Just to add some flavour to your comment which don’t disagree with but might be helpful for people who are thinking about a career in cyber.

Cyber security is not one skill but a massive range of them. Cyber is just a catch all term which incudes the obvious Information Security but also less obvious Business Continuity and Physical Security. When people say cyber they typically mean InfoSec.

Entry level SOC analyst pay scales continue to drop. I regularly SOC analyst roles being advertised as low as £20-£30k. Ten years ago they were about £10k higher. But entry level SOC analysts are typically trainees or degree apprentices and aren’t doing much more than a call centre role. Often graduate programmes skip this step entirely these days.

Meanwhile security management pay grades (GRC, Assurance functions, etc) and architectural roles are continuously on the up due to the influence those staff have on costs, expenditure, technology landscape, and risk management.

You’d be hard pushed to find a GRC role in an organisation with more than 20k staff (and a whole load of IT and infrastructure) being advertised for less than £100k (you would, but ignore the numbers. No one who’s worth their salt is going to take anything less. A salary negotiation for an experienced professional would bump up the advertised range significantly. Typically those conversations start with “Ive worked for X, Y and Z and Ive delivered A, B and C. If you want me to do that for you then you need to pay me £££).

Specialist cyber roles are also continuing to climb in salary but I’d argue for the most part you’re typically just employing someone who already had those skills and simply pivoted into cyber (such as a Cloud Security Professional). Their salaries in a non security role were likely high to start with.

Cyber pay grades also scale with the size of an organisation. Tiny company with not much IT and data, lower pay. Massive company, larger pay. There’s more responsibility in a larger organisation and much further to fall if it all goes tits up.

Cyber, especially a management role, is one of the rare jobs in big business where non C-suite staff have the ability to make massive impactful change to the way an organisation operates. That’s why we end up being paid so much. It’s mostly about experience and proof of value. Cyber professionals typically go through massive pay increases with each step up or along a career path. Your worth can be based on who you’ve worked for and how they’re perceived.

Of course I haven’t mentioned working for consultancies and MSP/MSSPs which is a whole different kettle of fish. Potentially career limiting if you want to transition from telling people how to do things rather than doing them yourself. But there’s still an obscene amount of money to be made if that’s a path people want to go down.