There are no employers in security that I know that anyone wants to work for that take certification seriously. The best people working in security --- not just in application security but in network security, red-teaming, exploit development, and cryptography --- don't have certificates.

If you want to work in startups, a hiring process that even asks if you have a certification is a big red flag. This is less true in the broader tech industry, but while it's probably not a good idea to discard a prospective Fortune 500 employer just because they ask if you have any certifications, it is certainly reasonable to pull the ejection lever hard if an employer cares about them.

Every minute you'd spend pursuing certification is better spent building programming skills.

For whatever it's worth, I still stand behind everything in here:

https://krebsonsecurity.com/2012/06/how-to-break-into-securi...