The Real Truth About Cybersecurity Careers: The Harsh Reality at Junior, Mid, and Senior Levels

Why Do People Leave the Cybersecurity Industry?

Jerry points out that those who wash out of cybersecurity almost all share one thing in common: they thought it was a nine-to-five office job, but it isn't. On Christmas 2014, the hacker group Lizard Squad attacked PlayStation Network and Xbox Live, and many security professionals spent Christmas morning in front of a keyboard rather than with their families.

Underfunding is another reality. According to an ISC2 survey, 36% of organizations are cutting budgets, and one-third say outright they can't staff up adequately. This means you will almost never get all the resources you need to do your job.

But Jerry isn't trying to discourage anyone—he's emphasizing that there is no single answer in cybersecurity because the job itself evolves: the work in year one, year eight, and year fifteen are completely different. Most "day in the life" videos focus only on the early career, when what you really need to understand in advance is this: the traits that get you into this field also expire in later stages.

Lizard Squad was a hacker group active around 2014, known for launching large-scale DDoS (Distributed Denial of Service) attacks. It claimed to have compromised Sony's PlayStation Network and Microsoft's Xbox Live, preventing millions of players from logging in during the Christmas holiday. For security practitioners, events like this mean: holidays are often peak periods for attacks, and Security Operations Centers (SOCs) need 24/7 coverage—so the expectation of a "nine-to-five" never held from the start. This also explains why many security roles use shift schedules and why Incident Response has become a specialized discipline.

Junior Stage: Hunger and the Ticket Queue

The daily life of a junior analyst (1–3 years) is basically a queue: alert tickets, requests, someone flags something, and then it becomes your problem. Most of what you see is "nothing." The entire value of the job lies in finding that one "something" among a pile of "nothings."

It's more technical than people expect—you need to read logs, build intuition for what "normal" looks like, and get to the point where anomalies jump out at you automatically. But what those videos don't tell you is: once you find the problem, your job immediately becomes writing—writing it clearly enough that someone else can act on it. Day one is a writing job, and almost no one tells you this in Security+ prep or bootcamps.

The requirements at the junior level are simple: be reliable, be curious. No one expects a junior analyst to know everything—they expect you to chase down the things you don't know.

On pay, Bureau of Labor Statistics data shows the bottom 10% of information security analysts earn less than $75,000. The upside is that you're getting paid to learn, and you grow faster than anywhere else in tech—18 months later you'll be a completely different professional.

The costs are real too: the ISC2 survey found that 48% of practitioners say they're burned out just trying to keep up with new threats and technologies. This pressure of continuous learning starts at level one and never stops.

Who exits at this level? The people who wanted to play the hacker-movie role but got stuck in a ticket queue. The trait that carries you through year one is hunger, but hunger has a shelf life—around year three or four, things change.

ISC2 (International Information System Security Certification Consortium) is the global security professional organization behind the CISSP certification. Its annual Cybersecurity Workforce Study is one of the most widely cited surveys of practitioner status in the industry. The figures mentioned in this article—"48% of practitioners burned out," "36% of organizations cutting budgets," "32% lacking advancement opportunities"—all come from this survey. This matters: these numbers aren't isolated feelings but systemic trends covering thousands of practitioners, showing that budget constraints, understaffing, and burnout are structural industry problems, not personal competence issues.

Mid Stage: Judgment and the Fork in the Road

At the mid level, you start to own things: a system, a process, a project. Work is no longer assigned to you—it belongs to you. What's new is that you start getting told no—no budget, no headcount, no priority. You know the right answer, you can prove the right answer, but someone with a spreadsheet tells you it can't be done this quarter.

The demand on you shifts from "finding problems" to "judgment": deciding which of the 15 items on the list is worth the organization's money this year. Pay also jumps substantially—Bureau of Labor Statistics data shows the median information security analyst salary is around $129,000.

You'll also start focusing on a specialty—a SOC analyst might move into detection engineering, a penetration tester might lean toward mobile applications. You become the go-to person for a certain type of work, and you start taking on responsibility for mentoring newcomers.

Leadership or Staying Technical?

Most career paths are described as junior, mid, senior—but not in cybersecurity. In the mid-to-late mid stage, you hit a fork: take the leadership track or stay hands-on. Most people frame this as technical vs. management, but Jerry thinks that framing is completely wrong.

When people hear "management," they think project management—I assign tasks, you complete them, you report back, I make sure your paycheck arrives. That's only part of it, and the easier part. The real work is people work: someone tells you a teammate's manner of speaking makes them uncomfortable, someone has something going on at home, someone doesn't want to work Fridays anymore, someone has decided you don't appreciate them. It's round-the-clock emotional labor that never appears in a job description.

Jerry shares a real case: a technically strong, widely respected friend recently moved into management, and six months later the company asked him to return to his original technical role—not because he missed deadlines, but because subordinates complained about his management style, and he probably didn't enjoy management work himself.

The other side of the fork has costs too. If you decline the leadership track, your income and advancement can both hit a ceiling. In the ISC2 survey, 32% of practitioners cited a lack of advancement opportunities and 31% cited inadequate compensation. Many people tie their identity to their title, and when the title stops moving, they interpret it as a verdict on their self-worth.

The lesson at this level: if you go into leadership, it should be because you genuinely want to help people who are struggling, to shape their direction and the direction of the information security program—not because the pay is higher. Who exits at this level? People who took leadership roles for the money and found it was a job they didn't want. The trait that carries you through this level is ownership.

Senior Stage: Communication Is the Ultimate Skill

The daily life of a senior is meetings, strategy, budgets, risk discussions, sitting with departments that aren't yours, rarely touching a keyboard. People often say technical skills rust, and that does happen, but the bigger problem is: when an entirely new tech stack appears, you have no time to learn it.

Jerry uses his own experience to illustrate: while he was a cybersecurity architect at MUSC—the top technical role at a multi-billion-dollar company—the organization underwent a massive migration to a Microsoft Azure hybrid environment. New identity models, new access controls, new configuration methods, none of which he understood. He didn't understand not because he was lazy, but because he'd been promoted twice without backfill, effectively doing three people's jobs, with no capacity left to learn a new stack. And the tech stack doesn't care about your capacity.

He chose to "fake it"—doing his best but knowing he was missing things. When you're a senior figure and people make decisions based on your judgment, that's a terrible state to be in. It made him question not the strategy but the quality of what he was delivering.

This is what "never getting all the resources you need" looks like at year 15 of a career: not a tight tooling budget, but you yourself being the resource they're short on. You fall into a strange zone: the keyboard has rusted, the leadership skills were never learned (because no one taught them), and 15 years into a career you feel like you're not good at anything. Worse, the industry has technical certifications, but this transition has no certificate, no course, no clear next step.

Communication Is Massively Underrated

The sharpest tool at this level is communication. You talk to the board one way, to finance another, to engineers another, to end users another, and to the people who report to you yet another. Most people assume that being able to speak a language means being able to communicate—an assumption that can end your career, while technical gaps almost never will.

This isn't a personal opinion. The ISC2 survey asked what managers value most: problem-solving 29%, collaboration 24%, communication 22%—two of the top three are non-technical skills.

A salary ceiling does exist: Bureau of Labor Statistics data shows the top 10% of information security analysts earn over $199,000, and that's analysts, not executives. Jerry's own top salary was $140,000; he once received a $170,000 offer but turned it down, so he cautions you to take these numbers with a grain of salt.

There's another rarely mentioned shift at the senior level: you'll meet people who have actually been victimized by criminals. You sit with them, and you may have personally been through incident response. It changes how you carry the work.

The upside of this stage is that you stop fixing things and start deciding what gets fixed.

Some will say: you don't have to go the management route—you can be a principal engineer, a staff engineer, an individual contributor, and stay technical forever. Those roles do exist, and for the right people they're the best jobs in the industry. But there are two caveats: such roles are far rarer than expected and concentrated in large companies; most organizations simply don't have such a position to give you. When Jerry worked at Booz Allen, a company of 50,000 people, the role didn't originally exist there either—it was introduced only after people started leaving rather than being pushed into management.

Hybrid cloud and identity model migration are common challenges for senior security architects. Cloud platforms like Microsoft Azure introduce entirely new identity and permission systems—Entra ID (formerly Azure AD), role-based access control (RBAC), conditional access policies—that differ greatly from the trust models of traditional on-premises Active Directory. If a security architect can't keep up with these changes, they can't assess whether access controls are sound or identity boundaries are clear. This illustrates that the technical risk at the senior level is often not "not knowing how to use a tool" but the organization no longer giving you the time to learn a new paradigm.

Humility: The Trait That Spans Every Stage

Jerry returns to the end of the Azure story: he went to a trusted colleague and told them he was struggling with the Azure stack. The colleague was his peer and remains a friend to this day. It was that simple—the person was good at it, took the time to walk him through it, and answered questions. A person with 16 years of experience was brought up to speed by a peer.

The trait that carries you through every stage of cybersecurity is humility. At the junior level, it's admitting you don't know. At the mid level, it's admitting that your favorite project isn't the priority. At the senior level, it's admitting that you're a beginner again at something you thought you'd never have to learn. What sinks people isn't the knowledge gap—it's not communicating, and being too proud.

AI Is Compressing the Technical Half

Jerry closes with a look at AI: the technical half of junior work is steadily shrinking; the judgment and communication half is not. That means the entire transition will arrive earlier than it did for his generation—the wall he hit at year 15 or 16 may be hit by later arrivals at year 8 or 10.

Is cybersecurity right for you? The honest answer is: it depends on which version of it you're prepared for, and that's something you can only discover along the way. But one thing can be decided today: whether you're the kind of person who says "I don't know, but I can find out"—whether facing a new acronym, a new tech stack, or the transition from keyboard to soft skills.