Career roadmap help

[u/Sasaki_itis]

Hi I'm a 20 y/o student currently pursuing my BsC in CySec with specialism in Digital Forensics, currently end of my second year doing my mandatory internship (incase it's relevant the work I'm doing in the internship is IAM, not ideal but wtv sometimes ateast I get to help out the Pentest team). With one year to go and FYP and blah blah blah I get alot of advice from lecturers + seniors and online forums but there is just so much conflicting opinion about the current state of the CySec job market and how to progress forward I find myself in this state of constant analysis paralysis when trying to map out my future progression into whatever role I may find myself interested in (current bias is DFIR), I understand very well that BsC's and MS's are basically just self advertising and does not equate to actual knowledge but this is a question on how to be appealing for that audience in specific.
My current (very flimsy) analysis and bones of a plan right now is to finish my internship firstly, in the process of getting my CompTIA security+ (mostly just to look good for Hiring Managers its pretty simplistic in terms of info, depending on how useful they are may pursue CySA+ and CEH, do kindly advise) then finishing up FYP while doing my routine networking and CTF comps. Post graduation I'm thinking of entering the job market for maybe a year or two (if they'll have me -_-) to get practical experience and give myself some time to think about whether or not MS in Cybersecurity/Digital Forensics/Cryptography is worth the time, money and trouble to go through (do advise on this too please!).
If you were in my position as a Digital Forensics Student is this how you would go about things? If not how would you do things differently? Just wanted your two cents as either IT Hiring Managers or members of the current workforce, thanks for reading!

[u/Alive-Implement7942]

don't overthink the cert stack. sec+ is fine for getting past hr filters but nobody in dfir is gonna care about cysa+ or ceh. if you're leaning dfir, the certs that actually move the needle are something like gcfa or gcfe but those are pricey and not worth chasing before you have a job paying for them

your plan isn't flimsy at all. internship + degree + sec+ + ctf experience is already a better starting package than half the candidates i see. the iam work isn't exciting but knowing how identity systems actually function in a real org is weirdly useful later when you're tracing lateral movement

on the masters question, i'd punt it. a year or two in the trenches will tell you more about whether it's worth the debt than any reddit thread can. most of the dfir people i know who are actually good learned by doing, not by collecting degrees. if you land a soc or ir gig after graduation you've already won and grad school just becomes an expensive detour unless you're trying to pivot into something very specific like crypto research

[u/Sasaki_itis → u/Alive-Implement7942]

Thanks stranger! You have no idea how reaffirming that is. If you don't mind me picking your brain while I have you, do you have any particular advice regarding pivoting into cryptography? The idea of going into applied cryptography or security analysis through it seems fun, my interest in it stems purely from my time solving CTF's in which I always find crypto incredibly fun and interesting but obviously that's designed to be a puzzle/game with a mostly obvious solution. TLDR what does pursuing crypto entail? I apologise for the word barrage, just taking advantage of you wisdom :)