Who is buying, hiring, and cutting in cybersecurity
The industry moves that reshape security careers - acquisitions, executive hires, layoffs, and funding rounds - paired with the one thing a news site cannot show you: the live hiring picture at the companies involved, straight from the employers' own ATS feeds we index hourly.
Updated weekly|Latest move: Sep 2, 2026
Sourcing note: every item links its primary source (company newsroom, filing, or a major outlet) and shows the date we verified it. If we could not verify a story, it is not on this page.
HiddenLayer raises a $100M Series B for AI runtime security
Austin based AI security company HiddenLayer raised a $100 million Series B led by Delta-v Capital, with Ten Eleven Ventures, Morgan Stanley, Microsoft venture fund M12 and Booz Allen Ventures participating. CEO Chris Sestito told TechCrunch annual recurring revenue grew more than 10x over the past year, with over 90% of that growth from new customers signed in the past year. The company says the money deepens its Agentic Runtime Security and Agent Harness Security products, which secure AI coding agents at runtime, and funds a push into Europe and the wider EMEA region.
The hiring angle: This is about as explicit as a hiring signal gets: the release says more hires are on the way as the company deepens channel relationships and pushes into EMEA. AI security is the specialization where demand is growing because of AI rather than in spite of it, and HiddenLayer is already one of the AI security employers we track.
Palo Alto Networks acquires AI agent startup Console in its seventh deal of 2026
Palo Alto Networks announced it is acquiring Console, a two year old startup whose AI agents automate routine IT help desk work such as password resets, app access grants and troubleshooting. Terms were not officially disclosed; TechCrunch reported a price of about $500 million in cash and stock, citing two sources with knowledge of the deal. Console was founded in 2024, raised $29 million across a seed led by Thrive Capital and a Series A co-led by DST Global and Thrive, and was last valued at $157 million according to PitchBook. Palo Alto Networks will fold Console into Cortex, and CEO Nikesh Arora said it gives Cortex the arms and legs to deliver autonomous security outcomes across the enterprise. That makes seven acquisitions for the company in 2026, after Chronosphere and Koi.
The hiring angle: Seven acquisitions in one year at the largest employer on our board means integration hiring, not just headcount absorption. Agentic automation moving into Cortex points at demand for detection and SOC engineers who can supervise agents rather than run playbooks by hand, which is the composition shift rather than a headcount cut.
Axonius appoints Chris Jones Chief Trust and Security Officer
Axonius named Chris Jones its Chief Trust and Security Officer and Dan Schoenbaum its SVP of Business Development. Jones brings more than 25 years across high growth SaaS, Fortune 50 technology and the US federal and intelligence communities; he was most recently deputy CISO at Cisco, where he owned cybersecurity strategy for a portfolio of more than $10 billion, and earlier founded Nike first global incident response team and the FBI Cyber Profiling Program. In the new role he owns enterprise security strategy while leading the field CISO program as a customer facing security advisor. Schoenbaum joins from Hive Pro and previously held president and COO roles at RiskIQ.
The hiring angle: A combined trust and security role plus a field CISO program is a go to market security hire as much as a defensive one, and it lands on top of the CEO transition we covered in February. Field CISO and customer facing security advisory is one of the few senior tracks that pays like sales engineering, and Axonius is in our registry so those requisitions surface on the board as they open.
Carrick commits $255M of new capital to Saviynt in a $600M continuation vehicle
Carrick Capital Partners closed an oversubscribed single asset continuation vehicle for identity governance company Saviynt with roughly $600 million in capital commitments, including $255 million of new capital that Carrick calls the largest investment in the firm history. Coller Capital led the vehicle and HSBC Asset Management co-led. The new money was made as part of the final close of Saviynt Series B financing and helped fund a tender offer providing liquidity to Saviynt employees. Carrick said Saviynt has surpassed $300 million in annual recurring revenue, grew bookings by more than 80% this year, and maintains a 96% customer retention rate.
The hiring angle: An employee tender offer alongside fresh growth capital is a retention move, which usually means a company is defending the team it has and then hiring on top of it rather than trimming. Saviynt is one of the larger identity governance employers we track and its openings skew heavily to India, so this is a signal worth watching on our India and identity and access surfaces.
Trellix names David Soto CISO and David Pieterse COO for go to market
Trellix expanded its leadership team with David Soto as Chief Information Security Officer and David Pieterse as Chief Operating Officer for go to market. Soto brings more than 25 years of cybersecurity leadership and joins from Amazon, where as Head of Infrastructure Security he scaled a resilient security program across more than 4,000 sites and 30 countries, with earlier roles at Check Point, Optiv and Pacific Life. He will lead the Trellix enterprise security program and serve as executive steward of its Customer Zero program. Pieterse was previously Chief Revenue Officer at Recorded Future and Snow Software.
The hiring angle: A Customer Zero program means the security team runs the product in anger and becomes a reference account, which tends to create detection and security engineering roles that sit unusually close to the product org. Pairing a CISO hire with a revenue side COO also signals a growth posture rather than a consolidation one at an XDR vendor we already track.
Brinqa acquires PlexTrac to close the exposure management loop
Exposure management vendor Brinqa acquired PlexTrac, the offensive security validation, workflow and reporting platform, to add proof that remediation actually worked to its continuous threat exposure management offering. Financial terms were not disclosed. The combined company says it serves more than 3,000 customers across 57 countries, including over 25% of the Fortune 500, and that both companies were recognized in the Gartner Magic Quadrant for Exposure Assessment Platforms. PlexTrac founder Dan DeCloss joins the Brinqa executive leadership team and board of directors and will run the combined offensive security practice.
The hiring angle: PlexTrac is the reporting layer a large share of pentest and red team shops actually write their deliverables in, so this pulls offensive security workflow inside a vulnerability management buyer. For candidates it reinforces that pentest skills are being valued for the remediation evidence they produce, not just the finding, which is the direction our offensive security and exposure management listings have been moving.
Pentera cuts another 60 employees in its second round in four months
Automated security validation company Pentera told employees it is carrying out another round of layoffs affecting about 60 employees, 30 of them in Israel. The cuts come four months after roughly 40 were let go in April, bringing the total to about 100 people, or around 20% of a 470 person workforce, and they touch all departments including research and development. Management framed the move as necessary to keep growing and moving quickly. The company said it plans to continue recruiting employees with relevant experience in artificial intelligence, reflecting a shift toward AI based validation and testing.
The hiring angle: This is the clearest single company example of the composition shift on the board right now: cuts across all departments while the same company keeps recruiting for AI experience. Experienced security validation and pentest automation engineers, a large share of them in Israel, are on the market at once, and the AI adjacent roles Pentera is still filling are exactly the ones our AI security surfaces have been growing.
Rapid7 cuts about 300 jobs (12% of workforce) alongside Q2 earnings
Rapid7 announced with its Q2 earnings that it is cutting roughly 300 jobs, about 12% of its workforce, at a cost of $11-12 million (mostly severance). The company forecast 2026 revenue declining from $860 million to as little as $837 million, citing customers delaying moves to its newer offerings and pressure from AI-integrated competitors. The cut follows CEO Wael Mohamed replacing longtime chief Corey Thomas in June, and comes less than a month after the company had described a much smaller 21-person reduction.
The hiring angle: A 300-person cut at a vuln-management and SIEM stalwart puts experienced detection, VM, and MDR practitioners on the market at once. Employers hiring in those specializations should expect a short window of unusually deep candidate pools.
Obsidian Security raises an $85M Series D at a $1.1B valuation
SaaS and AI agent security company Obsidian Security raised an $85 million Series D at a $1.1 billion valuation, led by Crescent Cove Advisors with participation from existing investors including Greylock Partners, Menlo Ventures, Norwest Venture Partners, IVP, Wing Ventures and Google Ventures. The company says it counts 60 of the Fortune 500 as customers, with more than 100 customers spending over $100,000 a year and more than 14 spending over $1 million. Obsidian says the funding extends its platform to more of the Fortune 500 and Global 2000 as the standard for securing what AI agents can access and do.
The hiring angle: Crossing a billion dollar valuation on the strength of AI agent governance is a category signal, not just a company one: identity, SaaS posture and agent permissions are collapsing into one buying centre. Candidates who can speak to both SaaS security posture and agent authorization are scarce, and Obsidian is in our registry so its openings show up on the board.
Zenity raises a $125M Series C for AI agent security
AI agent security company Zenity raised a $125 million Series C led by Norwest, with new investors Qumra Capital, SoftBank Vision Fund 2, Hitachi Ventures and LG Technology Ventures joining existing backers Vertex Ventures, Third Point Ventures, DTCP and Intel Capital. Founded in 2021 by Unit 8200 veterans Ben Kliger and Michael Bargury, Zenity now has more than 230 employees worldwide, with its research and development centre in Tel Aviv and go to market and operations led from New York. The company says it has tripled revenue in each of the past two years and is on track to triple again this year, and will use the money to accelerate platform innovation, expand Zenity Labs and deepen its presence across Europe and Asia Pacific.
The hiring angle: Stated expansion across Europe and Asia Pacific from a 230 person base is the shape that produces sales engineering and solutions architect hiring first, then research roles through Zenity Labs. It also reinforces the Unit 8200 to startup pipeline that makes Israel our second largest market by open roles.
Horizon3 raises $250M Series E at a $2B+ valuation
Autonomous pentesting company Horizon3 (NodeZero) raised a $250 million Series E co-led by NightDragon and NEA at a valuation above $2 billion, roughly tripling its $650 million Series D valuation in about a year. The company reports over 7,000 customers and 120% year-over-year ARR growth, and says the capital goes to go-to-market expansion (including MSP and telco channels, plus entry into Singapore and Australia) and R&D on autonomous agents.
The hiring angle: A tripled valuation plus stated GTM and international expansion is the classic precursor to a hiring wave, especially in sales engineering and offensive-security-adjacent roles. Horizon3.ai is already one of the larger offensive-security employers we track.
Okta signs definitive agreement to acquire Permiso Security
Okta agreed to acquire Permiso Security, a Palo Alto based identity threat detection and response (ITDR) platform founded by former FireEye executives, to extend threat detection across human, non-human, and AI agent identities. Okta did not disclose terms; TechCrunch reported a price of about $200 million, nearly all cash. The deal is expected to close in Q3 of Okta fiscal 2027 (August through October 2026).
The hiring angle: Identity threat detection is being pulled into the big identity platforms, which usually means ITDR and detection engineering skills get valued inside IAM teams, not just SOCs. Watch Okta requisitions for detection-flavored identity roles as the integration lands.
Cyera agrees to acquire Oasis Security in a ~$1B deal
Data security company Cyera (recently valued at $12 billion) agreed to acquire Oasis Security, a non-human identity security startup founded in 2022 that had raised about $195 million, for approximately $1 billion, mostly in cash with the remainder in Cyera shares. Cyera plans to integrate Oasis into a unified identity and data security platform aimed at securing proliferating AI agents. It is Cyera’s third acquisition of 2026.
The hiring angle: Two companies we track merging: non-human identity plus DSPM is becoming one buyer category, and candidates with both identity and data-security depth just got more valuable. Consolidation like this also tends to shake loose senior talent post-close.
Human risk management vendor Fable Security named Jacob Berry its Chief Information Security Officer. Berry brings 18 years across incident response, cyber operations, governance, and compliance, with prior roles including CISO at Jit and security leadership at Clumio, Cybereason, and Secureworks. CEO Nicole Jiang said Berry shares the company’s belief that secure behavior management is one of the most critical problems in security.
The hiring angle: A first dedicated CISO at a fast-growing startup usually precedes a security team build-out beneath them. Fable Security is in our tracked registry, so new GRC and security engineering requisitions there will surface on the board as they open.
Accenture takes a majority stake in Dragos and acquires runZero and NetRise (~$4.175B)
Accenture agreed to acquire a majority stake in OT security leader Dragos and 100% of runZero and NetRise at a combined enterprise value of approximately $4.175 billion, building an end-to-end OT and critical-infrastructure security platform. The three companies generate roughly $208 million in combined ARR as of June 2026, up 53% year over year. The transactions are expected to close in August or September 2026.
The hiring angle: The biggest OT security deal of 2026 pulls two of our tracked employers into a consulting giant. OT/ICS talent is chronically scarce; Accenture funding Dragos growth is bullish for OT security hiring, while integration periods often prompt senior ICs to look around.
Cloudflare lays off 1,100+ employees in AI-driven restructuring
Cloudflare cut more than 1,100 employees worldwide in what leadership framed as restructuring for the "agentic AI era" rather than cost-cutting, citing a 600% increase in internal AI usage over three months. Cuts touched HR, marketing, finance, and engineering. Departing employees receive severance through the end of 2026, continued healthcare, and accelerated equity vesting; the stock fell over 20% despite a Q1 beat.
The hiring angle: The clearest example yet of the AI composition shift we track: fewer generalist roles, sustained demand for senior and AI-adjacent security engineering. A large cohort of Cloudflare-caliber engineers hitting the market is a real opportunity for mid-size security vendors hiring now.
Axonius CEO Dean Sysman steps down; 40 roles cut in restructuring
Axonius co-founder and CEO Dean Sysman stepped down, moving to executive chairman, with president Joe Diamond appointed interim CEO. The company simultaneously cut about 40 employees (roughly 4% of staff, mostly marketing and sales) in what it called a structural adjustment for operational discipline as it matures toward an IPO. Sysman cited a serious medical situation affecting his newborn son.
The hiring angle: Leadership churn plus repeated GTM-side cuts (100 roles in an earlier round, 40 now) signals a company optimizing for efficiency metrics ahead of an IPO or sale. For candidates that means slower net hiring in sales and marketing but continued engineering demand; our live count below shows where Axonius stands today.
Methodology: items are added only after checking a primary or top-tier source; the source link and verification date are shown on every item. Live open-role counts come from the employer's own ATS feed, refreshed hourly, and may differ from figures quoted in coverage.
📬 Industry moves change who is hiring. Get the new security roles emailed weekly instead of checking back.
📬 Get new cybersecurity jobs each week in your inbox