That’s my field. Yeah, it can be hard to get your foot in the door, but once you’re in, you’re in. The nice thing is that all the info and experience you need is freely available. Want to show off malware analysis skills? Download a sample, tear it apart, write up your thoughts, and post it in a blog. Link to it in your resume. I’m a hiring manager, and I read those. Is network analysis more your thing? Malware-traffic-analysis.net. Know what we need? People who know what the three major cloud providers’ security logs look like and know when something actually bad is happening, because the default alerts are pretty useless. Same for O365 logs. Sometimes, I feel like our userbase wants to get their accounts compromised.