Working in cybersecurity in an average large company is usually miserable when you want to do it right. You are trapped between business metrics, laziness, and

Working in cybersecurity in an average large company is usually miserable when you want to do it right. You are trapped between business metrics, laziness, and lack of interest in modern technologies. On the one hand, you have businesses that claim that they will lose millions in revenues if their shitty site/service is down. Then you have users that do not give a crap about security: they have goals and security s not one of them. Finally, you have IT where there you either have under-the-radar operations for people interested in something, or an average to low understanding of technology. And there you are: you are "responsible" for making sure that the company is secure (per its ads) but cannot hurt the business. If there is an incident it is your fault anyway. It s not a surprise that burnout in cybersecurity is high. Or that security experts' goal is to have all the chekmarks no matter the reality (the ass covered approach). Or you have the rare CISO who will be pissed off by such things and will force their way to bring in real security (which is not rocket science: patch, configure correctly, use MFA and occasionally think before you do something). Some fail and leave, some become the enterprise assholes you do not want to deal with and, alllll right, you implement what they want because they piss you off. The unsung hero.