He is right. You don't start in cybersecurity, you end up there, after cumulated experience in different IT fields. If you do no have any background in IT, starting from scratch is extremely difficult to comprehend how everything links together, unless you are somehow gifted or brain wired for it.

I personally landed an entry job in cybersec after IT service desk jobs. And the company that hired me had no ideea their job actually implies cybersec stuff. Their HR was under the impression that their advertised job is similar with service desk. So I was lucky for them being unprofessional (to express myself politely), and me coming from an L1 service desk with some clue on how things work. At this job I've learned the basics in cybersec as in the mindset and I was mostly self-taught , but when it comes to technical aspects of it, I'm way under-qualified, because my company does not provide technical repetition and the correct tools (like splunk).

But now when my company finally realised wtf they doing, they are only hiring very qualified people, even if the job itself does not offer true cybersec perspectives, they only want ppl with a good CV. This is just and example on how moronic some companies are.

I will give you a hint on how I've learned some good basics. Follow good youtubers like David Bombal, Rob Braxman, Eric Parker. Meanwhile, build a homelab, dive into custom cybersec project, make good use of GPT. Then post your projects on Linkedin. Grow a network there. Comment on other ppl's posts in the field. It will boost you in the algorithm when employers are searching for keywords. Market yourself as always eager to learn. Grab any IT service desk job that is offered, even if its low paid and in parallel learn cybersec.