Starting this somewhat crudely, because I want to make the point clear early on - SOMETHING feels wrong right now, specifically with the way that hiring and layoffs keep happening in our industry. I don't care to draw attention to my own personal situation but want to provide some background which will hopefully establish some bonafides.
I got started in IT services doing End-User/Small Business PC diagnosis and repair. I spent approx. 15 years doing various degrees of the IT career ladder (Service Desk, SysAdmin, Network Admin, Systems Engineer, etc.) before finding out how exhausting and soul sucking that was. Having been so tired, I asked around to see what I might be able to take my experience and use it for besides what I was already doing.
The topic of using the skills in cybersecurity was one that came up quite a bit, being recommended to roles in SecOps. This was in roughly 2020/2021. I took the advice and found a place that let me engage in ransomware remediation (more than I had been doing at my level). I was able to keep that one on my resume for a couple years as I was contracting for them on an as needed basis. The work was AWESOME. I operated as the lead for a MSSP startup that was dealing in mostly reactive manners to ongoing ransomware cases. I got to spend 8-14 hours a day digging into how TA's TTP (Threat Tactic Procedures) changes as the event is happening. Working against some of the largest players at the time in the space (BlackBasta, Conti, Lockbit, etc.)
After doing that role for a couple of years, I eventually moved into a more consultant based role where I got to be a bit more proactive (with a healthy bit of reactive mixed in). I got to engage in audits based off of the NIST CSF 2.0 Framework and got to remediate the actions items I found during the audits. I thought that this would surely help me round out my security resume and that if I ever ended up back in the job market I would be better off for it.
To be fair, I wasn't counting on not having a job at any point (then again, who is?) I was fully committed to this company, when one of their customers got hit w/ ransomware because of a decision one of the previous owners had made in creating local accounts on their exploitable firewall that were eventually found and used - I was the one that spent 80 hours over 7 days in that customers office getting things back up (despite the ESXi host being completely encrypted along with the datastores).
But alas, bad things tend to come quarterly when your industry is considered a cost-center for most companies. After taking vacation in Nov '24 out of the country, I came back and was told "We don't have enough work to sustain your bosses salary AND yours, so we are laying you off effective immediately. I was as cordial as possible, returned my equipment, and asked for severance since this was a layoff and not a termination. "We have never done that in the past, so we won't be doing it now."
Obviously, as someone who likes the work I do I immediately shifted gears, tried to find as many companies as I could to apply to with the experience I have. Trying to use the 80-90% required experience rule (if you meet 80-90% apply anyway) that I was always taught growing up and on my way into this field. But it really seems to have gone absolutely nowhere.
It's been 10 months now and I am still looking, very actively at that. I spend hours a day on LinkedIn looking for companies (which is how I found the last 4 roles I had prior to this) to apply to. Even ditching the 80-90% rule in favor for a 100% one. I do OSINT on companies and try to connect and DM hiring managers/recruiters/other employees. Again, adding more time to the already miserable process. I was forced to apply for unemployment, which at this stage has come and went - leaving me with absolutely nothing to bring in income (which I can only imagine based on what I see on LI that several others with similar skills and experience are going through the same).
But when you look at the people that are specifically in charge of that first level of contact? The recruiters? They are too busy making posts on LI about how they "can't be humanly expected to view every candidate that submits an application." Even better is the "Just let AI handle it, it'll tell you which ones are the good ones worth reaching out to" people. Because from what I can see, the ATS doesn't like your resume formatting? Low rank. Doesn't understand the similarities between keywords in your resume/profile and the job description? Low rank. What happens when that does finally get to the recruiters eyes? They call the first 20 in their "top ranking" list and schedule them interviews. Everyone else gets a crappily worded message (if they are lucky) about how the company loves that they put their time in but aren't going to even do them the kindness of talking to them before assuming they don't have what they are looking for.
The hardest part? Now there's all these services that will submit your app for you autonomously, inputting in your data/etc and matching you to whatever keywords you tell it to apply for and basically every AI will write you a resume if you tell it to. So what is really going on? AI is reading the resumes that AI is writing? Nobody is getting work?
There's people with double my time in the field saying they are seeing the same problem. They aren't getting work either. They get completely ignored when 2-3 years ago they were called early into the process and typically saw all of the processes through to the end.
SO back to the point - what the actual heck is going on? (I'd love to be more animated here)
How many times should you edit your LI profile, your resume, your email header, etc. before everyone stops for a second and recognizes something is wrong. Companies like ISC2 ignoring/not validating 5-year requirements and letting SD people that did PW resets in AD for 5 years pass the mark for their minimum requirements, yet somehow are the expected industry norm now?
Honestly, as much as the work makes me feel like a used towel, I'd rather go back to systems engineering making half the money just to avoid these companies that really feel like walking on eggshells. Which makes me super sad, when I talk to others in the industry they say they love the work too. That it brings them enjoyment or at the least fulfillment. But not working for 10 months? No interviews in the last 3? I just don't know anymore if it feels like the place I can keep trying to stay in when there really doesn't feel like much of a foundation to stand in.
TL;DR Cybersecurity job market in the USA feels very shifty, on constantly unsettling sands. Doesn't matter if you have or don't have experience, people all across the sector are saying it feels impossible to get hired or to even get the time of day from recruiters. It feels like something is broken and wrong, and not sure how else to pinpoint the issue other than it feels like a market created by HR/recruiters who don't actually have any knowledge of what we do but disqualify us based on what their ATS tells them (even if frequently wrong).
EDIT: Before anyone else comments here with the same rough advice let me be clear and save you some time. I already reach out to friends/past co-workers extensively when able. No, I do not have a bad relationship with anyone of my recruiters or past co workers just because I respond negatively to your cookie cutter advice. Yes, I do cater my resume to each job I apply to and have done so for at least six out of the ten months I have been in the market. Yes, my experience goes extensively beyond what is listed in the post because I was trying not to bore everyone with my life's story. If you're that interested, look at the comments and I am sure you can put together some of my experience. No, I have not ever had an issue like this in the past 20 years worth of networking and applying to jobs (short of a 5 month window in 2020 after my contract ended for lack of physical work) or in trying to set up business with customers/clients. Lastly, yes I REALLY have been doing this since I was 12 - it's fine if you got to live a privileged upbringing but if I wanted to make enough to eat and have even the smallest amount of required items to go to school and live a decent childhood I had to work for it early on. I don't care if "you read that and immediately thought it was bullshit" nor do I care if you caught one slip I made while writing the original post on TTP (Tactics, techniques, procedures) in the middle of the night. The reality of the amount of ransomware I have stopped, the amount of attacks I have reversed, the amount of companies that wouldn't have been running if not for my help, the amount of courts that have paid me to be an expert witness, frankly - it's enough proof for me. If it's not enough for you, rather than berate me and tell me I am in the wrong industry or that I "need to edit my resume" for the 1000th time, why not instead question others in your own network and ask them if they are going through something similar. Because I would go beyond a shadow of a doubt to say that they'd agree. Everyone I know, 3,5,10,20,25 years of experience is going through this. It's not a matter of us just suddenly forgetting how to make a decent resume or how to communicate with people. To even insinuate that is a fallacy built on your own misconception of the job market. Be it based on your own bias from experience or seeing others. Stop trying to give me unnecessary advice that I didn't ask for and getting upset that I am not reciprocating that. Because things like "Edit Resume, Message your network, surely you are just not doing it right" not only are completely worthless, they're already being done and have been being done for YEARS. They just are not working now, and that is my whole point in this post.
