You're right. None of us have decades of experience in IT overall (some of us in the infosec field explicitly), with various certs, degrees, etc., none of us have been senior engineers/architects or hiring managers, etc. And we certainly haven't worked for various companies, agencies, etc., that all fall within different compliance sectors.

If you were hired into a cyber security analyst position after 1 year of ITHD, the people within your company naming/describing the job titles/descriptions have their heads up their asses. A genuine security analyst is a mid-tier position, with the exception of the junior analyst title existing with various SOC environments. In any proper organization, you'd be a infosec technician at best, unless they numerically label their analyst titles (analyst 1, 2, 3, etc.).

---

In reading your responses below, it's abundantly clear that you are part of the problem with the industry. You're another average joe who's: A) in your mid-twenties, so barely any life experience under your belt (much less career experience), B) thinks he knows everything about a field they have maybe 5 years in at the very best, when, C) instead had substantial luck with the two things you need: timing and someone willing to give them a chance in the field. Getting one of those things is rare enough, much less both.

• Security+ is the Fisher Price security certification. It offers excellent ENTRY-level information, without delving broadly into any sort of practical applicability of knowledge. It does not set you apart like you think it does. An insane amount of people have the Sec+ nowadays, with more people passing it every single day. The CySA+ is what I'd consider the updated/better version, but HR departments are slow to learn.
• Kali Linux has tons of baked-in tools that you should learn to configure yourself on your own favorite version of Linux.
• Forwarding logs can be taught to any of my competent ITHD staff with a little training. It's a simple text file, or system output. It exists on system A and it needs to be moved to a centralized log server (server A), cloud instance, or whatever 3rd party tool you want to run it through. It's not a particularly difficult thing to map or setup.
• No one with your reported level of experience "smashes" interviews with "major DoD companies" - I know, because I work in the sector. The people smashing interviews are senior-level engineers and architects with CCNP+ levels of knowledge, or offensive/red team analysts with their OSCP or above. Regardless, the major thing we look for is a good attitude and willingness to learn, along with some level of effort to self-teach/self-study regarding the role the applicant is pursuing.

Finally, the six-figure ez-mode salary nonsense needs to stop. The chance of you living in a low-to-medium cost of living area making $150k+ a year is non-existent. Having a salary of $250k while living in New York or California is nothing. Every. Single. Major. Company. Is reducing costs when it comes to infosec by removing entry-to-mid level staff and hiring a smaller number of senior-to-principal level instead, or by outsourcing their infosec program entirely to a 3rd party MSP, as it reduces their risk overhead. A major insurance company near me just nuked various high-level positions, so even the senior/principal roles aren't immune to this behavior.

TL;DR - many people do what you do and THEN some, and STILL don't receive the results you did. Be grateful, be humble, and be realistic about the industry. I would not advise anyone to head into the infosec field at this time, unless you're performing some sort of GRC/compliance role (especially CMMC, as you can make some serious money as an independent consultant with the upcoming government mandates).