Yes, like all tech jobs that pretend to be in demand.

Security is usually worse than regular engineering, because it tend to be a succession of short quick gigs.