Depends on what you want to do. If you are good with people, I suggest Information Assurance. It's basically consulting combined with cyber security. Most SMEs only require advice on basic network security, password management, how to avoid phishing attacks, social engineering attacks and ransomware, how to handle crises after being hacked etc. Checklists will get you a long way. Leave the reverse engineering of malware etc. to people with more interest and time. It is a more narrow field, takes a lot of additional effort and requires a fair bit of talent. If you are just going into cybersecurity for money, stick with IA. I know this is not a popular opinion on HN, but your average SME won't be able to do information security properly (remember, your average consumer believes in using an anti-virus to clean out a infected machine, when the correct thing to do is a complete wipe and reinstallation). Easier get them to offload most of their productivity tools to SaaSes and buy plenty of insurance than try to force FANG-level access control protocols on them.