Updated September 2026
The State of Cybersecurity Hiring
Key findings
- The median disclosed cybersecurity salary is $179k, across 2646 postings that list pay.
- Open security roles sit unfilled for a median of 43 days.
- Security Engineering is the most in-demand specialization, with 163 open roles.
- 35% of open roles are remote.
- SOC 2 is the most-referenced compliance framework, appearing in 331 postings.
Salary landscape
Based on the 2646 active postings that disclose pay, the median cybersecurity salary is $179k (25th–75th percentile $140k–$224k). Figures cover only roles that publish a salary range.
By specialization
| Specialization | Median (USD) | Postings |
|---|---|---|
| Privacy | $247k | 15 |
| Identity & Access | $213k | 26 |
| AppSec | $205k | 27 |
| Security Engineering | $197k | 56 |
| Threat Intelligence | $190k | 11 |
| AI Security | $184k | 17 |
| Cloud Security | $183k | 17 |
| GRC | $168k | 29 |
| OT/ICS | $147k | 10 |
| Detection Engineering | $122k | 23 |
By seniority
| Level | Median (USD) | Postings |
|---|---|---|
| VP | $275k | 59 |
| Director | $229k | 181 |
| C-level | $225k | 17 |
| Principal | $214k | 144 |
| Staff | $193k | 214 |
| Senior | $178k | 521 |
| Manager | $170k | 658 |
| Mid | $157k | 828 |
| Entry | $90k | 22 |
By country
| Country | Median (USD) | Postings |
|---|---|---|
| United States | $186k | 1973 |
| Canada | $139k | 144 |
| United Kingdom | $132k | 47 |
| Germany | $126k | 28 |
| Ireland | $102k | 28 |
Where the demand is
35% of open roles are remote. The most in-demand specializations by open-role volume:
| Specialization | Open roles |
|---|---|
| Security Engineering | 163 |
| Detection Engineering | 147 |
| Threat Intelligence | 101 |
| AppSec | 97 |
| GRC | 68 |
| Cloud Security | 68 |
| AI Security | 60 |
| Identity & Access | 59 |
| Offensive Security | 42 |
| Privacy | 22 |
Time on market
Security roles stay open a median of 43 days. This measures how long currently-open roles have been posted (open-role age), not formal time-to-fill.
| Specialization | Median days open | Postings |
|---|---|---|
| AI Security | 71 | 60 |
| Cloud Security | 69 | 68 |
| Privacy | 65 | 22 |
| Security Engineering | 58 | 163 |
| AppSec | 57 | 97 |
| Threat Intelligence | 50 | 101 |
| Offensive Security | 43 | 42 |
| Detection Engineering | 37 | 147 |
| Identity & Access | 37 | 59 |
| GRC | 35 | 68 |
| OT/ICS | 14 | 11 |
Framework & certification demand
Frameworks
- SOC 2 - 331
- ISO 27001 - 252
- FedRAMP - 227
- HIPAA - 205
- CCPA - 197
- GDPR - 124
- PCI-DSS - 84
- NIST 800-53 - 70
- CMMC - 61
- NIST CSF - 23
- DORA - 21
- NIST 800-171 - 20
Certifications
- CISSP - 295
- GIAC - 123
- CCSP - 91
- CompTIA Security+ - 81
- CISA - 69
- CISM - 69
- OSCP - 61
- CEH - 50
- CCSK - 39
- CIPP - 27
- CIPM - 20
- CRISC - 15
Key facts (cite this)
- The median disclosed cybersecurity salary is $179k, across 2646 postings that list pay. (source: InfoSec Job Board, September 2026)
- Open security roles sit unfilled for a median of 43 days. (source: InfoSec Job Board, September 2026)
- Security Engineering is the most in-demand specialization, with 163 open roles. (source: InfoSec Job Board, September 2026)
- 35% of open roles are remote. (source: InfoSec Job Board, September 2026)
- SOC 2 is the most-referenced compliance framework, appearing in 331 postings. (source: InfoSec Job Board, September 2026)
Frequently asked questions
What is the median cybersecurity salary in 2026?
Across the 2646 postings on InfoSec Job Board that disclose pay, the median cybersecurity salary is $179k (as of September 2026).
Which cybersecurity roles are most in demand?
By open-role volume, the most in-demand specializations are Security Engineering, Detection Engineering, Threat Intelligence.
How long do cybersecurity roles stay open?
Open security roles sit unfilled for a median of 43 days, a sign of how tight the talent market remains.
How is this data collected?
These figures are computed live from the active job postings aggregated from cybersecurity employers on InfoSec Job Board. Salary figures cover only the subset of postings that disclose pay.
Methodology
All figures are computed directly from the active job postings aggregated from cybersecurity employers on InfoSec Job Board, refreshed daily (September 2026). Salary medians cover only the 2646 postings that disclose pay; per-group medians are shown only where the sample is large enough to be meaningful (10+ postings per role, 25+ per country). "Time on market" reflects how long currently-open roles have been posted, not formal time-to-fill.
By Andrew Tjong. Andrew Tjong is the founder of InfoSec Job Board, where he analyzes hiring and salary data across the cybersecurity employers tracked on the platform. Published 2026-06-18; updated September 2026.