Updated August 2026
The State of Cybersecurity Hiring
Key findings
- The median disclosed cybersecurity salary is $175k, across 1641 postings that list pay.
- Open security roles sit unfilled for a median of 39 days.
- Security Engineering is the most in-demand specialization, with 201 open roles.
- 36% of open roles are remote.
- SOC 2 is the most-referenced compliance framework, appearing in 379 postings.
Salary landscape
Based on the 1641 active postings that disclose pay, the median cybersecurity salary is $175k (25th–75th percentile $135k–$225k). Figures cover only roles that publish a salary range.
By specialization
| Specialization | Median (USD) | Postings |
|---|---|---|
| Privacy | $211k | 10 |
| Security Engineering | $199k | 25 |
| AppSec | $185k | 11 |
| Cloud Security | $183k | 15 |
| GRC | $168k | 25 |
| Threat Intelligence | $110k | 17 |
By seniority
| Level | Median (USD) | Postings |
|---|---|---|
| VP | $290k | 52 |
| C-level | $251k | 11 |
| Director | $220k | 120 |
| Staff | $210k | 85 |
| Principal | $200k | 67 |
| Senior | $180k | 419 |
| Manager | $165k | 369 |
| Mid | $145k | 484 |
| Entry | $65k | 30 |
By country
| Country | Median (USD) | Postings |
|---|---|---|
| United States | $178k | 584 |
| United Kingdom | $120k | 25 |
Where the demand is
36% of open roles are remote. The most in-demand specializations by open-role volume:
| Specialization | Open roles |
|---|---|
| Security Engineering | 201 |
| Detection Engineering | 137 |
| Threat Intelligence | 124 |
| AppSec | 121 |
| Cloud Security | 87 |
| GRC | 78 |
| AI Security | 76 |
| Identity & Access | 59 |
| Offensive Security | 37 |
| Privacy | 25 |
Time on market
Security roles stay open a median of 39 days. This measures how long currently-open roles have been posted (open-role age), not formal time-to-fill.
| Specialization | Median days open | Postings |
|---|---|---|
| Privacy | 74 | 25 |
| Identity & Access | 47 | 59 |
| AppSec | 47 | 121 |
| Security Engineering | 45 | 201 |
| Offensive Security | 44 | 37 |
| GRC | 40 | 78 |
| AI Security | 39 | 76 |
| Threat Intelligence | 38 | 124 |
| Detection Engineering | 34 | 137 |
| Cloud Security | 33 | 87 |
Framework & certification demand
Frameworks
- SOC 2 - 379
- ISO 27001 - 308
- FedRAMP - 269
- CCPA - 257
- HIPAA - 237
- GDPR - 180
- PCI-DSS - 76
- NIST 800-53 - 67
- CMMC - 66
- NIST CSF - 30
- DORA - 30
- NIST 800-171 - 22
Certifications
- CISSP - 348
- GIAC - 152
- CCSP - 106
- CompTIA Security+ - 101
- CISM - 92
- OSCP - 75
- CISA - 72
- CEH - 62
- CCSK - 58
- CIPP - 28
- CIPM - 23
- AZ-500 - 21
Key facts (cite this)
- The median disclosed cybersecurity salary is $175k, across 1641 postings that list pay. (source: InfoSec Job Board, August 2026)
- Open security roles sit unfilled for a median of 39 days. (source: InfoSec Job Board, August 2026)
- Security Engineering is the most in-demand specialization, with 201 open roles. (source: InfoSec Job Board, August 2026)
- 36% of open roles are remote. (source: InfoSec Job Board, August 2026)
- SOC 2 is the most-referenced compliance framework, appearing in 379 postings. (source: InfoSec Job Board, August 2026)
Frequently asked questions
What is the median cybersecurity salary in 2026?
Across the 1641 postings on InfoSec Job Board that disclose pay, the median cybersecurity salary is $175k (as of August 2026).
Which cybersecurity roles are most in demand?
By open-role volume, the most in-demand specializations are Security Engineering, Detection Engineering, Threat Intelligence.
How long do cybersecurity roles stay open?
Open security roles sit unfilled for a median of 39 days, a sign of how tight the talent market remains.
How is this data collected?
These figures are computed live from the active job postings aggregated from cybersecurity employers on InfoSec Job Board. Salary figures cover only the subset of postings that disclose pay.
Methodology
All figures are computed directly from the active job postings aggregated from cybersecurity employers on InfoSec Job Board, refreshed daily (August 2026). Salary medians cover only the 1641 postings that disclose pay; per-group medians are shown only where the sample is large enough to be meaningful (10+ postings per role, 25+ per country). "Time on market" reflects how long currently-open roles have been posted, not formal time-to-fill.
By Andrew Tjong. Andrew Tjong is the founder of InfoSec Job Board, where he analyzes hiring and salary data across the cybersecurity employers tracked on the platform. Published 2026-06-18; updated August 2026.