Then kernel development, in depth work with creating custom applications that deal with TCP and UDP security and analysis, deep dives into the inner working on how various IoT devices work, building autonomous cyber reasoning systems, automated cyber ranges, and or automated policy client/server enforcement systems.
If you come in the door with these credentials you will be highly qualified to be at least a principal cyber engineer. Your in depth research would makes serious waves in the industry and with real world experience it would be an amazing win-win situation for you and the company that hires you, or even better your own business doing cyber research.
That's the USA philosophy of advanced degrees; it does not reflect the practice of every country.
And given standard scholarly impact statistics for completed theses, it arguably doesn't reflect reality either. Maybe we should start admitting that most PhD candidates haven't made a significant contribution to the state-of-the-art, most future candidates aren't going to, and the nominal requirement to do so isn't helpful?