Updated November 2026
The State of Cybersecurity Hiring
Key findings
- The median disclosed cybersecurity salary is $182k, across 2628 postings that list pay.
- Open security roles sit unfilled for a median of 47 days.
- Detection Engineering is the most in-demand specialization, with 181 open roles.
- 34% of open roles are remote.
- SOC 2 is the most-referenced compliance framework, appearing in 360 postings.
Salary landscape
Based on the 2628 active postings that disclose pay, the median cybersecurity salary is $182k (25th–75th percentile $141k–$225k). Figures cover only roles that publish a salary range.
By specialization
| Specialization | Median (USD) | Postings |
|---|---|---|
| Privacy | $217k | 11 |
| AppSec | $212k | 29 |
| Identity & Access | $197k | 32 |
| Security Engineering | $188k | 58 |
| Cloud Security | $185k | 17 |
| Threat Intelligence | $178k | 11 |
| AI Security | $173k | 22 |
| GRC | $162k | 30 |
| Detection Engineering | $146k | 21 |
By seniority
| Level | Median (USD) | Postings |
|---|---|---|
| VP | $271k | 47 |
| C-level | $247k | 16 |
| Director | $242k | 190 |
| Principal | $214k | 147 |
| Staff | $206k | 223 |
| Senior | $178k | 572 |
| Manager | $172k | 636 |
| Mid | $160k | 786 |
By country
| Country | Median (USD) | Postings |
|---|---|---|
| United States | $187k | 1957 |
| Germany | $147k | 25 |
| Canada | $139k | 145 |
| United Kingdom | $132k | 31 |
| Ireland | $97k | 27 |
Where the demand is
34% of open roles are remote. The most in-demand specializations by open-role volume:
| Specialization | Open roles |
|---|---|
| Detection Engineering | 181 |
| Security Engineering | 175 |
| Threat Intelligence | 104 |
| AppSec | 102 |
| AI Security | 89 |
| Cloud Security | 81 |
| GRC | 76 |
| Identity & Access | 62 |
| Offensive Security | 47 |
| Privacy | 18 |
Time on market
Security roles stay open a median of 47 days. This measures how long currently-open roles have been posted (open-role age), not formal time-to-fill.
| Specialization | Median days open | Postings |
|---|---|---|
| Privacy | 119 | 18 |
| Security Engineering | 63 | 175 |
| Identity & Access | 62 | 62 |
| OT/ICS | 62 | 13 |
| Threat Intelligence | 56 | 104 |
| AppSec | 48 | 102 |
| Cloud Security | 47 | 81 |
| Offensive Security | 44 | 47 |
| AI Security | 41 | 89 |
| Detection Engineering | 35 | 181 |
| GRC | 27 | 76 |
Framework & certification demand
Frameworks
- SOC 2 - 360
- ISO 27001 - 262
- FedRAMP - 256
- HIPAA - 220
- CCPA - 176
- GDPR - 142
- PCI-DSS - 106
- NIST 800-53 - 70
- CMMC - 54
- NIST CSF - 29
- DORA - 29
- NIS2 - 24
Certifications
- CISSP - 266
- GIAC - 93
- CISA - 79
- CISM - 79
- CompTIA Security+ - 76
- CCSP - 74
- OSCP - 65
- CEH - 50
- CRISC - 25
- CIPP - 23
- CCSK - 19
- CIPM - 19
Key facts (cite this)
- The median disclosed cybersecurity salary is $182k, across 2628 postings that list pay. (source: InfoSec Job Board, November 2026)
- Open security roles sit unfilled for a median of 47 days. (source: InfoSec Job Board, November 2026)
- Detection Engineering is the most in-demand specialization, with 181 open roles. (source: InfoSec Job Board, November 2026)
- 34% of open roles are remote. (source: InfoSec Job Board, November 2026)
- SOC 2 is the most-referenced compliance framework, appearing in 360 postings. (source: InfoSec Job Board, November 2026)
Frequently asked questions
What is the median cybersecurity salary in 2026?
Across the 2628 postings on InfoSec Job Board that disclose pay, the median cybersecurity salary is $182k (as of November 2026).
Which cybersecurity roles are most in demand?
By open-role volume, the most in-demand specializations are Detection Engineering, Security Engineering, Threat Intelligence.
How long do cybersecurity roles stay open?
Open security roles sit unfilled for a median of 47 days, a sign of how tight the talent market remains.
How is this data collected?
These figures are computed live from the active job postings aggregated from cybersecurity employers on InfoSec Job Board. Salary figures cover only the subset of postings that disclose pay.
Methodology
All figures are computed directly from the active job postings aggregated from cybersecurity employers on InfoSec Job Board, refreshed daily (November 2026). Salary medians cover only the 2628 postings that disclose pay; per-group medians are shown only where the sample is large enough to be meaningful (10+ postings per role, 25+ per country). "Time on market" reflects how long currently-open roles have been posted, not formal time-to-fill.
By Andrew Tjong. Andrew Tjong is the founder of InfoSec Job Board, where he analyzes hiring and salary data across the cybersecurity employers tracked on the platform. Published 2026-06-18; updated November 2026.