Is a master's degree in information assurance worth it?

I’m currently working on a Bachelor’s of Cybersecurity, with a focus in policy and compliance. I will graduate in a year to a year and a half. I do want to do security compliance as a career.
To do this kind of work, is a master’s degree necessary, or is work experience more important?

I think that once you have some work experience, you will better be able to judge what sort of master’s degree will be useful, if any. And your employer may be willing to cover part of the cost.

Look up job postings for jobs that you would like to do, and see what kinds of education and experience they required. Normally, they ask for certain experience and certain education but experience can substitute for education and vice versa.