I would agree but I doubt the intended audience is "most people in the [infosec] industry" because the skillset of those folks, particularly experienced ones, i

I would agree but I doubt the intended audience is "most people in the [infosec] industry" because the skillset of those folks, particularly experienced ones, is quite lumpy but has an area under the curve that is substantially greater than what is included here. I think his target audience is new folks that are conceptually interested in moving into the domain. They don't know where where to start, largely because there is little regularity in how the incumbents got there. You've got folks with a degree and 15 years of systems engineering experience trying to figure out how to parlay an advanced skillset into the domain and teenagers speaking at security conferences. That said, it's definitely not necessary to have all of the skills mentioned in the article. There are a lot of efforts, including articles like this, to help pave a yellow brick road to the industry. Until then, for better but mostly worse, it selects for those that have faith they can get there and the tenacity to try until they succeed.