Cybersecurity career paths, mapped from 2,150 open roles: ten specialties, every rung from intern to CISO, and the pay at each

Ten security specialties, the rungs inside each, and what employers ask for and pay at every step, measured on the 2,150 security roles that were open on 11 November 2026.

A cybersecurity career path runs in two directions, and most confusion about it comes from mixing them up. One direction is sideways: the specialty you practise, such as tuning detections in a security operations team, hunting for flaws in an application, or proving to an auditor that a control works. The other direction is upward: the scope you carry, from a first seat where someone senior reviews your calls, to a staff engineer whose designs other teams build on, to a director who answers for an entire function. Every job title encodes both at once. "Senior detection engineer" is one rung on one ladder; "director of product security" is a high rung on a different ladder. Once you picture your career as a position on that grid, the usual questions (which path, how long, what it pays, whether you must manage people to rise) get concrete answers.

Here are those answers in brief, from the openings this board read on 11 November 2026. Security engineering is by far the largest specialty, with 618 of the 2,150 open roles, with security operations and incident response second (309), then leadership (237), GRC (215) and application security (210); penetration testing (93) and cloud security (76) are the smallest. Only 59 English-language titles marked a starting rung. The experience asked for climbs in steps: postings whose title carries no level word most often asked for 3 years, senior titles for 5, staff, principal and lead titles for 8, and directors and above for 10. Pay climbs with them, though not evenly: the middle stated salary was $187,000 for titles with no level word, $192,000 for senior titles, $231,000 for staff titles, $265,000 for directors and $305,000 for CISOs. And above the middle rung, specialist titles outnumbered management titles by about four to one (1,013 against 243), which matters to anyone who assumes that climbing means managing.

How the figures were measured. CyberJobs.cc pulls security openings directly from the hiring systems of 298 employers and refreshes them every hour. For this guide, every open posting was read in full from the board's job feed late on 11 November 2026, 2,150 postings in all, and each one was sorted by the board's ten specialties, by the level word in its title, by whether it is remote, whether it names a government clearance, how many years of experience it asks for and what salary it states. 1,038 of the 2,150 (48%) state a salary range, nearly all in US dollars, so pay figures describe the postings that publish pay, which leans toward US employers. The employers themselves are mostly security vendors, software and cloud companies, defense firms and AI labs, which pay far more than the economy-wide figure: the US Bureau of Labor Statistics median for information security analysts was $129,180 in May 2025 - BLS Occupational Outlook Handbook. Every pay figure here follows the board's single definition of typical pay, the span from the 25th percentile of range midpoints to the 90th percentile of range tops, and "the middle" is the median midpoint. Open-role counts the board can recount are written so that they refresh whenever you load this page; everything else is a dated snapshot with its sample size.

Contents

1. The career map in one table
2. Five branches and ten specialties
3. Defend: operations, response and threat research
4. Build: engineering, application, cloud and identity security
5. Break: penetration testing and red teams
6. Govern and advise: GRC, architecture and consulting
7. Lead: managers, directors and CISOs
8. The ladder: rungs, years and pay
9. Above senior: the specialist track and the management track
10. Moving between specialties
11. Where the entry points are
12. AI security as a new branch
13. Choosing a path
14. Questions about cybersecurity career paths

1. The career map in one table

Each row is one specialty in the board's ten-way split of security openings, with the branch it belongs to, how many roles were open on 11 November 2026, the title people usually hold when they start in it, the senior seats it leads to, the middle salary its postings state and the share of its roles that are remote. The sections after the table explain each row and the evidence behind it.

The middle pay in each row is the median midpoint of the salary ranges that specialty's postings stated on 11 November, measured from as few as 31 distinct ranges (cloud security) and as many as 308 (security engineering). The salary pages carry today's figures for each specialty, split by seniority, workplace and employer.

Three patterns in the table are worth noticing before going further. First, the specialty that most people picture when they think of a hacking career, penetration testing, is one of the two smallest, while the two specialties that hire most (engineering and operations) are the ones that build and run defenses. Second, the gap in middle pay between specialties is narrower than the spread inside any one of them: $176,000 for GRC against $229,000 for leadership is a gap of $53,000, while the typical range inside operations alone runs from $146,000 to $320,000. Rung and employer move pay more than the choice of specialty does. Third, leadership has no first title of its own. Nobody starts as a security manager; every manager, director and CISO on the board came up through one of the other nine rows.

2. Five branches and ten specialties

Ten specialties is a lot to hold in mind, so it helps to group them by the question each one answers. Every security job, stripped to its core, exists to answer one of five questions about an organisation's systems:

• Defend: is something hostile happening right now, and how do we stop it? (security operations and incident response; threat intelligence and research)
• Build: can the systems be designed and run so that the hostile thing cannot happen, or cannot spread? (security engineering; application and product security; cloud security; identity and access management)
• Break: where would a real attacker get in, and how far would they get? (penetration testing and red teams)
• Govern: can we prove that the controls exist, work, and are proportionate to the risk the organisation accepts? (governance, risk and compliance; with architecture and consulting advising across build and govern)
• Lead: who sets priorities, spends the budget and answers for the outcome? (security leadership)

The grouping is not just a convenience. The branches differ in the rhythm of the work, in who your customer is and in what evidence you produce. Defenders work in incidents and shifts and produce investigations. Builders work in projects and releases and produce systems and code. Breakers work in engagements and produce findings and reports. Governors work in audit cycles and produce policies, evidence and risk decisions. Leaders work in budgets and quarters and produce priorities and people. A move inside a branch keeps the rhythm and changes the tools; a move across branches changes both, which is why it costs more (section 10).

The US government's own taxonomy draws similar lines. NIST's NICE Workforce Framework for Cybersecurity, in Components version 2.2.0, sorts security work into five work role categories with 42 work roles: Oversight and Governance (17 roles), Design and Development (9), Implementation and Operation (7), Protection and Defense (7) and Investigation (2) - NICCS NICE Framework tool, page published July 2026. Version 2.2.0 was released on 28 April 2026 and added a Cybersecurity Supply Chain Risk Management work role to the oversight category - NIST, April 2026. Offensive work is largely absent from the civilian framework: version 2.0.0 removed the Cyberspace Effects and Cyberspace Intelligence categories, which now live in the Defense Department's Cyber Workforce Framework - NICCS, page published May 2026. The framework itself warns that its work roles "are not synonymous to job titles or occupations" - NICCS work role page. This guide follows the employers' titles, since those are what you will search for, apply to and be promoted into.

The chart counts each specialty as the board stands when you open this page, next to how many of those roles are remote.

On 11 November the build branch held 1,015 of the 2,150 roles, 47% of the board, against 450 for the two defend specialties, 93 for break, 355 for govern and advise together, and 237 for lead. That proportion is a structural fact about security work. An organisation can buy defense as labour (more analysts watching more alerts) or as design (fewer ways for an attack to work at all), and the postings show employers spending most of their hiring on design. Even the operations specialty now titles more of its roles as engineering than as analysis, as the next section shows.

Remote work is spread fairly evenly, with one exception. Architecture and consulting (39%), operations (39%) and penetration testing (38%) had the highest remote shares on 11 November, and cloud security the lowest at 18%, despite sounding like the most location-free specialty. The remote roles page lists each specialty's remote openings separately, and the city pages count roles by metro area.

The employer shapes the job as much as the specialty does. The board groups its employers by kind, and on 11 November the middle stated salary ran from $175,000 at defense and aerospace companies to $318,000 at AI labs, with security software companies at $192,000, software and internet companies at $219,000 and banks, payment and crypto firms at $205,000 - cybersecurity jobs by industry. Some specialties live almost entirely at one kind of employer: 70% of threat intelligence roles and 51% of cloud security roles were at security vendors, while 29% of penetration testing roles were at defense companies. Choosing a specialty therefore partly chooses your future employers, and with them your pay band and whether you will need a clearance.

The second chart sets each specialty's typical floor next to its middle, read live from the open postings that state a salary.

3. Defend: operations, response and threat research

The defend branch is where most people picture security work happening: someone watching screens, an alert firing, an investigation that runs late into the night. That picture is partly right and increasingly out of date.

Security operations and incident response

The work. Operations teams watch an organisation's telemetry (sign-ins, endpoint activity, network traffic, cloud control-plane logs), decide which signals are hostile, investigate those, and contain what is real. Incident responders take over when containment turns into a full investigation, and many operations teams now write and maintain their own detection rules rather than only consuming a vendor's. Of the 309 operations postings open on 11 November, 64% named a SIEM, EDR or XDR platform, 50% named Python and 30% named MITRE ATT&CK.

What the titles say. The titles show what the job has become. Among those 309 roles, 147 titles called the job an engineer and only 80 called it an analyst; 78 titles contained the word "detection" and 111 named incidents, response or forensics. Across the whole board, titles naming detection (86) outnumbered titles naming a SOC analyst or security operations analyst (17) by five to one. The tier 1 analyst seat still exists, but it is a smaller share of the specialty than its reputation suggests, and the senior seats are engineering jobs: writing detections as code, building the pipelines that feed them, and automating the triage a person used to do by hand.

The first seat. On 11 November 16 operations roles carried a starting-rung title, the second most of any specialty. Two show the range: Expel's remote associate SOC analyst seat offered between $85,000 and $90,000, and Samsara's Security Operations Engineer I stated $95,200 to $144,000. Interns in operations are paid by the hour; Rocket Lab's security analyst internships stated $18 to $25 an hour. For the full route into this first seat, the companion guide on how to become a SOC analyst goes step by step.

Where it leads. The senior operations postings read as escalation and ownership. CoreWeave's senior security operations engineer posting asked for 3 to 5 or more years, described the role as an escalation point for other analysts and required a place in a 24/7/365 on-call rotation, at $134,000 to $179,000. Samsara's senior threat detection engineer asked for six or more years and stated $157,675 to $238,500. From there the paths fork: detection engineering, incident response consulting at a vendor's services arm, threat hunting, or management. Addepar's senior security operations manager posting asked for eight or more years, the running of detection and response, and incident command, at $172,000 to $269,000. At the top of the branch, DoorDash's senior director of global cyber defense would lead incident response, detection engineering, threat intelligence, threat hunting and insider threat, asked for 15 or more years, and stated $349,600 to $437,000.

Signals worth knowing. Operations had the highest share of postings mentioning on-call duty, shifts, weekends or 24/7 coverage: 45%, against 18% in engineering. It also had one of the lowest shares naming a clearance (3.6%), and 41% of its roles were at security vendors, largely companies that sell detection and response as a service ( CrowdStrike had 28 operations roles open, Palo Alto Networks 21, Huntress 11). The middle stated salary was $177,000, with a typical range of $146,000 to $320,000 from 129 distinct ranges; the SOC salary page keeps that current.

Threat intelligence and security research

The work. Intelligence analysts and researchers study attackers rather than alerts: which groups target which industries, what infrastructure they use, how their malware works, and what defenders should look for next. The output is reports, indicators, detection logic and, at vendors, research that feeds the product and the company's public reputation. Of the 141 open roles, 62% named Python, 40% asked for reverse engineering or malware analysis, and 45% mentioned detections or a SIEM. "Security researcher" was the most common title (29 roles), ahead of "threat researcher" (11).

Who hires. This is the most vendor-concentrated specialty on the board: 70% of its roles were at security software companies on 11 November, led by Palo Alto Networks (21), Sophos (11), Arctic Wolf (9) and SentinelOne (6). The reason is economic. An in-house team needs only enough intelligence to protect one organisation; a vendor sells intelligence to thousands of customers, so it can afford dedicated researchers and publishes their work as a selling point.

The first seat and the climb. Only 3 starting-rung titles were open, so most people arrive from operations, incident response or offensive work rather than straight from school. Cobalt's associate security researcher posting is a rare exception, asking for one to three or more years across systems, code and security and promising to mentor the hire into a full researcher. Higher up, Coinbase's senior threat intelligence engineer posting asked for five or more years and the ability to present analysis to executives, at $180,370 to $212,200; Arctic Wolf's staff threat intelligence researcher, described as "a technical authority" who leads complex adversary investigations, stated $240,000; and Bitsight's head of threat research, who leads and grows a team of malware researchers, stated $215,000. The middle across the specialty was $193,000 from 52 ranges, with a typical $159,000 to $278,000.

4. Build: engineering, application, cloud and identity security

The build branch is where nearly half the board's openings sit, and where the strongest pay ladders run. Its four specialties share one demand: you have to be able to make systems, not only judge them.

Security engineering

The work. Security engineers design, build and run the controls an organisation depends on: endpoint and network protection, logging pipelines, secrets and key management, hardening, internal security tooling, and the automation that ties them together. A large share of the specialty is software engineering on security products. On 11 November, 122 of the 618 engineering titles (20%) were software engineer or developer titles, mostly at vendors building the products other security teams buy. Half the postings (51%) named Python and 38% named AWS, Azure or Google Cloud.

The first seat. Engineering had the most starting-rung titles of any specialty (22 on the board's entry page on 11 November), and many of them were new-graduate software security roles at defense and hardware companies. Anduril Industries' 2027 new-grad information security engineer role stated $88,000 to $117,000; SpaceX's new-graduate security software roles for Starshield stated $130,000 to $160,000; Applied Intuition's new-grad cybersecurity software engineer stated $130,000 to $158,000; and SailPoint's associate security software engineer, asking for two to four years in software engineering, security automation or DevOps, stated $69,200 to $116,584. The spread is the lesson: a computer science graduate who can write production code enters engineering at a higher rung and salary than almost any other first security job.

Where it leads. Within engineering, the title "senior" barely moved the stated middle on 11 November ($205,000 for titles with no level word, $204,000 for senior titles), while staff and principal titles reached $237,000. The step that changes pay in engineering is the one from senior to staff, which section 9 explains. From staff the paths lead to principal engineer, to security architect, or to engineering management. Engineering also holds the largest number of AI security roles (103 of the board's 231), and 59 engineering roles (9.5%) named a clearance, mostly at defense employers. The middle stated salary was $212,000, typical $174,000 to $375,000, from 308 ranges.

Application and product security

The work. Application security engineers keep vulnerabilities out of the software a company ships: they threat-model new features, review code, run and tune static and dynamic analysis, harden build pipelines and the software supply chain, and teach developers to fix what the scanners find. "Product security engineer" was the most common title in the specialty (53 roles), ahead of "application security engineer" (35), which reflects how the work is organised today: inside product teams, rather than as a test of finished applications. Of the 210 open roles, 54% mentioned threat modelling, 51% named static or dynamic analysis or code review, 26% named supply chain controls such as SBOMs, and 35% mentioned penetration testing.

Who gets in. One posting in three (33%) asked for software development experience outright, the highest share of any specialty. That is the defining fact of this path: the shortest route into it starts in software development, and the developers who cross over carry the credibility that matters most in the job, which is that engineers believe their advice. Only 4 starting-rung titles were open, three of them SpaceX's new-graduate software security roles for Starlink at $130,000 to $175,000.

Where it leads. Application security had the steepest pay ladder on the board. The stated middle rose from $179,000 for titles with no level word to $218,000 for senior titles and $250,000 for staff and principal titles. Chainguard's postings show what each step asks: its staff product security engineer wanted seven or more years for $205,000 to $231,000, and its principal product security engineer wanted ten or more years to set product security direction across major products and lead multi-quarter, cross-functional initiatives, at $229,000 to $258,000. At the top sits the director of product security. 1Password's senior director of product security posting asked for nine or more years in security, at least five of them leading security teams or programs, and stated $272,000. Across the specialty the middle was $218,000, typical $172,000 to $346,000, from 117 ranges; the application security salary page splits it by level and employer.

Cloud security

The work. Cloud security engineers secure workloads on AWS, Azure and Google Cloud: identity policies and guardrails across accounts, network segmentation, Kubernetes and container security, infrastructure-as-code review and the detections that watch cloud control planes. The postings are blunt about the prerequisites. Of the 76 open roles, 78% named a major cloud provider, 66% named Kubernetes and 51% named Terraform or infrastructure as code.

A small count that understates the work. Cloud security was the smallest specialty on 11 November, but cloud skills run through the whole board: 38% of engineering postings and 43% of operations postings also named a cloud provider. Employers increasingly treat cloud security as a skill every security engineer needs rather than a separate job, so the specialty title is mostly used by vendors (51% of the roles) and by consultancies that sell cloud assessments.

The first seat and the climb. Only 2 starting-rung roles were open, and both assumed cloud experience: GuidePoint Security's associate cloud security engineer for AWS asked for one year of related experience and foundational AWS security skills. Most people enter from cloud, platform, DevOps or site reliability engineering. The stated middle was $185,000, typical $165,000 to $300,000, from 31 ranges, and the senior seats lead to staff cloud security engineer and cloud security architect. With only 18% of its roles remote, it is the least remote-friendly specialty on the board, and its remote openings have a page of their own.

Identity and access management

The work. Identity engineers decide who and what can reach which systems, and prove it: single sign-on and multi-factor rollouts, the automation that grants and removes access as people join, move and leave, privileged access, service accounts and the machine identities that now outnumber people. Of the 111 open roles, 56% named SAML, OpenID Connect or OAuth, 49% named an identity platform such as Okta, Entra ID, SailPoint, CyberArk or Ping, and 38% mentioned audits or access reviews.

Two kinds of identity job. A third of the specialty's titles (35%) were software engineer titles, people building identity products and platforms, while the rest run identity programs inside organisations. Both pay well. Identity had the highest stated middle of any non-leadership specialty on 11 November, $225,000, typical $188,000 to $305,000, from 57 ranges (the IAM salary page has the detail), and the highest median experience asked outside leadership and architecture: seven years. On-call language appeared in 32% of its postings, the second highest after operations, because a broken sign-in system stops a whole company.

The first seat and the climb. Identity had a single starting-rung title open, Nebius's junior identity and access engineer in Prague. The more common entry is from IT administration, where joiner-mover-leaver work and directory management are daily tasks, or from operations, where account compromise is the most common investigation. The senior seats lead to staff identity engineer, to a head of IAM role, or to a role like Nscale's director of customer identity and access management, which it described as a player-coach who sets direction, hires a team and stays technical enough to make the architectural calls.

5. Break: penetration testing and red teams

The work. Offensive security practitioners attack systems with permission to show where they fail: web, network, cloud and hardware penetration tests, red team operations that imitate a real adversary from first access to objective, vulnerability research and exploit development. Of the 93 open roles on 11 November, 73% mentioned penetration testing or red teaming, 44% asked for exploit development, vulnerability research or reverse engineering, 41% named an OffSec certification such as OSCP, and 49% mentioned reports. That last figure is the one beginners underrate: a penetration test produces a document, and the people who rise in this branch are the ones whose findings get fixed because they were written clearly.

A small specialty with distinctive employers. Penetration testing held only 4.3% of the board's openings. It also had the highest clearance share of any specialty, 14% (13 of 93 roles), because defense contractors such as Two Six Technologies (8 offensive roles) hire offensive engineers for government work. Thales listed 15 offensive roles, most of them French engineering internships.

The first seat. Counting internships, offensive security had the highest share of starting-rung titles on the board (12 of 93), but nine of those were French internships at one employer. Outside them, the real first seats were few: CrowdStrike's red team intern program, Armadin's associate red team analyst in Mexico, and Wiz's pentest product associate, which nonetheless asked for two years of hands-on application security or penetration testing experience. The sibling guide on how to become a penetration tester covers the route in detail.

Where it leads. The stated middle was $200,000, typical $169,000 to $320,000, from 41 ranges, as the penetration tester salary page shows by level. The senior seats are red team lead, principal consultant (one open title read "Managing Principal, Red Team Operator"), and vulnerability researcher, and a newer branch tests AI models themselves: the best-paid offensive opening on the highest paying jobs ranking on 11 November was a red team engineer for an AI lab's safeguards team. Many offensive practitioners also move sideways into application security, where 35% of postings mention penetration testing, and where the work trades the variety of client engagements for ownership of one product.

6. Govern and advise: GRC, architecture and consulting

These two specialties share a skill that the others treat as secondary: turning technical facts into decisions that non-specialists (auditors, customers, executives, buyers) can act on.

Governance, risk and compliance

The work. GRC practitioners turn security into evidence that outsiders accept: SOC 2 and ISO 27001 programs, FedRAMP and CMMC for government work, PCI DSS for payments, risk assessments, third-party reviews and customer security questionnaires. Of the 215 open roles on 11 November, 77% named at least one framework, 23% named FedRAMP specifically, and 64% mentioned audits.

Part of the specialty is now an engineering job. Across the board, 17 titles said GRC engineer or compliance engineer, against 28 that said GRC, compliance or risk analyst. Within GRC postings, 29% named Python and 31% talked about compliance automation or automated evidence collection. The logic is straightforward: when a company holds several certifications at once, collecting the same evidence by hand for each audit stops scaling, so employers hire people who can pull it from systems with code. That shift makes GRC one of the few paths where a non-technical entrant can steadily become technical inside the job.

Clearances and government work. GRC had the second highest clearance share (11.2%, 24 roles), mostly information system security officer seats at defense companies. Anduril's senior ISSO posting is typical: five or more years in cybersecurity or information assurance, managing vulnerability remediation and authorization documentation in eMASS, at $147,000 to $196,000.

Where it leads. The stated middle was $176,000, typical $153,000 to $320,000, from 125 ranges ( GRC salaries), and the ladder rose from $162,000 for titles with no level word to $207,000 for staff and principal titles. Management comes earlier here than in engineering: Coinbase's GRC manager posting asked for eight or more years in technology risk, IT audit or compliance and stated $193,970 to $228,200. Above that sit roles such as Zania's VP of GRC, which asked for twelve or more years, and privacy leadership, where The New York Times' VP and head of privacy asked for fifteen or more years at $275,000 to $315,000. In the NICE framework, oversight and governance is the largest category, with 17 of the 42 work roles, which reflects how many distinct jobs this branch contains.

Security architecture and consulting

The work. Architects set the patterns other teams build on; consultants and vendor-side engineers design deployments, run proofs of concept and answer a buyer's hardest technical questions. Of the 140 open roles, 54% used customer-facing language, 46% mentioned travel and 46% mentioned presales or proofs of concept, all the highest shares on the board. 65 of the 140 titles were sales engineer, solutions engineer, forward deployed engineer or consultant titles.

Who gets in. This is a destination more than a starting point. The median experience asked was seven years, and only 2 starting-rung titles were open, one of them Darktrace's graduate solutions engineer. Most people arrive after several years in engineering, operations or GRC, when they can explain why a design is safe as well as build one. The stated middle was $208,000, typical $175,000 to $343,000, from 46 ranges.

Where it leads. The senior path runs to principal architect, to practice leadership at a consultancy, or to the vendor role of field CISO. Four of the 13 CISO titles open on 11 November were field or advisory CISO roles at vendors: customer-facing advisers who carry the title but run no internal security program. Illumio's field CISO stated $208,000 to $250,000. For someone who likes the strategic conversation of a CISO role but not the budget fights, it is a real alternative destination.

7. Lead: managers, directors and CISOs

The work. Security leaders set priorities, own budgets, hire and develop teams, and answer to executives and boards for the organisation's risk. Within the 237 leadership roles open on 11 November, 115 titles were people-manager titles, 48 were program or technical program manager titles, 43 were directors, 13 were VPs or heads of security and 13 were CISO titles.

No first seat. Leadership had no starting-rung titles at all, and its postings asked for the most experience: a median of eight years across the specialty and ten for directors and above. The US government's description of the path matches the postings. The BLS says information security analysts may advance to become chief security officers or other computer and information systems managers, and that an IT security manager may need to have worked as an information security analyst; the managers' occupation lists five years or more of related work experience and a May 2025 median of $175,140 - BLS, computer and information systems managers.

What the postings ask of leaders. Strategy and roadmaps appeared in 74% of manager-titled postings and 88% of director-and-above postings, against 39% of senior specialist postings. Executives or the board appeared in half of both management groups, and budgets in 15% and 24%. Yet leadership postings are less detached from the technical work than people assume: 48% of manager postings and 60% of director-and-above postings used the words "hands-on" or "player-coach". Many employers want a leader who can still read a detection, review a design or sit on an incident bridge.

Not every manager title manages people. Some manager titles describe incident commanders, program managers or physical site security managers rather than people leaders. Measured by the text, 65% of manager-titled postings talked about building, hiring, leading or developing a team; the rest manage programs, incidents or vendors. Read the posting, not just the title, before deciding whether a role is a step onto the management track.

Pay. The specialty's stated middle was $229,000, typical $204,000 to $382,000, from 131 ranges, with directors at $265,000 and CISO titles at $305,000 across the board. The manager and CISO salary page splits that by employer and workplace.

8. The ladder: rungs, years and pay

The specialties describe where you work; the ladder describes how far up you are. Employers signal the rung with a word in the title (intern, associate, senior, staff, principal, lead, manager, director) or, at many fast-growing companies, with no word at all. The chart counts the 2,150 open roles of 11 November by the highest rung their title names.

The shape is a pyramid with a very small base. Titles with no level word (35% of the board) and senior titles (26%) make up the bulk; staff and principal titles together (18%) outnumber all management titles combined. Starting rungs are the thinnest layer: 88 roles, of which 29 were internships posted in French or German (28 of them at Thales), leaving 59 English-language starting-rung titles. Most titles without a level word sit in the middle of the ladder, though not all of them: AI labs tend not to put levels in titles at all (58% of their security titles carried none, against 31% at security vendors), and a "Security Engineer" at a lab can be paid like a staff engineer elsewhere.

The years each rung asks for

About half the postings state a number of years, and the numbers step up cleanly with the rung.

The samples behind each bar differ: only 9 of the 88 starting-rung postings stated years at all, against 365 of 754 with no level word, 317 of 555 senior postings, 254 of 458 lead, staff and principal postings, 125 of 212 manager and program manager postings and 51 of 83 at director and above. Two readings follow. First, the rungs are roughly two to three years apart, so a career that moves at the pace the postings assume reaches senior around year five and staff or principal around year eight. Second, managers are asked for fewer years than staff engineers (a median of six against eight). Employers promote people into management earlier than they promote them into the top specialist rungs, because the specialist rungs require depth that only accumulates with time on hard problems, while management requires a different kind of experience that some people show early.

What each rung pays

Sample sizes behind those middles: 319 ranges for no level word, 272 for senior, 29 for lead, 144 for staff, 86 for principal, 32 for program managers, 84 for managers, 33 for directors and 8 for CISO titles, so the top bar rests on few postings. The typical spans were wide: $149,000 to $358,000 with no level word, $169,000 to $280,000 for senior, $201,000 to $340,000 for staff, $177,000 to $336,000 for managers, $232,000 to $406,000 for directors and $273,000 to $414,000 for CISOs.

The chart hides one distortion worth correcting. The no-level group includes most of the AI labs' roles, and the labs pay the most of any employer kind, which pulls that bar up toward the senior bar. Leaving AI labs out, the ladder reads more clearly: $175,000 for no level word, $190,000 for senior, $230,000 for staff, $220,000 for principal, $215,000 for managers, $265,000 for directors and $305,000 for CISOs. The two large steps in a security career are the move from senior to staff (about $40,000 at the middle) and the move from manager to director (about $50,000). The move from mid-level to senior is real but small, which matches what the postings ask: senior is mostly about doing the same work independently, while staff and director are about doing a different kind of work.

At the bottom of the ladder, pay splits by kind of seat. Interns are paid by the hour: the 14 internship postings stating a rate had a middle equal to about $57,200 a year, from Rocket Lab's $18 to $25 an hour to Figma's PhD security intern at $74 an hour. Starting-rung roles and internships together stated 23 distinct ranges with a middle of $92,900, but that blends associate SOC seats in the $85,000 to $90,000 range with new-graduate software security roles at $130,000 to $175,000. The entry-level roles page shows those figures by specialty as the board stands today.

What changes as you move up

Titles and numbers tell you where a rung is; the postings themselves tell you what it is. Reading all 2,150 postings for a handful of signals, and 112 of them in full across every rung, shows the job changing shape in a consistent way.

English-language postings only; the manager column includes program managers. Read across the rows and the career arc appears. Code peaks at the senior rung and stays high for staff and principal engineers, then halves at the management rungs. Strategy and roadmaps climb steadily from the first seat to the director's office. Executives and budgets barely appear until the management rungs, then dominate. On-call duty peaks at senior, when you are the escalation point, and falls back once you set direction rather than carry the pager.

The full postings add the texture behind those percentages. At the starting rung, the recurring phrase is working alongside someone: GuidePoint Security's associate cloud security engineer works "alongside senior consultants" with "hands-on mentorship". At the middle rung, you own a queue and the projects that improve it: BitGo's SOC analyst posting asked for four or more years responding to alerts and expected the hire to run projects from beginning to end. At the senior rung, you become the person others escalate to and you lead incidents yourself: Samsara's senior security operations engineer leads incidents as incident commander. At staff and principal, the language becomes about authority without a team: Arctic Wolf's staff researcher is "recognized as a technical authority", and MongoDB's principal software engineer for security, asking for twelve or more years at $203,000 to $399,000, is told to form independent opinions on security and architecture decisions and voice them even when they cut against consensus. At the management rung, the first verb changes: OpenAI's manager of cyber applied AI architects is asked to "hire, coach, and develop a team". And at the director rung, the job is a function rather than a team: WHOOP's director of security engineering and operations, asking for ten or more years at $220,000 to $245,000, would lead two functions and define their strategy, standards and measurable outcomes.

9. Above senior: the specialist track and the management track

Somewhere around year five to seven, most security careers reach a fork. You can keep deepening as a specialist, toward staff, principal and distinguished engineer or researcher, or you can move into managing people, toward manager, director and eventually CISO. Many people assume the second fork is the only way up. The postings disagree.

The specialist track is the bigger one. Above the middle rung, the board held 1,013 specialist titles (senior, lead, staff and principal) against 243 management titles (manager, director, VP or head of, CISO) and 52 program and project manager titles on 11 November. Even counting only the top specialist rungs, staff and principal titles (387) outnumbered people-manager titles (160) by more than two to one.

It pays about the same until director. Staff and principal titles together stated a middle of $225,000 from 230 ranges; people-manager titles stated $219,000 from 84. The board's highest paying jobs ranking puts the same comparison in its own words, ranking principal or staff security engineers above security managers. The management track pulls ahead only at director ($265,000) and CISO ($305,000), and those seats are scarce: 54 director titles and 13 CISO titles, four of the latter being vendor field CISO roles.

The two tracks ask for different evidence. A staff or principal posting asks you to show depth: systems you designed, research you published, incidents you led, the hardest technical decisions you made and why. A manager posting asks you to show leverage through people: teams you built, people you hired and promoted, programs you delivered through others, budgets you defended. The BLS describes both directions for security analysts: advancing within the occupation by leading a team of analysts or becoming an expert in one area of information security, or advancing into management - BLS Occupational Outlook Handbook.

There is a third track, and a hybrid. Program and technical program managers (52 roles, middle $223,000) run cross-team security programs without owning the engineers. OpenAI's senior technical program manager for security asked for five or more years leading technical programs and stated $165,400 to $285,000. The hybrid is the player-coach: a small team's leader who still does technical work, which is what the "hands-on" language in half of all management postings describes.

How to choose between them. Since the two tracks pay alike until director, the deciding question is what you want your working week to hold. Think of the month at work you enjoyed most: if it was a hard problem you cracked yourself, the specialist track keeps more of those months; if it was a person you helped grow or a dispute you settled between teams, management offers more of them. Nor is the fork final. Design judgment and influence matter on both tracks, so a manager who keeps technical credibility can step back into a specialist seat, and the hands-on language in management postings shows how many employers want leaders who never fully left the technical work.

The next rung may be at another employer. Internal promotion depends on budgets as much as merit. In ISC2's 2025 workforce study of 16,029 practitioners, 41% of respondents at large organisations reported promotion freezes, alongside hiring freezes (49%) and budget cuts (46%) - ISC2, December 2025. When the rung above you is frozen where you work, the open postings show where it exists, and which rung they would place you on.

10. Moving between specialties

Security careers are rarely a straight line inside one specialty. People move sideways when a new branch opens, when a role they did not know about appears, or when they discover they prefer building to watching or explaining to building. The cost of a move depends on how much of what you already know the new specialty uses, and the postings show those overlaps directly.

The principle is simple. Each specialty works on a particular kind of evidence (alerts and logs, code, cloud configuration, identities and permissions, control evidence) and with a particular audience (an incident commander, developers, platform engineers, auditors, customers). A move is cheap when the new specialty shares your current evidence or your current audience, and expensive when it shares neither.

Three moves stand out because the market rewards them. The first is operations to detection engineering, the direction the operations titles already lean: an analyst who learns to write detections as code moves into the part of the specialty where most of the senior titles are. The second is software development to application security, the specialty with the steepest pay ladder, where former developers enter at a higher rung than people who arrive from operations. The third is GRC to GRC engineering, which takes someone from a specialty with a $176,000 middle toward the engineering ladder above it, without leaving the work they know.

The expensive moves are the ones that change both the evidence and the audience at once: a GRC analyst who wants to become a penetration tester, or a SOC analyst who wants to become a cloud architect, has to learn a new kind of evidence and a new kind of customer together. Those moves are possible, and they get easier through an intermediate step (GRC to application security reviews, operations to cloud detection) than in one jump. Your resume for a sideways move should lead with the overlap the table shows, since that is what makes the move credible to the person screening it.

11. Where the entry points are

If you are choosing a path before your first security job, the most useful number is not how many roles a specialty has, but how many of them a newcomer can win.

By title, the entry points are few and concentrated. The board's entry-level roles page counted 59 starting-rung titles at 40 employers late on 11 November: 22 in security engineering, 16 in operations, 5 in GRC, 4 each in application security and penetration testing, 3 in threat intelligence, 2 each in cloud security and architecture, 1 in identity and none in leadership. Relative to each specialty's size, operations offered the best odds (16 of 309, 5.2%), followed by penetration testing (4 of 93, 4.3%) and engineering (22 of 618, 3.6%). The internships page counted 36 student openings that evening (29 internships or co-ops and 7 new-graduate roles across 23 employers), with interns' middle rate at $28 an hour.

Titles undercount the openings a newcomer can realistically reach. Among postings with no level word in the title, 102 gave two years or less as the first experience figure they stated, and across every rung above the starting one, 122 did. That is twice as many as the titled starting rungs. By specialty, those low-experience postings were concentrated where the titled entry points are: 32 in engineering, 23 in operations and 19 in application security, followed by GRC (7) and smaller numbers elsewhere. A posting titled simply "Security Engineer" that asks for two years is, in practice, an entry point for someone with two years in IT or software.

The credentials are less of a barrier than they look. Only 35% of all postings (745) mentioned a bachelor's degree or a degree at all, and 54% of those (402) also accepted equivalent experience in its place. Certifications appear in about a quarter of postings, more often at the senior rungs than at the first ones; the certifications page ranks the ones employers name and which specialties name each. Clearances were rare at the first rung (3 of 88 starting-rung postings).

The practical conclusion. Without a security job yet, the job you hold now largely picks your first specialty, since each one draws newcomers from a particular neighbour (the guide to getting into cybersecurity maps those doors). Choosing straight from school, the entry points favour engineering if you code and operations if you do not, with GRC as a third route for strong writers and organisers.

12. AI security as a new branch

AI security gets a section of its own because it cuts across every other branch. On 11 November, 231 open roles at 112 employers were AI security work by the board's rule (a title naming AI, machine learning, LLMs or agents, or a posting naming at least two AI security topics), 10.7% of the board. Their stated pay ran from $178,000 to $350,000 typical, the middle at $214,000 from 125 ranges, and 84 were remote - AI security jobs.

What the work actually is. The topics the postings named show what employers are worried about. Of the 231, 146 talked about securing AI systems in general, 114 named prompt injection, 62 named LLM security, 34 data poisoning, 32 model security or the protection of model weights, 25 adversarial machine learning, 22 jailbreaks and 19 red-teaming of AI models; 174 mentioned agents. Prompt injection's lead matches the industry's own list: it is the first entry, LLM01, in the OWASP Top 10 for LLM and generative AI applications, 2025 edition - OWASP GenAI Security Project.

It is a branch of the existing specialties, not a new one. Reasoned from first principles, AI systems do not need a new kind of security practitioner; they need the existing kinds applied to a new kind of system. Prompt injection is an injection flaw, which application security already knows how to model. Red-teaming a model is offensive work with a different target. An AI agent that acts on a user's behalf is a non-human identity with permissions, which is identity work. Model abuse shows up in logs, which is detection work. And standards for AI management systems are a new framework for GRC to evidence. The postings bear this out: AI security roles sat inside security engineering (103 roles, 17% of that specialty), architecture (25, 18%), application security (25, 12%), operations (20), leadership (16), GRC (13), penetration testing (12, 13%) and threat intelligence (12).

It is not an entry point yet. Only 6 of the 231 AI security roles carried a starting-rung title, against 87 with no level word, 59 senior and 58 staff or principal. The branch is staffed by people who already practise one of the existing specialties and added AI on top. For a career plan, that means the route into AI security runs through application security, engineering or offensive work first, with AI-specific knowledge as the differentiator rather than the foundation. The pay reflects the scarcity of that combination, and the security roles at AI labs themselves (132 on the board, middle $318,000) are the best-paid employer group on the board.

13. Choosing a path

With the map, the ladder and the moves laid out, choosing becomes a question of fit along three axes: what kind of work suits you, what you bring, and what the market offers.

By temperament. The branches feel different from the inside, and the postings show how.

• If you like urgency, puzzles and a clear end to each case, the defend branch fits: operations postings mention shifts or on-call cover more than any other (45%), and each investigation closes.
• If you like making things and seeing them used, the build branch fits: two thirds of senior postings name a programming language or code, and the work is measured in systems shipped.
• If you like adversarial creativity and can write, the break branch fits, provided you accept that half its postings mention reports and that the specialty is small.
• If you like structure, writing and persuading people, GRC fits, and it increasingly rewards those who add automation.
• If you like explaining and travelling, architecture and consulting fit: more than half their postings are customer-facing.
• If you get more satisfaction from people's growth than your own output, plan toward the management track from senior onward.

By background. Your current job sets the cheapest first move. IT support and help desk lead most naturally to operations or identity. Systems and network administration lead to security engineering and cloud security. Software development leads to application security and identity products, often at a higher starting rung. Cloud, platform and DevOps engineering lead to cloud security. Audit, compliance, legal and risk lead to GRC. Military and government service lead to cleared operations, engineering and GRC seats; the cleared roles page lists 148 postings at 33 employers that named a clearance on 11 November, and offensive security (14%) and GRC (11%) asked for one most often.

By market. The measured trade-offs, in one place:

• Most openings: security engineering (618), then operations (309); best newcomer odds by title: operations (5.2%).
• Highest middle pay outside leadership: identity ($225,000); steepest ladder: application security ($179,000 to $250,000).
• Most remote: architecture and operations (39%); least: cloud security (18%); most clearance-bound: penetration testing and GRC.
• A branch to grow into later: AI security, reached through engineering, application security or offensive work.

A method that works. Pick two neighbouring specialties that fit your temperament and background. Open twenty current postings in each on the board, at the rung just above where you are. List what they ask for that you lack, and count how often each gap appears. The gap that appears in most postings of both specialties is your next year of work, and whichever specialty's gaps are smaller is your first move. Then prepare for the interviews of that specialty, since each one tests a different kind of judgment.

14. Questions about cybersecurity career paths

What are the main types of cybersecurity jobs?

Ten kinds of security work in five branches: defend (operations and incident response; threat intelligence), build (security engineering; application security; cloud security; identity and access management), break (penetration testing and red teams), govern and advise (GRC; architecture and consulting) and lead (managers, directors, CISOs). The two largest right now are security engineering ( 619 open now) and operations ( 309).

What is the best cybersecurity career path?

There is no single best one, but there is a best one for a given person. On the measured trade-offs, identity and access management and application security had the highest middle pay outside leadership on 11 November ($225,000 and $218,000), security engineering had the most openings (618 of 2,150) and operations had the best share of starting-rung titles. The best path for you is the one whose first move uses most of what you already know (section 10) and whose daily rhythm suits you (section 13).

What does cybersecurity career progression look like?

In the postings, rungs are two to three years apart. Titles with no level word most often asked for three years, senior titles five, managers six, staff, principal and lead titles eight, and directors and above ten. Pay rose from a middle of $187,000 for no level word to $192,000 senior, $231,000 staff, $265,000 director and $305,000 for CISOs on 11 November, with the largest steps from senior to staff and from manager to director.

Which cybersecurity job pays the most?

CISO and VP of security roles state the highest salaries, followed by security directors and then principal and staff engineers. The highest paying cybersecurity jobs page ranks 18 job titles by the ranges in their open postings and updates every hour. Employer kind matters as much as title: security roles at AI labs stated a middle of $318,000 on 11 November, against $175,000 at defense companies.

Which cybersecurity path is easiest to start in?

By the share of roles titled as a starting rung, security operations (5.2%) and penetration testing (4.3%), but penetration testing is small and its entry roles still ask for proof of skill. In absolute numbers, security engineering had the most starting-rung titles (22), mostly for people who can write code. For someone without a technical job yet, the realistic order is an IT or development job first, then operations, engineering or GRC; today's openings sit on the entry-level roles page.

Can you switch specialties in cybersecurity?

Yes, and it is common. The cheapest switches share evidence or audience with your current work: operations to detection engineering, software development to application security, audit to GRC, application security to penetration testing. Moves that change both, such as GRC to penetration testing, usually go through an intermediate role.

Do you have to manage people to reach the top of a security career?

No. Above the middle rung there were about four specialist titles for every management title on 11 November, and staff and principal titles stated a middle of $225,000 against $219,000 for people managers. Management pulls ahead only at director and CISO, which are a small number of seats.

How many years of experience does a CISO role ask for?

Director-and-above postings asked for a median of ten years, and some CISO-level postings asked for more: one field CISO opening wanted ten or more years in leadership, three of them as a CISO or VP of security. The usual road runs through a director post in operations, engineering, product security or GRC.

Is AI security a good career path?

It is one of the best-paid branches (a middle of $214,000 across 231 roles on 11 November), and it reaches into every specialty, with a dozen or more roles in eight of the ten. It is rarely a first job: only 6 of those 231 roles carried a starting-rung title. The usual route is to become strong in application security, engineering or offensive work first, then add AI-specific skills such as testing for prompt injection and securing agents.

Is there a cybersecurity roadmap that works for everyone?

The shape is shared (a neighbouring job, a first security seat, independence at senior, then a choice between specialist depth and management) but the specialty is not. A roadmap that ignores your starting job wastes years; one built from the postings of the specialty next to your current work is the shortest path the market offers.