Is cybersecurity a good career? An honest verdict for four starting points, measured on 2,150 open security jobs

A measured answer to whether security work is worth choosing now, built from the 2,150 openings 298 employers had posted on 12 November 2026 and set beside the government's projections, the largest practitioner survey and this year's layoffs.

Cybersecurity is a good career in 2026 for anyone who can reach its second rung, and a slow one to start from nothing. The work pays well (the middle salary stated in open postings was $205,000, and the US government projects 21% growth in analyst jobs over a decade), yet only about one opening in ten was written for someone with two years of experience or less, and US postings fell by a quarter this year. AI is absorbing the most repetitive part of the first job while opening a well-paid branch whose work is protecting AI systems. So the verdict turns on where you begin: strong for IT staff and software engineers, workable for graduates who plan early, and a two-stage project for someone with no technical background.

What this answer rests on. CyberJobs.cc reads open security roles straight from the careers systems of the employers that post them, every hour. For this guide the board's complete job feed was read once with the full text of every posting, as it stood at 23:01 UTC on 11 November 2026 (the first hour of 12 November in Central Europe): 2,150 open roles at 298 employers. Each posting was sorted by specialty, by the level word in its title, by the first number of years of experience its text asks for, by the salary range it states, by whether it is fully remote, and by whether its duties involve protecting AI systems or using AI tools. Just under half (1,038 postings, 48%) state a salary, nearly all in US dollars, so pay figures lean toward American employers; and the companies this board follows (security vendors, software and cloud firms, defense contractors, banks and AI labs) pay more than the economy at large. Counts the board can recount refresh each time this page loads. All other board figures describe that one evening, each with the number of postings behind it, and every outside figure carries a link to its source page.

Contents

1. What makes a career good, and how to test this one
2. Demand, measured: who is hiring and for what
3. Pay, measured: what postings state at each level
4. The entry-level squeeze
5. Is cybersecurity oversaturated?
6. AI: what it is taking and what it is creating
7. Remote work and location
8. Stability: layoffs against regulated demand
9. Who the work suits, and who it wears down
10. The verdict by starting point
11. Questions people ask before choosing security

1. What makes a career good, and how to test this one

"Good" is too vague to measure, so this guide breaks it into four tests that can each be checked against data. A career is worth choosing when it pays more than your realistic alternatives for the effort it takes, when demand for the work rests on something more durable than a hiring fashion, when the first seat can be reached at a reasonable cost in time and money, and when the skills keep their value as the tools change. A fifth test is personal: whether the ordinary week of the job is one you would choose. The sections below take each test in turn, and section 10 combines them for four common starting points.

Security does unusually well on the second test, and the reason is structural rather than cyclical. Most technology spending buys something that can be finished: a feature ships, a migration completes, a data center is built. Security spending buys protection against an opponent who adapts to whatever was built. Every new system, cloud account, vendor connection and AI agent adds surface an attacker can try, and the attacker's methods change after each defense lands. That makes the work recurring by nature. Two further forces lock it in. Regulators and large buyers increasingly make demonstrable security a condition of doing business, so even a company that would rather spend less cannot. And a breach is expensive in a way that executives feel personally, which gives the security budget a defender in the room whenever spending is cut.

None of that guarantees a seat for any particular person. Durable demand for security work is a different thing from durable demand for beginners, and the gap between those two is the most important fact in this guide. Sections 4 and 5 measure it.

2. Demand, measured: who is hiring and for what

On 12 November the board held 2,150 open security roles. Security engineering was the largest specialty with 618, followed by security operations and incident response (309), security leadership (237), governance, risk and compliance (215) and application and product security (210). Threat intelligence (141), architecture and consulting (140), identity and access management (111), penetration testing (93) and cloud security (76) made up the rest. As this page loads, the live counts read 617 in engineering and 309 in operations.

The chart puts each specialty's openings beside the number that a newcomer can realistically compete for: roles whose title marks a starting rung, plus roles with no level word in the title that ask for two years of experience or less (section 4 explains the rule).

Two features of the picture matter for a career decision. The first is that most of the demand is for building and running defenses rather than for watching them. Engineering, application security, cloud and identity together held 1,015 roles, 47% of the board, which means the typical security job now looks more like an engineering seat with a security mandate than like a screen of alerts. The second is how thin the low-experience bars are everywhere. Even in operations, the specialty most associated with first jobs, they came to 46 of 309 roles.

Who employs security people

A common assumption is that security careers happen at security companies. The postings say otherwise. Security vendors held 618 of the roles (28.7%) across 79 employers, and security consultancies and managed services another 121 across 16. The remaining two thirds sat at organizations whose product is something else: software and internet companies (449 roles), cloud, data and infrastructure firms (358), defense, aerospace and hardware makers (265), banks, payment and crypto firms (201) and AI labs (132). Security is a function that every company with valuable systems has to staff, which is a large part of why the demand is broad. The industry breakdown keeps these groups current.

Hiring is also spread out rather than held by a few giants. The largest single employer, Palo Alto Networks, accounted for 103 of the 2,150 roles (4.8%), followed by Thales (98), SpaceX (63), Anthropic (52) and CrowdStrike (50). The ten largest together held 26% of openings, it took 40 employers to reach half of them, and the median employer had 4 security roles open. For a job seeker, that spread is protective: no single company's budget cycle decides the market.

How long postings stay open

The feed carries each posting's date as closely as the board knows it (the earlier of the employer's own date and the board's first sighting), which gives a rough read on how quickly roles are filled. The median open posting was 44 days old. 39% had appeared in the last 30 days, 27.5% were older than 90 days, and 76 were more than a year old, which usually marks an evergreen requisition or a seat that is genuinely hard to fill.

Age differs by level in a telling way. The 209 low-experience postings had a median age of 35 days, and only 19% were older than 90 days. The 1,314 postings with senior, lead, staff, principal or management titles had a median age of 46 days, with 27% past 90 days. Some employers re-date postings when they edit them, so read the gap as a direction rather than a measurement, but the direction is consistent with everything else in this guide: experienced seats linger, junior seats do not.

What the national figures add

The board sees one slice of the market, so it helps to set it beside the government's view. The US Bureau of Labor Statistics counted 192,900 information security analyst jobs in 2025 and projects employment to grow 21% from 2025 to 2035, against 6% for computer occupations and 3% for all occupations, with about 14,100 openings a year on average - BLS Occupational Outlook Handbook, last modified 27 August 2026. That occupation is only one title among many in security; the CyberSeek project, run by CompTIA with Lightcast and NICE, counted 514,359 US security job listings over the 12 months to April 2025, 12% more than the year before - CompTIA, 2 June 2025.

The most recent count is less cheerful. CyberSN's jobs report found 235,786 US security postings between January and September 2026, down 26.4% from the 320,210 of the same months in 2025 and a four-year low - SecurityWeek, 18 October 2026. Both readings can be true at once. A ten-year projection describes how many people the economy will employ in the work; a count of postings describes how many seats employers are trying to fill this year, and it swings with budgets, interest rates and hiring freezes. A career lasts decades, so the projection matters more for the choice of field, while the posting count matters more for how hard the next twelve months of job hunting will be.

3. Pay, measured: what postings state at each level

Across the 1,037 distinct salary ranges in open postings on 12 November, the middle (the median midpoint of the ranges) was $205,000 a year, and the typical span ran from $167,000 to $345,000 (the 25th percentile of midpoints to the 90th percentile of range tops, the board's one definition, explained on the methodology page). Postings located in the US had a middle of $213,000 across 775 ranges. Today's figures sit on the salary report, and the live middles read $210k/yr for engineering and $177k/yr for operations as this page loads.

Those numbers are far above the national median, and the reason is worth understanding before anyone plans a budget around them. The BLS put the median wage of information security analysts at $129,180 in May 2025, with the lowest tenth earning less than $75,090 and the highest tenth more than $199,850, against $50,980 for all workers - BLS. The government counts every analyst at every employer, including hospitals, school districts and county offices. The board counts offers from employers that publish through modern applicant tracking systems, which tilts toward technology companies and toward the US postings that print a range at all. The truthful summary is that security pays well everywhere and very well at technology employers.

Pay climbs with experience, fastest early on

The clearest way to see what experience is worth is to group postings by the years they ask for and compare the salaries they state.

The samples behind the bars are 63 ranges for two years or less, 89 for three to four, 331 for five to seven, 124 for eight to nine and 112 for ten or more. The first step is the steepest: moving from a posting that asks for two years to one that asks for three or four adds about $30,000 at the middle, and the next three steps add roughly $27,000, $24,000 and $13,000. That shape matters for a career decision. The early years in security are where earnings rise fastest, so the cost of a slow start (a year spent trying to break in, or a detour through an unrelated job) is paid in the steepest part of the curve.

Pay by rung and title word

Grouped by the level word in the title instead, the middles were $187,200 for titles with no level word (317 ranges), $192,500 for senior titles (272), $231,300 for staff (144), $222,500 for principal (86), $218,200 for people managers (86), $265,000 for directors (33) and $305,000 for CISO titles (8). At the bottom, internships stated a middle equal to $57,200 a year, about $27.50 an hour, across 14 ranges, and the 9 non-intern starting-rung ranges had a middle of $144,000, a figure pulled up by new-graduate security software seats. The career paths guide walks that ladder rung by rung.

One word in a title predicts pay better than most: "analyst" or "engineer". The 178 analyst-titled postings stated a middle of $153,500 across 76 ranges, while the 1,126 engineer-titled postings stated $207,500 across 611. The 254 postings with software engineering titles (software engineer, developer, backend or full-stack) stated $223,250. The market pays a premium for people who build controls rather than operate them, and section 6 shows that AI is widening that gap.

Pay by employer and specialty

Employer kind moves pay more than specialty does. AI labs stated a middle of $318,000 across 109 ranges, software and internet companies $219,200, banks, payment and crypto firms $204,500, cloud and data firms $204,100, security vendors $191,500, security consultancies $185,000 and defense and aerospace companies $175,000. Between specialties the spread is narrower: governance, risk and compliance ($176,300) and operations ($177,000) at the low end, identity ($225,000) and leadership ($229,000) at the top, with engineering at $212,000. For one specialty in depth, the salary pages break pay down further, and the salary calculator compares a specific offer with what postings state.

A comparison with software development keeps expectations honest. The BLS put the median wage for software developers at $135,980 in May 2025, slightly above the $129,180 for security analysts - BLS, software developers. At the national middle, security is not a pay upgrade over writing software. Its premium appears higher up, and in the specific combination of software skill and security judgment, which is why the postings that ask for both pay among the most on the board.

4. The entry-level squeeze

This is the part of the answer that most enthusiastic career articles skip, so it gets measured three ways.

By title. 87 of the 2,150 postings (4.0%) had a title marking a starting rung. 57 were internships or apprenticeships, and 29 of those were written in French or German, almost all for one European defense group, Thales. The other 30 were junior, associate, new-graduate or level-one titles. The board's entry-level page, which keeps only English titles, counted 59 at 40 employers that evening.

By the years asked. 1,412 postings (66%) stated a number of years of experience, and the median was five. Only 152 of them (10.8%) asked for two years or less, while 1,024 (72.5%) asked for five or more.

Both together. Counting every starting-rung title, plus every posting with no level word that asks for two years or less, gives 209 roles (9.7% of the board) at 88 of the 298 employers; leaving out the French and German internships brings it to 180 (8.4%). For a reader in the United States the window is narrower still. Of the 1,014 roles open to someone living there (posted in the US or open worldwide), 62 met that test, 6.1%, and the US-open postings that state a requirement asked for a median of six years.

The 209 seats cluster where training is cheap for the employer. Defense, aerospace and hardware companies held 73 of them (many in recruiting cohorts that sponsor clearances), security vendors 48, software companies 37, consultancies and managed services 18, and banks and cloud firms 16 each. AI labs, the best-paid employers on the board, held exactly one. Relative to its size, operations offered the most (46 of 309, 14.9%), then engineering (12.6%) and application security (11.9%); identity (3.6%) and leadership (one seat in 237) offered almost none.

What the realistic first seats look like

Reading the low-experience postings in full shows that "entry level" in security usually means a candidate who already has something, either a degree or a couple of years in or beside the field.

• SpaceX's Security Analyst (SOC) in Hawthorne, California asks for a bachelor's degree in a STEM field or two years of professional information security experience in lieu of one, and states $95,000 to $115,000.
• Esri's Security Operations Analyst in Redlands, California asks for two years of hands-on monitoring, triage and investigation, works business hours with an on-call rotation once the hire knows the systems, and states $70,304 to $114,400.
• Chainguard's remote GRC Analyst for Europe accepts two years in information security, compliance, audit, risk or IT, which makes it one of the few seats open to someone arriving from an audit or risk job.
• Headway's remote Security Engineer (Detection & Response) asks for one to two years of security response and automation, or four to five years in DevOps, IT or software engineering with security overlap, and states $182,750 to $215,000.

The Headway posting shows something the averages hide: a few employers explicitly treat adjacent engineering experience as equivalent to security experience, and those seats pay like mid-level roles. They are the best entry points on the board, and they go to people who already work in technology.

Why the first rung is so narrow

Think of the experience requirement as insurance the employer buys. A security team's mistakes are asymmetric: a missed intrusion or a wrongly granted permission can cost far more than a year of salary, and a beginner's judgment is unproven. Hiring someone with five years transfers that risk to the candidate's past employers, who already paid to train them. Training a junior is a bet the team can only afford when it has senior people with time to review the newcomer's work, which is why the seats concentrate at large operations centers, defense contractors and service firms with cohorts. A security team of three at a growing company almost never posts a junior role, however much routine work it has.

Budgets tighten that further. In ISC2's 2025 study of 16,029 practitioners, hiring freezes held at 39%, 33% of respondents said their organizations lacked the resources to staff their teams adequately, and 29% said they could not afford to hire staff with the skills they needed - ISC2 2025 Cybersecurity Workforce Study, 4 December 2025. A frozen team rarely backfills with a beginner. And the AI Workforce Consortium, founded by Cisco, found that in the G7 economies senior security postings grew 65% between October 2025 and March 2026 while junior postings grew 5.9% - Infosecurity Magazine, 21 August 2026. Employers are adding experienced seats far faster than junior ones.

Credentials, by contrast, are less of a wall than the reputation suggests. 759 postings (35%) mentioned a degree at all, and 462 of those (61%) also accepted equivalent experience in its place. A named certification appeared in 24% of postings. The binding constraint at the door is experience, not paper.

5. Is cybersecurity oversaturated?

The question is common because both sides of the evidence are loud: a famous shortage figure on one side, and on the other, newcomers reporting hundreds of applications without an interview. Saturation has a precise meaning that settles it. A field is oversaturated when there are more qualified candidates than seats at the going pay. Security is two markets with opposite answers.

At the door, it is crowded. Roughly one opening in ten accepts two years or less, junior postings are growing at a fraction of the senior rate, and the employers who do train beginners can choose among many applicants for each seat. Practitioners expect the door to narrow further: in ISC2's 2025 pulse survey of 436 professionals, 52% said AI would significantly or somewhat reduce the need for entry-level staff, while 31% took the more optimistic view - ISC2, 16 July 2025. For a newcomer without a neighbouring job, "oversaturated" describes the experience accurately.

Inside, it is short. Postings that ask for experience stay open longer, and the senior and staff ladder (section 3) pays steadily more for each step. CyberSeek put the supply-demand ratio for security roles at 74% and reported recruiting periods 21% longer on average - CompTIA. In ISC2's main 2025 study, 88% of respondents said their organization had suffered at least one significant security consequence because of a skills shortage - ISC2 press release, 4 December 2025.

One widely repeated figure deserves a correction. The "4.8 million" security workforce gap came from ISC2's 2024 study, and ISC2 defines its gap as the difference between the staff organizations say they need and the staff available for hire - ISC2, 11 September 2024. It measures perceived need, not open jobs, and in 2025 ISC2 stopped publishing it, explaining that respondents now rank critical skills above the need for more people - ISC2 2025 study. Anyone promising millions of empty seats waiting for beginners is quoting a number that never meant that.

The practical reading: the field is not full, but its door is. Whatever shortens the time from "no experience" to "two years of relevant experience" (a neighbouring IT or engineering job, an internship, a cleared defense cohort) is worth more than any amount of extra preparation done outside a job.

6. AI: what it is taking and what it is creating

The fear behind "will AI replace cybersecurity jobs" is reasonable, because the most repetitive security work is exactly the kind of work language models and automation handle first. The postings show both halves of what is happening: a first rung being redesigned, and a new branch being built.

What it is taking: the routine half of tier 1

A tier 1 analyst's day has traditionally been dominated by alerts that match known patterns: a sign-in from a VPN exit node, a quarantined file, a reported email that turns out to be marketing. Those cases have structured evidence and predictable answers, which makes them cheap to automate. The evidence that they are being automated is now in the postings themselves. 37 open postings at 20 employers described AI agents that triage or investigate alerts, 14 of them in operations. Huntress, which runs a 24/7 human-led operations center, describes the agent its team is building as one that picks up a signal and investigates it end to end, and says the system "is meant to augment our analysts, not replace them" by taking the high-volume, repetitive work off their plates. 7AI, a company built around agents for security operations, is hiring a remote Security Analyst - Tier 2 whose core duty is to analyze and validate AI agent investigations for accuracy, completeness and risk; it asks for two years in security operations and weekend on-call shifts, and states $100,000 to $140,000.

That 7AI posting is the clearest picture available of the first job's future. The human's role shifts from doing the triage to checking it and answering for it, which requires more judgment, not less, and fewer people per alert. Controlled evidence points the same way. In a randomized trial of Microsoft Security Copilot's phishing triage agent, analysts working with the agent achieved up to 6.5 times as many true positives per analyst minute and a 77% improvement in verdict accuracy compared with a control group - Bono, arXiv, November 2025. Omar Santos, a distinguished engineer at Cisco, named the tier 1 SOC analyst as "one of the roles that is getting reshaped the fastest" - SiliconANGLE, 20 August 2026.

The title counts are consistent with that. Across the board, 178 postings carried "analyst" in the title against 1,126 carrying "engineer", and within operations, engineer titles outnumbered analyst titles by roughly 140 to 80. Employers also say so in their own financial filings. CrowdStrike's 2025 restructuring cut about 500 positions, 5% of its workforce - CrowdStrike 8-K, May 2025, and its chief executive's note to staff said that "AI flattens our hiring curve" - CrowdStrike, Exhibit 99.1.

What it is creating: security for AI, and AI inside security work

The other half is new work. The board counts a role as AI security work when its title names AI, machine learning, LLMs or agents, or when its text names two or more AI security topics, prompt injection and model theft among them. On that rule, 231 open roles at 112 employers qualified on 12 November, 10.7% of the board. They stated a middle of $213,600 across 125 ranges, typically $177,500 to $350,000, and 86 were remote. Engineering held the most (103), with architecture and application security at 25 each. CyberSN's count of US postings found demand for AI security engineers up 268.3% even as total postings fell - SecurityWeek. The AI security jobs page lists today's roles and the topics their postings name.

Few of these seats take beginners. Only 13 of the 231 were low-experience seats by this guide's rule, against 86 with no level word and 118 at senior, staff or principal level. Employers are staffing it with people who already practise application security, engineering or offensive work and then learned how models and agents fail.

A second, larger change runs through ordinary postings: more of them now expect the hire to work with AI tools day to day. Matching duty and requirement sentences that ask the hire to use AI (and leaving out product descriptions and hiring-process notices), 436 postings at 160 employers did, 20.3% of the board. One employer, CrowdStrike, writes the same line into nearly every posting; without it the share was 18.4%. Operations led at 26.5%, ahead of threat intelligence (23.4%) and engineering (21.0%), and postings from the last 30 days carried the expectation more often than postings older than 90 days (21.5% against 17.4%). Harness's threat hunting role asks for the ability to use AI for threat hunting, through LLMs and AI-assisted workflows that speed up investigation and triage; DataDome's analyst posting wants someone comfortable using AI-assisted tools to speed up and improve analysis. Outside this board, the AI Workforce Consortium found that 28.5% of security postings in G7 economies between October 2025 and March 2026 required AI skills, up from 14.2% a year earlier - Infosecurity Magazine.

Will AI replace cybersecurity jobs?

Reasoned from what the work is, AI replaces tasks with known answers and raises the value of tasks without them. Security has an unusual property here: the opponent also uses AI, so cheaper automation on the defense side is matched by cheaper attacks, and the volume of novel cases does not fall. The BLS lists increased use of AI among the reasons it projects faster growth for analysts - BLS, and in ISC2's 2025 study only 18% of practitioners said AI was leading them to consider changing careers - ISC2. What AI does change is the shape of the ladder. The bottom rung, where people used to learn by closing easy alerts, is shrinking, and the remaining junior work asks for the ability to check machine output, write a query or a detection, and automate what the agent cannot. A newcomer who arrives with those skills is entering a field that AI makes more interesting. One who expects to learn them on the job by working a queue of easy cases may find the queue gone.

7. Remote work and location

On 12 November, 696 of the 2,150 roles (32.4%) were fully remote; the live count reads 700 as this page loads, and the remote roles page lists them by specialty. Remote seats did not pay less: their middle was $211,750 across 382 ranges, against $203,500 for on-site and hybrid roles.

Remote rarely means anywhere in the world. Of the 696 remote roles, 504 accepted applicants in one country only (335 of them the United States), 70 named several countries and 94 were open worldwide. Employer kind decided the remote share more than specialty did: security consultancies and managed services listed 68.6% of their roles as remote, banks and payment firms 42.8%, security vendors 36.6% and AI labs 36.4%, while defense and aerospace companies listed 8.7%. By specialty, architecture and operations were the most remote (39% each) and cloud security the least (18%). Among the 209 low-experience seats, 61 (29%) were remote, about the board's average, but a remote junior posting draws applicants from an entire country, so it is the most contested seat there is.

Location still shapes the opportunity. 869 of the roles were placed in the US, 130 in India, 100 in Israel, 76 in the United Kingdom and 62 in Canada, with 580 naming no country (mostly remote roles or offices the posting does not specify). 187 postings (8.7%) at 39 employers mentioned a security clearance, 93 of them at defense and aerospace companies, and the cleared roles page separates them by the level each names. Counts for each metro area live on the city pages.

8. Stability: layoffs against regulated demand

Security has a reputation as recession-proof. The past two years test it. Beyond CrowdStrike's 5% cut in 2025, SentinelOne announced a reduction of about 8% of its full-time staff in May 2026 while concentrating investment on AI, data, cloud and endpoint - SentinelOne 8-K, May 2026, and Rapid7 approved a plan in August 2026 to reduce its workforce by about 12% - Rapid7 8-K, August 2026. Across the profession, 24% of ISC2's 2025 respondents reported layoffs at their organizations, one point fewer than the year before, and 26% expected more - ISC2 2025 study.

The distinction that matters is between the security industry and the security function. Vendor layoffs follow the economics of software companies: growth slows, investors push for margins, a product line is cut, and the people on it lose their jobs, security engineers among them. The security function inside a bank, a hospital system or a defense contractor answers to different pressures, chiefly contracts, regulators and insurers, and it is hard to cut without consequences someone signs for. On this board, about two thirds of the openings (1,411 of 2,150) were at organizations that do not sell security products or services, which is where that steadier demand lives.

Regulation is one of the clearest sources of demand that does not depend on budgets. The US Defense Department's CMMC acquisition rule took effect on 10 November 2025 - Federal Register, 10 September 2025, and the program rule starts its second phase one calendar year after the first - Federal Register, 15 October 2024, so the requirement is now phasing into defense contracts year by year. Work like that turns into GRC analysts, assessors, cleared engineers and the 215 compliance roles on this board.

Practitioners themselves are fairly confident. In ISC2's 2025 study, 87% believed there would always be a need for security professionals, 81% were confident the profession would remain strong, and 68% were satisfied in their current job - ISC2 press release. The honest version of "recession-proof" is that the field is durable and individual employers are not: choosing where you work (an organization that must be secure, rather than one that sells security in a crowded market) is as much a stability decision as choosing the field.

9. Who the work suits, and who it wears down

Pay and demand say whether the market wants you. The postings also say what the week is like, and that decides whether you will still want the job in five years.

It is often on call. 40.8% of operations postings mentioned on-call duty or 24/7 coverage, and 48.9% mentioned on-call, shifts, nights, weekends or after-hours work. Identity followed with 20.7% on-call, because a broken sign-in system stops a whole company, while engineering (12.9%), application security (10.5%) and GRC (7.4%) were mostly daytime work. The first job is usually in the specialty with the most irregular hours.

It never stops changing. ISC2 found that 48% of practitioners felt exhausted from trying to stay current and 47% felt overwhelmed by their workload - ISC2 press release. Attack techniques, cloud platforms and now AI systems change faster than any curriculum, so the job includes permanent study, much of it on your own time.

It asks for code and for prose. 52% of postings named a programming or scripting language, rising to 62.5% of senior and 69.7% of staff postings before falling to 22.8% for managers. 53.5% mentioned written communication, reports or documentation. Security work produces evidence that someone else has to act on, which rewards people who can explain a risk as clearly as they can find it.

Put together, the people who do well tend to enjoy adversarial puzzles, tolerate being interrupted, keep learning without being told to, and like explaining things to people who did not ask to hear them. The people it wears down tend to want a body of knowledge they can finish, predictable hours from the first year, or work where nobody else depends on their call at 3 a.m. Neither list is a verdict on intelligence; it is a description of the rhythm. If the rhythm of operations does not suit you, GRC and engineering offer a different one, and the career paths guide describes each branch's week.

10. The verdict by starting point

The four tests from section 1 come out differently depending on what you bring. Here is the answer for the four most common starting points, each grounded in what the postings ask of people like you.

From the help desk or a sysadmin seat

This is the strongest position for its cost. You already hold the knowledge that security postings treat as a prerequisite: how accounts, endpoints and networks behave when nothing is wrong. The BLS notes that many analysts come from an IT department, often as network and computer systems administrators - BLS, and the postings agree: 388 of them (18% of the board) asked for four years or less, and the 212 of those in operations, identity, engineering and cloud stated a middle of $158,000 across 85 ranges. Postings like Headway's, which accept years in IT or DevOps with security overlap in place of security experience, are written for you. The route is usually an internal move or a SOC or IAM seat, and the guides on becoming a SOC analyst, an IAM engineer and a security engineer map it. Verdict: yes, and sooner than you think.

Coming from software engineering

You are the candidate much of the market is short of. Security employers want people who can read and fix code: 254 open postings had software engineering titles, at a middle of $223,250 across 173 ranges, and application security stated a middle of $217,500. Many of the best-paid low-experience seats on the board were security software or product security roles asking for two years of software engineering. Because the AI security branch grows mostly out of engineering and application security, a developer who learns threat modelling and the ways models and agents fail is positioned for the fastest-growing corner of the field. Expect little or no pay cut; the application security guide covers the move. Verdict: very good, often the best-paid way in.

Fresh out of a degree

Graduates do have seats of their own, though few, and they fill early. The 87 starting-rung titles sat mostly at defense, aerospace and hardware companies, security vendors and consultancies, and many internships already named 2027 in their titles, which means programs fill a year ahead. New-graduate engineering seats paid well (SpaceX's new-graduate software security roles stated $130,000 to $175,000, Anduril Industries' 2027 new-grad information security engineer $88,000 to $117,000), but they asked for real programming ability. A graduate who can code, applies a year early, and is open to cleared work or on-site roles has a reasonable shot; one who applies only to remote analyst roles in the spring of the final year is competing for the scarcest seats on the board. The internships page shows what is open now. Verdict: workable, if you start a year before you graduate.

Starting with no technical background

Be realistic about time. Of the 1,014 roles open to US-based applicants, 62 took two years or less; 42 of those were engineering or operations seats, and half mentioned a degree. The BLS notes that some workers enter with a high school diploma plus industry training and certifications - BLS, but the postings show that the usual path runs through a technical job first. Two routes work. The first is an IT support role, which turns you into the first starting point above within a year or two. The second, for people from audit, compliance, legal, finance or risk, is GRC: 74% of its 215 postings named a framework such as SOC 2, ISO 27001, NIST or FedRAMP, work those backgrounds already touch, though 28.8% also named Python and only 14 were low-experience seats. Plan for two to three years before a security title, and read the guide to getting into cybersecurity and the GRC analyst guide for the steps. Verdict: possible and worth it for the right temperament, but not quick.

Two smaller groups deserve a line each. Veterans of cyber, signals and intelligence work who hold an active clearance start from strength: 187 postings named a clearance, 93 of them at defense and aerospace companies. And experienced professionals moving from a senior job in another field usually enter below their old title, because postings count years spent in security or right beside it; the faster route back up runs through whichever specialty uses most of what they already know, which the career paths guide lays out move by move.

11. Questions people ask before choosing security

Is cybersecurity a good career in 2026?

For most people who can reach a second job in it, yes. Postings stated a middle salary of $205,000 on 12 November, the BLS projects 21% growth for analysts from 2025 to 2035, and demand comes from regulation and adversaries rather than fashion. The weakness is the start: about one opening in ten accepted two years of experience or less, and US postings fell 26.4% in the first nine months of 2026, so the first seat takes planning.

Is cybersecurity oversaturated?

At the entry level, effectively yes; above it, no. Low-experience seats made up 9.7% of open roles (6.1% of those open to US applicants), while postings asking for experience stayed open longer and paid more with each step. The often-quoted shortage of millions is ISC2's 2024 estimate of perceived need, not a count of open jobs, and ISC2 no longer publishes it.

Is it hard to get a job in cybersecurity?

Without adjacent experience, yes. The median posting that states a requirement asks for five years, and 72.5% ask for five or more. With two years in IT, software or audit work, it is much easier, because a growing number of postings accept that experience in place of security experience. Today's junior roles are on the entry-level page.

Will AI replace cybersecurity jobs?

It is replacing tasks, mostly the routine triage of tier 1 work, rather than the jobs. 37 open postings described AI agents that triage or investigate alerts, and the humans in those teams validate the agents' work. Meanwhile 231 roles (10.7%) were about securing AI systems, at a middle of $213,600, and the BLS cites AI as one reason it expects growth. The first rung is changing shape, so newcomers need query, scripting and verification skills from the start.

What does a security job pay at each stage of experience?

On this board, postings asking for two years or less stated a middle of $145,000, rising to $175,000 for three to four years, $202,500 for five to seven and $239,400 for ten or more. Nationally, across all employers, the BLS median for security analysts was $129,180 in May 2025. The board leans toward technology employers that pay above the national figure; the salary report carries today's numbers.

Is cybersecurity a stressful job?

It can be, especially at the start. 40.8% of operations postings mention on-call or 24/7 cover, and nearly half of practitioners in ISC2's 2025 study said they felt exhausted from keeping current or overwhelmed by workload. GRC and most engineering roles keep more regular hours, so the choice of specialty changes the stress more than the choice of employer does.

Can I get into cybersecurity without a degree?

Yes, for many seats. Only 35% of postings mentioned a degree at all, and 61% of those accepted equivalent experience instead. Experience is the harder requirement to meet, which is why the routes that work start in a neighbouring IT or engineering job.

Is cybersecurity in demand?

The demand for experienced people is strong and broad: 2,150 open roles at 298 employers on this board, no employer above 5% of them, and two thirds at organizations that do not sell security. Overall postings fell in 2026, and junior postings have grown far more slowly than senior ones, so "in demand" is true of the profession and only partly true of its entry level. The board's count reads 309 operations roles and 215 GRC roles right now.

Which cybersecurity jobs hold up best against AI?

The ones built on engineering, judgment and accountability: security engineering, application and product security, identity, cloud security and the AI security roles themselves, whose postings pay among the most on the board. Work that consists mostly of closing known alert types is the most exposed. The highest paying jobs ranking shows which titles the market values most today.