Franko's response had much of the details of it accurately.
For the Nuts and Bolts of it, you need certifications. The whole industry uses certifications as the "acid test" for employability.
Usually the bottom rung certification is a Comptia Security+ with a continuing education requirement. Higher rung certifications are CASP and CISSP. You also need to be rounded out with some functional Network knowledge, minimum being Network+, with CCNA being surprisingly well respected. I find that many in the industry have little understanding of network basics (like what Network+ and CCNA give exposure to). This makes their Security conceptual applications significantly weak.
After a year of seasoning, it is not uncommon for network security pros to get 100k+ jobs, depending upon market. Many of the splashy security leaks you have heard about in the news have been due to VERY bad security practices. Even moderately good security makes a big difference, unless your organization is a high-value target.
I will say that some of the new threats are fairly complex. The recent Solar Winds hack, has been a long-time coming. For some reason, nobody thought it was a bad idea to have ONE appliance which had credentials to view and change network settings on EVERY switch/router/server on the network. For those whose organizations which were too poor to afford a Solar Winds license, and were parsing through Syslog files each day, they avoided this whole damaging mess.
