From my experience, the problem is that most infosec positions are powerless to do anything to increase security at the company, and are primarily there for PR or compliance reasons. The positions seem to be mostly filled with people who wanted to make a career change for the money; experienced people usually leave to work at private security companies, or FAANG sized companies.
This. A million times this. I can’t tell you how many netsec roles are staffed by people that are content being a butt in a seat and have zero effect on the overall security of a corporation.
