Having worked in the infosec community for close to 20 years now... What you are seeing is the result of the commoditization/expansion/specialization of the ind

Having worked in the infosec community for close to 20 years now... What you are seeing is the result of the commoditization/expansion/specialization of the industry. The issue with security is there is literally unlimited work and only a certain amount of budget to work through it. So CISOs are constantly looking for tools to automate or reduce the dependence on people and to be frank, they are all pretty shitty. Then what happens is the CISO has blown his budget on tools that supposedly automate all this work and designed his program so they don't need "rockstars", because they are expensive (aka people who know what they are doing). Whats happening right now is that the only companies that can afford or attract competent people in the industry are large tech companies (and even some of those have incompetent leadership and can't attract decent people). Really good security people are basically consolidating at a few dozen companies and are kind of handcuffed there because other places are terrible to work at/don't pay as well. So basically you see this massive delta between the people who know what they are doing and the ones who have gotten into the industry in the last 3-5 years. One of the massive downsides to this consolidation is the places that are willing to hire early in career positions don't have experienced staff to mentor these new folks. And since there aren't good mentors, people aren't picking up the skills you would want/expect from them.