200 applications, 6 interviews, 0 offers: what the entry-level cyber job search actually looks like

I’ve applied to roughly 200 cybersecurity and IT roles since the start of my senior year. As of this writing the number sits around 195, and I’m being deliberately conservative when I round it to two hundred.

Six interviews. Zero offers.

The honest interview rate, against resolved applications (the ones that came back with either a rejection or a callback rather than the silent vacuum), is about 8.5%. That is, depressingly, not far off industry average for entry-level cyber in 2026.

I’m writing this post for three reasons. One: someone Googling “entry-level cybersecurity job search reality” deserves better numbers than the LinkedIn-influencer fairy tales currently filling that search result. Two: I built a tool to manage this mess and I want to talk about it. Three: I’ve learned some things that are worth writing down.

The numbers, unvarnished

• ~195 applications spread across federal civilian, defense contractor, commercial blue team, and IT analyst roles
• ~65 rejections. About 10 of those were auto-rejected within hours of submission. ATS filters killed them before a human ever looked at the resume.
• ~125 still in “Applied” state with no response. Most of these are functionally dead. Companies don’t owe candidates closure and most don’t give it.
• 6 interviews. Two were referrals. Two were inbound recruiter contacts who found me on LinkedIn. One was a cold application that made it to a final round. One I walked away from during the interview stage because it was a night-shift NOC role paying the same as my internship.
• 0 offers. Currently.

The pattern that matters

Of those 6 interviews, 5 came from referrals or inbound recruiter contact. Exactly one came from a cold application through a company’s career portal.

That ratio is the most important thing I’ve learned from this entire process. The hit rate on cold Workday applications is essentially zero. The hit rate on a referral or a recruiter reaching out is roughly 100% of however many of those you can generate.

I’m now spending the majority of my job-search effort on the activities that generate that second category. LinkedIn presence. Conference DMs. Cold emails to people whose work I respect. Replying to recruiter outreach with actual thought instead of canned interest. Asking veterans in my professional network for warm intros to their security teams.

The career portal is the slot machine. The referral is the front door.

Why this market is hard right now

A few things are true at once:

The federal hiring freeze has not lifted in the way people hoped. USAJobs postings exist but a meaningful chunk of them are placeholders or for internal candidates. Cleared roles in the DC corridor are real, but the entry-level slots are getting flooded by mid-career people pivoting from tech layoffs.

Defense contractor postings show similar pressure. Booz Allen, SAIC, Leidos, the primes are still hiring, but their entry-level cyber pipelines are competitive in a way they weren’t three years ago.

Commercial cyber is in its own contraction. The big SOCs and MSSPs that used to absorb entry-level analysts in volume have automated a lot of that tier-1 work or shipped it offshore.

The good news, if you can call it that, is that none of this is a you problem. The bad news is that the conventional advice (apply to lots of jobs, get the cert, use the spreadsheet) was calibrated for a market that no longer exists at the entry level.

What I built to deal with it

Around application 130 or so, I got frustrated enough to build a thing. It’s called sitrep, it lives on my GitHub, and it does roughly this:

It pulls postings from nine job sources (USAJobs API, ClearanceJobs RSS, Greenhouse and Lever direct APIs across about 90 defense-cyber companies, and a few others). It scores each posting against my resume using an LLM. It pulls recruiter contact info from Hunter.io enrichment. It generates a fit summary, an outreach draft, and interview-prep notes per role.

It does not auto-apply. It is not a spam cannon. The whole point is that the noise of the modern job board is so high that even a focused search wastes half your time on roles that aren’t actually a fit, and the way to fix that is with judgment-augmenting tooling at the discovery stage rather than volume hacks at the application stage.

It’s also the most useful thing I’ve built this year, and it came directly out of being annoyed.

What I’d tell past-me

Spend more time on fewer applications. I wasted easily 80 hours of my own time submitting generic resumes to roles that ATS auto-rejected within hours. Those 80 hours, applied to 20 tailored applications with custom cover letters and follow-up emails to the recruiter, would have produced more interviews than my first 100 spray-and-pray applications combined. I have the data to prove this.

Track salary data from day one. I have salary numbers on maybe 4% of my applications, which means I’m flying blind on compensation. By the time I’m in a final round I should already know the band. I don’t, because I didn’t record it.

The referral asymmetry is real and you should plan for it. If you graduate without a network, build one. The 5-of-6 interview ratio from referrals and inbound is not unique to me, every honest job-searcher I’ve talked to says the same thing. Plan your last semester accordingly.

Build something while you wait. Every recruiter who saw the homelab and sitrep on my GitHub asked about them in the interview. Every. Single. One. The certs got me past the resume filter. The projects got me past the technical interview. I would not have made it to a final round without both.

Where I am now

Still searching. The commission and the clearance, between them, dramatically change the kinds of roles that will respond to me, and a lot of the doors I knocked on six months ago are doors I should knock on again now that the resume reads differently. The job search is not over. It has merely entered a new phase.

I’ll write a post when I sign somewhere. Probably with similar numbers and similar candor. Until then, this is the data.

If you’re in the same spot, hang in there. The market is bad. You are probably not bad. Build something. Get a referral. Ask for the salary. Don’t take the $52k night-shift role.