Cloudflare Security Hiring Data

Method and definitions

The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. Cloudflare's figures come from its own public job board only; full descriptions and application forms are read where its board publishes them. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.

Other employers

Every employer this site reads other than Cloudflare, over the same window and pooled: counts are summed and medians are taken over all their figures together. Cloudflare is compared with the rest of the market, not with a market that includes it.

Rank

Its place among the employers with open roles on the last day of the window, highest first (longest first for days listed). A share is ranked where the employer's open roles read on their own among the employers (they reach the weight of the employers' average share, fitted on their own counts), a pay median from 3 distinct advertised figures and days listed from 3 removed roles, so an employer below one is not ranked on that measure.

Open role

A role listed by a given day and still on its employer's board that day. Week by week, open roles are counted at the end of each week (Sunday, UTC).

Back catalogue

The roles already listed in the week an employer was first tracked. That week is marked in the weekly series and its roles are not counted as new listings; weeks before it are left out.

New listing

A role that first appeared during the window on an employer already tracked before that week. An employer's first week in this dataset is its back catalogue (the roles it already had up) and is not counted as new. When this site changes how it reads an employer's board (a page or department read too, a relevance rule changed), the roles that came into view or left it from that change to the end of its week are this site's reading, not the employer's hiring: they are not new listings or removals, and changes in open roles are measured like for like across it. Each employer's report says what changed.

Removed listing

A role that left its employer's board during the window, other than with a change in how this site reads the board (see New listing).

Change in our reading

When this site changes how it reads an employer's board (a page or department read too, a relevance rule changed), the roles that came into view or left it from that change to the end of its week are this site's reading, not the employer's hiring: they are not new listings or removals, and changes in open roles are measured like for like across it. Each employer's report says what changed. This site has read Cloudflare's board the same way since it was first read.

Days listed

From a removed role's listing date to the last day it was seen on its board. A median needs at least 3 removed roles with a known listing date.

Advertised pay

The pay a posting publishes, on one scale: a year's pay in US dollars (the middle of a stated range; an hourly rate counts as 2,080 hours, a monthly one as 12 months). Pay in another currency is kept in that currency and left out of these medians. Counted once per distinct figure, as the job board counts it. Typical pay is the span from the 25th percentile of range midpoints to the 90th percentile of range tops, every figure taken as a full-time year (an hourly rate times 2,080 hours), stated from 3 distinct figures.

Compared within the same specialties

For each specialty where both Cloudflare and the other employers publish at least 3 distinct figures, its median over theirs, minus one; averaged across those specialties, weighted by its distinct figures, so an employer hiring for better-paid specialties is not read as paying more for the same work. It needs two such specialties.

Where it is open

Read from each posting's location text and, where that names no country, from what the posting's own description states: open to applicants anywhere (remote worldwide), worldwide except listed countries, only listed countries (the country or countries the role is based in or hires from), or no rule stated.

Specialty

Each role is classified from its title and description into one of the 10 security specialties this site tracks (Security Operations & Incident Response, Security Engineering, Cloud Security, Application & Product Security, Identity & Access Management, Penetration Testing & Red Team, Threat Intelligence & Security Research, Governance, Risk & Compliance (GRC), Security Architecture & Consulting, Security Leadership). Every specialty links to its own page.

Mention

A description mentions a degree, certification, clearance or tool when it contains one of the patterns published in the requirements report. A mention may be a requirement or a preference.

Application form

The fields an applicant fills in on the employer's own application page, read from its applicant-tracking system. Required: the form will not submit without the field.

Window

Live: the last 28 complete days, in UTC, with the weekly series over the last twelve complete ISO weeks from the week of 11 Nov 2026 at the earliest. Edition: one calendar month, in UTC, its weeks cut at the month's edges.

What this data cannot tell you

• An employer may fill roles it never lists publicly (through recruiters, referrals or LinkedIn only): its listings are what it advertises, not everything it hires for.
• A listing is not a hire. Some employers keep a role open for months, and some post one listing per city or country.
• Listings only: how many people apply to an employer is never published here.
• Pay is what postings advertise, not what anyone is paid after bonuses, equity or the level an offer lands on.
• Full descriptions and application forms are published by some job boards only, so those figures appear only for the employers whose boards publish them, and describe the roles open on the day they were read.
• A removed listing may have been filled, paused or closed: employers do not say which.
• The weekly series, pay week by week, new and removed listings and days listed appear once the board has six weeks of its own history (from 28 Dec 2026): in its first weeks the removals include roles this site's own relevance rules took off the board, and the first week is every employer's back catalogue.

How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.

Editions

The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.

• Live data (this page)Last 28 complete days, recomputed daily

Cite and reuse

Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.

@misc{cyberjobscc_cloudflare_hiring_data_live,
  author = {{CyberJobs.cc}},
  title = {Cloudflare Security Hiring Data (live data, 11 Nov 2026 to 14 Nov 2026)},
  year = {2026},
  howpublished = {\url{https://cyberjobs.cc/research/cloudflare-hiring-data}},
  note = {Accessed 15 Nov 2026},
}

More research

The same figures for every other large employer:

• Palo Alto Networks hiring data
• Thales hiring data
• SpaceX hiring data
• Inetum hiring data
• CrowdStrike hiring data
• Coupang hiring data
• GuidePoint Security hiring data
• Anthropic hiring data
• OpenAI hiring data
• Capco hiring data
• Zscaler hiring data
• Anduril Industries hiring data
• Arctic Wolf hiring data
• SentinelOne hiring data
• Databricks hiring data
• Okta hiring data
• Sophos hiring data
• AHEAD hiring data
• Elastic hiring data
• Check Point hiring data
• Nebius hiring data

• Cybersecurity Employers ComparedWhich employers list the most security roles, what do they pay, who may apply to them and what do they hire for?Read the report
• How Concentrated Cybersecurity Hiring IsIs security hiring spread across many employers or held by a few, overall and within each specialty?Read the report
• When Cybersecurity Jobs Are PostedOn which days and at what hours do employers post security roles, and how soon after posting does this site read them?Read the report
• Cybersecurity Salary TransparencyHow many security job postings publish pay, which specialties and employers publish it most, and how is advertised pay spread?Read the report
• What Raises Cybersecurity PayWithin the same specialty, how much more do roles with a senior title, a named certification, a clearance or remote work advertise?Read the report
• How Cybersecurity Jobs Are PaidDo security postings quote a salary or an hourly rate, in which currency, as a range or a single figure, on what contract, with what bonus?Read the report
• The Cybersecurity Salary ReportWhat do security roles pay, by specialty and by employer?Read the report

All 50 research reports