RMFInsider

Cybersecurity is not oversaturated. The bottom rung of it is. In 2026 there are two job markets wearing the same name: an entry-level market where a remote “junior SOC analyst” posting collects several hundred applications in a weekend, and a mid-level market where hiring managers cannot fill cleared ISSO, GRC, cloud security, and detection engineering seats after three months of trying. The gap between those two markets is roughly two years of experience plus one clearance, and the entire game for a newcomer is crossing it as fast as possible.

I see this from the inside. I am a working DoD ISSO in Hawaii, I have watched cleared openings sit unfilled for a quarter, and I also read the comments on my TikToks from people who have sent 300 applications and heard nothing. Both of those things are true at once, and this post is about why, and what to do about it.

What “oversaturated” actually looks like from the employer side

When a posting for a first-year analyst role goes up on a big job board, the applicant pile splits into a predictable shape. A large share are people with zero certs and a bootcamp certificate of completion. A second share hold Security+ and nothing else, no lab, no project, no writing sample. A thin slice have a cert plus something they built plus a resume that describes it in the language of the job description. That thin slice gets the phone screens. The posting still shows “500+ applicants,” and everyone in the other two groups concludes the field is closed.

So the honest answer to “is cybersecurity oversaturated” is: the applicant count is saturated, the qualified applicant count is not. That distinction is annoying, because it puts the burden back on you, but it is also the good news. You are not competing with 500 people. You are competing with the 20 or 30 who did the work, and you can see exactly what that work is.

Why entry-level got crushed (the real causes)

• The 2023 to 2025 layoff cycle pushed experienced people down into roles they were overqualified for. A displaced five-year analyst applying to a junior posting beats a new grad on paper every time.
• Bootcamp and influencer marketing created a wave of applicants who were told a 12-week course equals job-ready. Hiring managers learned to filter, and the filter catches the honest beginner too.
• Remote postings are national postings. A remote junior role in 2019 drew from one metro. Now it draws from all fifty states, and the applicant count reflects that even when the actual hiring bar did not move.
• AI-assisted applications made it free to apply to 200 jobs in an evening, so recruiters now see volume that has no relationship to intent or qualification.
• Entry-level roles got absorbed. Tier-1 SOC triage is increasingly automated or outsourced to MSSPs, so the historical on-ramp shrank while the number of people trying to use it grew.

None of those causes touch the mid-level shortage. They only pile up at the door.

Where the openings actually are in 2026

If you look at where seats stay open the longest, a pattern shows up, and it is not glamorous.

Cleared DoD and federal work

This is the largest, least advertised, most structurally under-filled segment in the field, and it is my lane. A defense contractor cannot hire a brilliant candidate who cannot obtain a clearance, and the clearance pipeline throttles supply in a way no bootcamp can fix. The result is that entry-level cleared roles, including ISSO, security control assessor support, and vulnerability management, routinely pay in the range of roughly $85,000 to $110,000 as of 2026 for people with a Security+ and a willingness to learn eMASS. The federal and DoD route into cybersecurity walks through who sponsors clearances for new people and how DoD 8140 turns a single cert into an eligibility ticket. My own ISSO salary breakdown has the GS and contractor numbers.

GRC, compliance, and risk

Governance, risk, and compliance roles are undersubscribed because they sound boring on TikTok. Nobody makes a viral video about writing a control implementation statement. Meanwhile every regulated company, every federal contractor, and every cloud provider needs people who can read a framework, map it to evidence, and talk to auditors without panicking. The technical bar to enter is lower than SOC work, the ceiling is high, and the ISSO job is the DoD version of it.

Cloud security and identity

Not entry-level in the strict sense, but reachable in 18 months from a help desk or sysadmin seat. If you already administer Entra ID or AWS IAM, you are closer to a cloud security role than a fresh Security+ holder is to a SOC role.

AI security and governance

Brand new, thinly staffed, and being handed to GRC people because nobody else wants to own the policy side. I wrote about the specific AI security skills GRC and ISSO roles are asking for because it is one of the rare places where a newcomer and a 10-year veteran start from a similar knowledge base.

The two-year gap, quantified

Here is the arithmetic that makes the “oversaturated” debate mostly noise. Approximate, dated to 2026, and drawn from what I see on postings and hear from peers, not a survey:

• Zero experience, Security+ only: hundreds of competitors per posting, offers in the roughly $55,000 to $70,000 range when they come, often help desk with a security flavor.
• Zero experience, Security+ plus a documented lab or project plus targeted applications: the competitive pool drops to dozens; same salary band, but the interviews actually happen.
• One to two years in any adjacent seat (help desk, sysadmin, junior GRC, cleared anything): the pool thins dramatically; roughly $75,000 to $95,000.
• Two years plus a clearance or a specialization: recruiters start messaging you; six figures becomes normal rather than aspirational.

The field is not saturated at rungs three and four. It is saturated at rung one, and rung two is available to anyone who does the extra 100 hours. The whole strategy is to spend as little time as possible at rung one.

How to not be the 500th applicant

These are the tactics that separate the thin slice from the pile. None of them are secret. Almost nobody does all of them.

• Apply to fewer jobs, better. Ten tailored applications where your resume mirrors the posting language beat 200 one-click submissions. Applicant tracking systems rank on keyword match, and the human on the other end ranks on whether you clearly read the posting.
• Build one thing and write it up. A home SIEM, a hardened VM with the STIG findings you closed, a vulnerability scan with a remediation report. Put the writeup on a public page and link it from the resume. This alone removes you from the bottom two groups.
• Go where the applicants are not. On-site roles in second-tier metros, defense contractors near a base, state and local government, hospitals, utilities, and credit unions. The posting with 40 applicants is a better bet than the remote posting with 900.
• Get cleared, or get clearable. If you are a U.S. citizen with a clean-enough background, a contractor willing to sponsor you changes your entire market. The first ISSO job guide covers how people get sponsored with no clearance and no experience.
• Take the adjacent job. Help desk, NOC, sysadmin, IT audit, or a junior GRC role at a contractor. Twelve months there beats twelve months of applying to SOC roles from outside.
• Talk to humans. Local ISSA and ISC2 chapter meetings, BSides, and the DoD-adjacent meetups near bases have hiring managers in the room. I have watched people get referred on the spot for showing up twice.

The DoD angle, plainly

I want to be direct about why I keep steering people toward the cleared route, because it is not just that it is my world. It is the one segment where the structural shortage runs in your favor at the entry level. Every contractor supporting a DoD program has to fill 8140-coded positions with certified people. The certification requirement (Security+ satisfies the common baseline for ISSO-type roles) is public. The pay is public. The demand is public, in the form of postings that sit open for months. And the main barrier, the clearance, filters out a huge share of your competition before you ever apply.

The trade-offs are real: nearly all of this work is on-site, the paperwork is unglamorous, and you will spend your first year learning acronyms and uploading artifacts to eMASS. I have personally watched an ATO package sit in a queue long enough that the system it authorized got a hardware refresh. But an ISSO at a mid-size contractor with two years in and a Secret clearance is a six-figure employee in a market where the SOC analyst with the same two years is still fighting for phone screens.

Who should actually worry

Some honesty in the other direction. The field is genuinely a poor bet right now if you plan to earn one cert and wait for the market to come to you, if you are unwilling to relocate or work on-site for the first role, if you cannot obtain a clearance and also will not consider GRC or adjacent IT work, or if you dislike reading and writing (compliance is a writing job; so is incident reporting). If two or more of those describe you, the “oversaturated” narrative will feel true for a long time, and it is better to hear that now than after a $15,000 bootcamp.

The bottom line

Cybersecurity has an oversaturated front door and an understaffed building. The people who get in do not out-apply the crowd; they route around it through adjacent roles, cleared work, GRC, and one documented project that proves they can do something. If you want that sequenced week by week, from the first cert through the first offer, the 6-month no-experience plan is the free version, and Zero to Hired is the full roadmap with the checkpoints filled in.