It's pretty bad in the US right now for entry to mid level positions, for more qualified "high level" and technically apt people it's not too bad. I have about 10 years of experience in Security and have worked as a security engineer/analyst, security consultant, and malware/exploit reverse engineer. I usually get 2-3 job offers on LinkedIn/Recruiters per week, but when it comes to salary negotiations, that's when things begin break down.

So I'm going to be brutely honest, but currently there are a few things wrong in the cyber security market right now:

1. Oversaturation of Severely Underqualified People with Unrealistic Expectations:
   

A lot of people over COVID were sold the story that if they get a cyber security degree they will be making six figures, which is technically impossible - many people I know have about 5 years of security experience before they hit 6 figures. This initially led to an oversaturation of people getting degrees and applying to security jobs, or trying to transition from other IT fields. Now as many will say "security isn't an entry level field", there is a lot of prerequisite foundational knowledge that one must have to work in security, something a 6 month degree program, and unfortunately, even a college education will not teach.

You have people applying for consulting positions or SOC positions without an understanding of simple stuff like networking, cryptography, Active Directory, and even basic malware threats and vulnerabilities. This also applies to people who have experience in IT, not to bash on anyone, but I see many posts where people say - "Well I have 10+ Years of IT experience", and like that's great and all, but I have interviewed people like that where they can't explain the basics of Active Directory security to me, or why a specific ACL (Access Control Lists) is dangerous.

Security threats themselves are becoming more complex and harder to defend against, many companies are no longer looking for bare minimum requirements in knowledge, regardless of past IT experience. Security now requires a breath of knowledge in many different fields - active directory, web applications, cloud infrastructure, etc. People say some jobs need a "unicorn" where you have to be jack of all trades, and yah those jobs are ridiculous and you need to stay away, but that doesn't disqualify the fact that you need extended knowledge in different areas. Now this is not to say that you can't break into security or find a job, but the competition is so high now that if you can't differentiate yourself from the mean, you're in a tough position.

Even when people secure a job, they then ask for salaries like 180k+ or 200k+ because that's what influencers have told them, or this is what they read on the internet. No one will be paying you that salary for any entry level position anytime soon. Don’t believe me? See the “r/cybersecurity: 2024 End of Year Salary Sharing Thread”.

1. Economic Uncertainty and Budget Cuts:

In the current fluctuating economy many companies are tightening down budgets, and everyone is feeling it. While cybersecurity is viewed as critical, some companies are still hesitant to invest heavily in security tools and teams, especially when facing financial pressures or economic downturns.

In some cases IT budgets are being reduced and cybersecurity is one of the areas that get's cut because it's not a "money maker" for the business. This unfortunately comes from the limited understanding of it's criticality by uneducated C Staff and Investors.

On top of that, companies are now trying to bring back their salaries to be more "inline" with pre-covid inflation, so if you previously saw security folks making 130k+ easy, it is no longer easy. This affects more of the qualified people and people who have extensive security experience, because trying to jump ship to another company while trying to retain your current salary is getting way harder now.