Updated October 2026
The State of Cybersecurity Hiring
Key findings
- The median disclosed cybersecurity salary is $178k, across 2587 postings that list pay.
- Open security roles sit unfilled for a median of 44 days.
- Security Engineering is the most in-demand specialization, with 179 open roles.
- 34% of open roles are remote.
- SOC 2 is the most-referenced compliance framework, appearing in 312 postings.
Salary landscape
Based on the 2587 active postings that disclose pay, the median cybersecurity salary is $178k (25th–75th percentile $140k–$222k). Figures cover only roles that publish a salary range.
By specialization
| Specialization | Median (USD) | Postings |
|---|---|---|
| Privacy | $232k | 10 |
| AppSec | $202k | 29 |
| Identity & Access | $201k | 33 |
| Threat Intelligence | $197k | 12 |
| Security Engineering | $193k | 60 |
| Cloud Security | $185k | 19 |
| AI Security | $175k | 11 |
| GRC | $169k | 24 |
| Detection Engineering | $142k | 20 |
By seniority
| Level | Median (USD) | Postings |
|---|---|---|
| VP | $271k | 57 |
| Director | $233k | 176 |
| C-level | $228k | 10 |
| Principal | $214k | 146 |
| Staff | $203k | 217 |
| Senior | $178k | 546 |
| Manager | $170k | 645 |
| Mid | $157k | 779 |
| Entry | $71k | 10 |
By country
| Country | Median (USD) | Postings |
|---|---|---|
| United States | $186k | 1910 |
| Germany | $147k | 27 |
| Canada | $139k | 152 |
| United Kingdom | $134k | 36 |
Where the demand is
34% of open roles are remote. The most in-demand specializations by open-role volume:
| Specialization | Open roles |
|---|---|
| Security Engineering | 179 |
| Detection Engineering | 145 |
| Threat Intelligence | 106 |
| AppSec | 102 |
| Cloud Security | 89 |
| Identity & Access | 66 |
| GRC | 65 |
| AI Security | 60 |
| Offensive Security | 36 |
| Privacy | 17 |
Time on market
Security roles stay open a median of 44 days. This measures how long currently-open roles have been posted (open-role age), not formal time-to-fill.
| Specialization | Median days open | Postings |
|---|---|---|
| Privacy | 86 | 17 |
| AI Security | 77 | 60 |
| Cloud Security | 61 | 89 |
| Offensive Security | 60 | 36 |
| AppSec | 57 | 102 |
| Security Engineering | 55 | 179 |
| Identity & Access | 50 | 66 |
| Threat Intelligence | 45 | 106 |
| Detection Engineering | 45 | 145 |
| GRC | 43 | 65 |
| OT/ICS | 34 | 16 |
Framework & certification demand
Frameworks
- SOC 2 - 312
- ISO 27001 - 233
- FedRAMP - 232
- HIPAA - 202
- CCPA - 180
- GDPR - 133
- PCI-DSS - 86
- NIST 800-53 - 61
- CMMC - 58
- NIST CSF - 25
- DORA - 23
- NIS2 - 17
Certifications
- CISSP - 283
- GIAC - 103
- CCSP - 86
- CompTIA Security+ - 77
- CISM - 68
- CISA - 67
- OSCP - 61
- CEH - 54
- CCSK - 33
- CIPP - 24
- CIPM - 19
- CRISC - 16
Key facts (cite this)
- The median disclosed cybersecurity salary is $178k, across 2587 postings that list pay. (source: InfoSec Job Board, October 2026)
- Open security roles sit unfilled for a median of 44 days. (source: InfoSec Job Board, October 2026)
- Security Engineering is the most in-demand specialization, with 179 open roles. (source: InfoSec Job Board, October 2026)
- 34% of open roles are remote. (source: InfoSec Job Board, October 2026)
- SOC 2 is the most-referenced compliance framework, appearing in 312 postings. (source: InfoSec Job Board, October 2026)
Frequently asked questions
What is the median cybersecurity salary in 2026?
Across the 2587 postings on InfoSec Job Board that disclose pay, the median cybersecurity salary is $178k (as of October 2026).
Which cybersecurity roles are most in demand?
By open-role volume, the most in-demand specializations are Security Engineering, Detection Engineering, Threat Intelligence.
How long do cybersecurity roles stay open?
Open security roles sit unfilled for a median of 44 days, a sign of how tight the talent market remains.
How is this data collected?
These figures are computed live from the active job postings aggregated from cybersecurity employers on InfoSec Job Board. Salary figures cover only the subset of postings that disclose pay.
Methodology
All figures are computed directly from the active job postings aggregated from cybersecurity employers on InfoSec Job Board, refreshed daily (October 2026). Salary medians cover only the 2587 postings that disclose pay; per-group medians are shown only where the sample is large enough to be meaningful (10+ postings per role, 25+ per country). "Time on market" reflects how long currently-open roles have been posted, not formal time-to-fill.
By Andrew Tjong. Andrew Tjong is the founder of InfoSec Job Board, where he analyzes hiring and salary data across the cybersecurity employers tracked on the platform. Published 2026-06-18; updated October 2026.