@ChaiFanatic This is sheer ignorance. Your friend is either not good at his job or is oblivious of the current opportunities in this field.
@ajcgxd Cyber security is a thriving space. There’s no job role/title of an “ethical hacker”. Cybersec is a huge field and can be broadly classified into 3 areas - offensive security, defensive security, and GRC (governance, risk, and compliance)
Since you specifically asked for the role of an “ethical hacker” I’ll give you my two cents. The professional terminology is Penetration Testers. This role falls under the offensive security category. Their role is to emulate the actions of an actual criminal and break into an application or network to find flaws and loopholes.
Most of the cybersecurity engineers you’ll meet would have started their careers with this role (even I did).
For a beginner, I’d suggest learning about how the internet works (basically what happens when search for a website on browser), the OSI model, how different technologies work (ex SQL, JS, SOP, CORS, etc), linux fundamentals, using the command line, OWASP top 10, HTTP headers and status codes, TCP/IP handshake.
You can start by using platforms like TryHackMe or HackTheBox - these have academies where they’ve defined learning paths based on your competency. This would be a great place to start.
There is no defined timeline to be considered “learned enough”. It all depends on how much time you’re devoting to learning and applying the skills. You can build your credentials through certifications as well (ex OSCP, OSWE, eJPT, etc).
With regards to jobs, cybersecurity has a massive skill shortage. There are plenty of opportunities across various roles. Cybersecurity is a hot field right now, in-line with AI and Data Science.