It’s ok to want people to have a lot of experience.

The problem is that too many firms was people who are infosec experts. But are only willing to pay entry-level salaries.