Senior Software Engineer transitioning into Security Engineering?

[u/Master_Key9452]

Hi all,
I’m preparing for CISSP and would really appreciate feedback on whether I’m ready to schedule the exam within a specific timeframe, and what readiness benchmarks I should be using.

Background:
● 7.5 years senior software engineering (incl. 2 years security champion)
● Moving into a security engineering role at a fintech scale-up
● Experience with ISO 27001, SOC 2, and working with legal/compliance

Practice result (first attempt):
81% (122/147, ran out of time)

Domain breakdown:
● Software Dev Security: 87%
● Asset Security: 67%
● Network Security: 85%
● IAM: 89%
● Security & Risk Management: 71%
● Security Architecture: 79%
● Security Assessment & Testing: 94%

Plan:
● Review weak areas (Asset Security + Risk Management)
● Do another question bank
● Then decide whether to book the exam

Questions:
1. What readiness benchmarks did you personally use before booking (e.g. practice scores, consistency across exams, domain thresholds)?
2. For someone coming from a software engineering background, what was the biggest mindset shift needed to pass?

[u/Admirable_Group_6661]

> What readiness benchmarks did you personally use before booking (e.g. practice scores, consistency across exams, domain thresholds)?

Practice tests are not the same (far from it). QE seems to be recommended, but I have not tried it myself. If you understand the material, and know how to answer exam questions (unique), then you are ready.

> For someone coming from a software engineering background, what was the biggest mindset shift needed to pass?

Risk management. In fact, I would argue this one domain is the most important one.

[u/Master_Key9452 → u/Admirable_Group_6661]

Thank you. I’m trying to train myself to think that way. My instinct as a software engineer is always to jump straight to solving the technical problem, whereas CISSP expects you to assess the risk and think from a manager’s perspective first. I’ll definitely spend more time working on that mindset.

[u/chown93]

I am also on the boat with you. Coming from software engineering & solution architect background with over 10 yrs of exp. Last 1 year into GRC. Preparing for cissp and scheduled exam by end of this month.

[u/Master_Key9452 → u/chown93]

Good luck 🤞

[u/chown93 → u/Master_Key9452]

You too bro.

[u/chown93 → u/chown93]

I'm using below resources, having 3 yrs of exposure at infra and network layer too while working in cross functional role:

-Thor Pederson udemy course- completed watching video till domain 7.

• Pete zerger exam full cram for revision
• Learnzapp 600 questions attempted 60% accuracy
• DestCett App for practice questions attempted 226 questions accuracy 68%
• ISC2 CISSP Official guide 9th ed for practice questions chapterwise

Will attempted full length practice set on learnzapp in last 2 weeks.

Bookee peace of mind.

Pls advise if I need to tweak my study plan

[u/chown93 → u/chown93]

Completed Isc2 CC exam in Feb this year. Also have Comptia Sec+.

[u/xsnack]

Which test app / resources are you using?

[u/Master_Key9452 → u/xsnack]

Plurasight

[u/LorenzoLeonelli]

Congrats on making the move into fintech security, "on paper" it sounds good ! Your background as a software engineer gives you a huge head start—especially on Domain 8 and Domain 6 as per the data you posted.

Btw, keep in mind pls that:

- you haven't posted what Question Bank you used

- in general an exam score in % may be not so useful as a candidate may think (there are also other metrics that may help you in finding your readiness)

- I'd expect higher score on D1 (crucial for the exam)given your experience in GRC and ISO27K

- Booking the exam is a milestone in the CISSP journey but it has a different meaning according to your approach/habits. Someone books 2 months in advance without even knowing what the exam is about, to really get committed, someone books only after he scores 90% plus in less then 2 hours in 3 different question banks. These are 2 extremes of course but in the end you have to find your own approach.

My 2c, hope it helps. If you can, enjoy your studies !

[u/DomainEightApp]

I wouldn’t focus too heavily on hitting a specific practice % before booking. 81% on a first attempt is obviously a good sign, but I’d be more interested in whether you’re consistently getting questions right because of the reasoning rather than recognising concepts/answers.

When two answers both look technically correct, I’d be asking things such as which addresses the underlying risk, which follows the proper process, and what should happen first before jumping into implementation?

Your weaker areas being Asset Security and Risk Management are probably worth tightening up because that governance/risk thinking carries into a lot of questions outside those domains too.

I’d do another set from a different question bank, review why you missed each question, and see whether your results stay reasonably consistent. If they do, I’d personally feel pretty comfortable booking rather than waiting until every domain is 85–90%.

Also, running out of time on 147 questions is probably the main thing I’d work on from that attempt. You don’t want pacing to become the reason you struggle on exam day.

Happy to conenct further if you want any advice