Ok, he may need to learn a bit of a lesson from this. His first company invested a lot of time and money in him with the CompTIA, it's not cheap and it requires a lot of study. They wouldn't have done that on a whim or if they weren't serious about developing him.
One really important thing to remember about CyberSecurity as a field is that we are a cost to the business, we generate no revenue and our work can be very expensive, the systems and tools that we use, as well as the cost of the specialist people. We have a really important function in preventing and responding to breaches that COULD potentially cause huge financial loss and reputational damage. The key word there being COULD. We are completely reliant on the company we work for having a well enough developed understanding and consideration of the risks that a breach brings, and having the foresight and finances to be willing to spend to prevent it even though it may never happen.
It is highly likely that the first company had in fact had the budget pulled or frozen, if revenue is low then the teams that are pure cost are the ones that get frozen first. It's rarely a permanent position so patience and having open conversations to really understand the drivers being the back track, when the new financial year and planning for it will start etc are so important.
He can't change what has happened just look forward and keep it in mind for future decisions.
If he has the time and will then he should start doing free courses, listening to podcasts, reading draft and newly published legislations about AI. It's the new big scary and big exciting thing in Cyber, UK Govt have recently published new guidelines. Several states in the US too and loads of the big software providers have been launching new security tools with extensive AI capabilities. All the hackers/scammers/bad actors are using it too, so it is what everyone is talking about and trying to formulate policies, plans and processes to use it well and combat threats from it all at the same time.