My son just got a MA in cyber security and is having the worst time finding a job. They all want someone with experience.
What he found out is the kids graduating with BA's were doing OK finding jobs but for some reason he wasn't.
And he knows his stuff. He's got an impressive job at the moment and is doing well in it.
We don't get it.
So just my .02 here.
1) Degrees are nice, but the career field is new enough that many companies are not accepting degrees ONLY. Best to have a couple of certifications to back it up. I know a LOT of guys with NO degree who are making $150K with their certifications. Location is also a big driver. Big NFL cities pay far more that remote towns. And if you are in a remote town, be prepared for travel. Depending on what your son wants to do, I can point him towards the most common certifications.
2) Cyber security as an industry, has two flavors. Soft and Hard. Soft is the regulatory compliance side. Consultants asking questions such as ... DFS 500 requires a MFA policy. Please provide a copy of your current policy, your list of approved applications and a list of your current approved exceptions. The the consultant will conduct a gap analysis against the regulation (there are a bunch) and write a report on recommendations on how to close the gaps.
Hard side is the very technical but is mostly either 1) architecture (reviews of applications to ensure capabilities (such as TLS 1.2) or code reviews (known as either SAST or DAST) -or- 2) penetration testing (a highly in demand but limited skills set with it’s own set of certifications)
If your son is attempting to get a job outside of those areas ... yeah, it is going to be tough. Especially tough to get a management level position without experience. Not impossible and there are a few specific certifications that can bridge that gap.
I will send a private msg with my work email.