If you are _really_ good at cryptography engineering --- that is to say, top-of-your-field good simultaneously at systems engineering and cryptography --- then there are fairly lucrative jobs you can get either as a consultant for a firm like Rambus/CRI, or as a crypto engineer at one of the big tech firms.
Unfortunately, if you're not that person, or you can't live in California, the answer is a bit fuzzier.
There are some big obstacles to working in the field:
* The overwhelming majority of crypto is built (poorly, dangerously) by amateurs, and there's no real force in the industry to change that.
* The overwhelming majority of crypto is built as, at best, a feature of a much larger product. Even when crypto is critically important to the value proposition of a product, in terms of lines of code or commits per year, it's usually not that big a factor. This means that even projects that need good crypto tend not to have a headcount allocated just for crypto (it's also a major reason why most crypto is done by amateurs).
* There are good jobs breaking crypto, but not that many of them. Being able to reliably find cross-site scripting is --- at the firm level at least --- more lucrative than being able to reason through a practical exploit for an unknown key share bug. There are crypto pentesters (with extremely high bill rates), but that brings you back to "top-of-field for multiple disciplines".
* You can, of course, make an academic career. You'd go for a PhD in cryptography, and then either stay in school as a professor, or join a research group at one of the big tech firms (this is a different job than crypto engineering at one of the big tech firms; your principle job will probably still be to publish) --- so far as I can tell, those research group positions are exclusively staffed with PhDs.
That's not to say people shouldn't study crypto! They absolutely should: it is mind-expanding in ways orthogonal to the other specialities engineers take on to expand their minds. It will make you a better systems programmer. It might make you better at software security, too (it might not, though). It will, at least, mean that when your project is called on to, I don't know, encrypt a password reset token, you'll be able to do that competently.