Security skills are scarce because exploits are expensive
If there is one honest, unglamorous truth about web3 hiring right now, it's that smart contract security skills are some of the scarcest and most valuable in the entire industry. This isn't hype, it follows directly from the economics of the space: a single overlooked bug in a deployed contract can be drained of real, often enormous, value within minutes, and unlike most software bugs, there is frequently no way to patch it after the fact because the contract is immutable once live. That asymmetry, one missed edge case can mean an irreversible, public, nine-figure loss, is why teams pay a real premium for people who can genuinely find these bugs before an attacker does, and why there are consistently more open roles than qualified people to fill them.
This scarcity isn't limited to people who call themselves auditors. Formal verification awareness, understanding how to mathematically reason about what a contract can and cannot do rather than just testing example cases, and the ability to read past exploits and understand exactly how they worked, are skills that make someone more valuable even in roles that aren't explicitly security roles. A protocol engineer who thinks like an auditor writes safer code from the start. A DevRel person who understands common exploit patterns gives better guidance to the developers they support. Security-adjacent thinking has become a real differentiator across the industry, not a niche specialty walled off from everything else.