Key findings
- 3
Members most often strongly fit Governance, Risk & Compliance (GRC) roles (22% of checks) and least often Threat Intelligence & Security Research roles (1%).
- 4
When a member is an unlikely fit, the role most often asks for hands-on work in a security specialty (91%), years or seniority of experience (54%) and a named tool, platform, framework or language (36%) that their background does not show.
- 5
2% of checks name a spoken language the member does not show; Ukrainian (35% of those), Portuguese (29%) and German (9%) are named most.
- 6
35% of checks name a tool or certification the member does not show; AWS (27.4% of those), SIEM (18.1%) and Kubernetes (15.9%) are named most.
Figure 1
How often members qualify
When a member is checked against a security role that suits them, how often do they qualify?
| Verdict | Checks | Share of checks |
|---|---|---|
| Strong fit | 3,092 | 7.6% |
| Possible fit | 16,718 | 41.3% |
| Unlikely fit | 20,646 | 51.0% |
Sample. 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, of 2,162 members against 1,806 roles.
A check is one member and one role, judged from the member's profile (their work, never their name or contact details) and the role's own posting: strong, possible or unlikely, with what fits and what is missing. Where a role is closed to the member's country, the verdict is unlikely, decided by the role's own rule.
Checks are made when a member opens a role and asks about it, or asks for their plan, and ahead, for the roles the site lists for the member; so these are roles chosen for each member, not every role.
Members whose best it is: each member counts once, at the best verdict among their checks in the window.
No count below 3 people is shown, nor any share that would reveal one, so no figure can point at a person; a group too small to show on its own is counted in "Other".
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 2
When members ask, and when the site checks ahead
Do members who ask about a role themselves qualify more or less often than for the roles the site picks for them?
| How the check was made | Strong | Possible | Unlikely |
|---|---|---|---|
| The member asked about the role | 9.0% | 40.6% | 50.4% |
| Made ahead for the member's list | 7.2% | 41.5% | 51.2% |
Sample. 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026.
A member asks about a role from its page on the site; the site checks ahead the roles it lists for the member (their matches and their plan).
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 3
How often members qualify, by specialty
For which security specialties do the people looking for security jobs most and least often qualify?
| Specialty | Strong | Unlikely |
|---|---|---|
| Governance, Risk & Compliance (GRC) | 21.6% | 20.2% |
| Security Operations & Incident Response | 15.0% | 46.1% |
| Security Leadership | 6.9% | 61.7% |
| Application & Product Security | 6.6% | 52.3% |
| Penetration Testing & Red Team | 6.5% | 61.4% |
| Identity & Access Management | 5.6% | 53.3% |
| Cloud Security | 3.8% | 43.5% |
| Security Engineering | 3.7% | 54.0% |
| Security Architecture & Consulting | 2.9% | 54.0% |
| Threat Intelligence & Security Research | 0.9% | 74.7% |
Sample. 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, by the specialty of the role.
Each role is classified into one of the ten security specialties the site tracks, from its title.
Rows with fewer than 21 checks are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own checks (the weight fitted on the rows' own counts).
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 4
How often members qualify, by the credential they hold
Do people with a professional certification, a doctorate or a master's qualify more often for security roles?
| Highest credential | With a strong fit | Strong share of checks |
|---|---|---|
| Professional certificationSmall sample | 42.9% | 6.9% |
| Doctorate (PhD)Small sample | 57.1% | 10.2% |
| Master's degree | 61.3% | 10.2% |
| None of these | 53.5% | 6.9% |
| Not known | 44.4% | 5.7% |
Sample. The 2,162 members with a fit check made 11 Nov 2026 to 14 Nov 2026.
With a strong fit: the share of the group's members with at least one strong verdict among their checks in the window.
Each member counts once, at the highest they hold: a professional certification (a security certification such as CISSP, OSCP or GIAC, or a professional licence), then a doctorate, then a master's degree. A credential is what the member stated on the site, else what they gave the candidate pool, else what their profile shows.
Rows with fewer than 130 members are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own members (the weight fitted on the rows' own counts).
No count below 3 people is shown, nor any share that would reveal one, so no figure can point at a person; a group too small to show on its own is counted in "Other".
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 5
What members most often lack
When a member falls short of a security role, what does the role ask for that their background does not show?
| The role asks for | Share of checks | Of unlikely fits | Of possible fits |
|---|---|---|---|
| Hands-on work in a security specialty | 81% | 91% | 80% |
| Something else the role asks for | 45% | 40% | 53% |
| Years or seniority of experience | 42% | 54% | 34% |
| A named tool, platform, framework or language | 37% | 36% | 42% |
| Securing AI systems (LLMs, prompt injection, adversarial machine learning) | 9% | 9% | 9% |
| A certification | 4% | 4% | 4% |
| Where they live, may work or when they can work | 4% | 6% | 3% |
| A spoken language, or a level of it | 3% | 5% | 1% |
| A degree | 2% | 2% | 1% |
| A security clearance | 1% | 2% | 1% |
Sample. A simple random sample of 38,415 of the 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, with the gaps the judge wrote; a share of all checks is within 0.1 points of the whole window's, 19 times in 20.
Each check's gaps are the judge's own lines on what the role asks for and the member's background does not show. A check counts once for each kind its gaps name; a check with no gap counts for none, so the kinds do not add up to 100%.
A gap is read with the requirement report's own patterns (degrees, certifications, security clearance, years, tools), the site's vocabulary of security work (the words that make a job title a security role), the list of spoken languages, the programming languages and tools of the programming-languages report, and the phrasings only a gap uses: securing AI systems, a span or rank of experience, and where or when a member can work.
Hands-on work in a security specialty counts a gap naming security work by those words ('incident response', 'penetration testing', 'threat hunting', 'security engineering'); a gap naming such work without them ('audit evidence work', 'firewall monitoring') counts as something else unless it names a tool.
Patterns: securing AI systems \b(llms?|large language models?|prompt injection|jailbreak\w*|adversarial (?:ml|machine learning|ai)|machine learning|ml (?:security|models?|systems?)|ai (?:security|safety|red[- ]team\w*|systems?|models?|agents?|evaluation)|genai|generative ai|agentic|rlhf)\b; experience (\b\d{1,2}\s*\+?\s*(?:[-–]\s*\d{1,2}\s*)?(?:years?|yrs?)\b|\b(?:one|two|three|four|five|six|seven|eight|nine|ten)(?:[- ]plus)?\s+(?:or more\s+)?years?\b|\b(?:senior|seniority|mid[- ]?senior|mid[- ]level|staff[- ]level|principal[- ]level|track record|proven|professional experience|years of)\b); where and when \b(not open in|open only|only open|based in|us[- ]based|resid\w*|located|location|time ?zones?|availability|available|full[- ]time|part[- ]time|hours? (?:a|per) week|on[- ]?site|in[- ]person|work authori[sz]ation|right to work|visa|sponsorship|citizen\w*|us[- ]specific|country|countries)\b.
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 6
What members lack, by specialty
In which security specialties do roles most often ask for specialty work, experience, a tool, a certification or a clearance the applicant does not show?
| Specialty | Specialty work | Experience | Tool or skill | Certification | Clearance | Degree | AI security | Language | Place or hours |
|---|---|---|---|---|---|---|---|---|---|
| Security Engineering | 81% | 40% | 47% | 1% | 2% | 2% | 8% | 5% | 5% |
| Application & Product Security | 87% | 55% | 27% | 10% | 1% | 1% | 8% | 3% | 4% |
| Security Operations & Incident Response | 77% | 46% | 47% | 1% | 1% | 1% | 1% | 4% | 3% |
| Governance, Risk & Compliance (GRC) | 57% | 26% | 47% | 6% | 1% | 0% | 1% | 3% | 7% |
| Penetration Testing & Red Team | 91% | 56% | 24% | 2% | 1% | 2% | 48% | 0% | 1% |
| Threat Intelligence & Security Research | 98% | 11% | 2% | 0% | 1% | 2% | 5% | 1% | 1% |
| Cloud Security | 81% | 37% | 80% | 1% | 1% | 3% | 2% | 2% | 6% |
| Security Leadership | 82% | 38% | 30% | 3% | 1% | 3% | 1% | 1% | 4% |
| Identity & Access Management | 69% | 39% | 18% | 7% | 1% | 3% | 1% | 2% | 7% |
| Security Architecture & Consulting | 76% | 46% | 26% | 2% | 1% | 1% | 7% | 2% | 4% |
Sample. A simple random sample of 38,415 of the 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, with the gaps the judge wrote; a share of all checks is within 0.1 points of the whole window's, 19 times in 20.
Shares of each specialty's own sampled checks.
Rows with fewer than 11.5 sampled checks are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own sampled checks (the weight fitted on the rows' own counts).
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 7
The spoken languages members most often lack
Which spoken languages do security roles ask for that the people applying do not show?
| Language | Of checks missing a language | Of all checks |
|---|---|---|
| Ukrainian | 34.9% | 0.60% |
| Portuguese | 29.0% | 0.50% |
| German | 9.1% | 0.16% |
| English | 7.9% | 0.14% |
| French | 6.5% | 0.11% |
| Japanese | 3.6% | 0.06% |
| Spanish | 2.7% | 0.05% |
| Korean | 2.3% | 0.04% |
| Chinese (Mandarin) | 2.1% | 0.04% |
| Polish | 1.7% | 0.03% |
| Russian | 1.4% | 0.02% |
| ArabicSmall sample | 0.5% | 0.01% |
| BurmeseSmall sample | 0.5% | 0.01% |
| TurkishSmall sample | 0.5% | 0.01% |
| DutchSmall sample | 0.3% | 0.01% |
| GreekSmall sample | 0.3% | 0.01% |
| DanishSmall sample | 0.2% | 0.00% |
| MalaySmall sample | 0.2% | 0.00% |
| UrduSmall sample | 0.2% | 0.00% |
Sample. A simple random sample of 38,415 of the 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, with the gaps the judge wrote; a share of all checks is within 0.1 points of the whole window's, 19 times in 20. 659 of the sampled checks name a language in a gap.
A gap names a language by its name ('Asks for fluent German'), where a role's team or customers work in it. A language is counted per check, not per role, so a few roles checked for many members can lead the list. Where a role needs a language the member shows no sign of speaking, the judge's verdict is unlikely, whatever the rest of their background.
Rows with fewer than 8.3 sampled checks are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own sampled checks (the weight fitted on the rows' own counts).
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
Figure 8
The tools and certifications members most often lack
Which tools, clouds, frameworks and certifications do security roles ask for that the people applying do not show?
| Tool or certification | Of checks missing one by name | Of all checks |
|---|---|---|
| AWS | 27.4% | 9.6% |
| SIEM | 18.1% | 6.4% |
| Kubernetes | 15.9% | 5.6% |
| SOC 2 | 12.6% | 4.4% |
| Google Cloud | 11.0% | 3.9% |
| ISO 27001 | 6.9% | 2.4% |
| Go | 6.8% | 2.4% |
| OffSec advanced (OSEP, OSWE, OSED, OSCE3) | 6.3% | 2.2% |
| Python | 5.8% | 2.0% |
| Vulnerability management | 5.3% | 1.9% |
| Linux | 4.5% | 1.6% |
| Zero trust | 4.2% | 1.5% |
| Microsoft Azure | 3.9% | 1.4% |
| Rust | 3.8% | 1.3% |
| Terraform | 3.8% | 1.3% |
| NIST frameworks | 2.5% | 0.9% |
| DevSecOps | 2.0% | 0.7% |
| Splunk | 1.5% | 0.5% |
| PCI DSS | 1.5% | 0.5% |
| CompTIA Security+ | 1.4% | 0.5% |
| HIPAA | 1.2% | 0.4% |
| Active Directory and Entra ID | 1.1% | 0.4% |
| GDPR | 1.1% | 0.4% |
| CGRC (formerly CAP) | 1.1% | 0.4% |
| MITRE ATT&CK | 1.0% | 0.4% |
| FedRAMP | 0.8% | 0.3% |
| SQL | 0.7% | 0.2% |
| Burp Suite | 0.3% | 0.1% |
| OSCP | 0.3% | 0.1% |
| Microsoft Sentinel | 0.3% | 0.1% |
| PowerShell | 0.2% | 0.1% |
| Microsoft security certifications (AZ-500, SC-200, SC-100, SC-300) | 0.1% | 0.0% |
| GIAC certifications (GSEC, GCIH, GPEN and others) | 0.1% | 0.0% |
| CompTIA CySA+ | 0.1% | 0.0% |
| CEH (Certified Ethical Hacker) | 0.1% | 0.0% |
| CISSP | 0.1% | 0.0% |
| CISA (Certified Information Systems Auditor)Small sample | 0.0% | 0.0% |
| CISMSmall sample | 0.0% | 0.0% |
| AWS certificationsSmall sample | 0.0% | 0.0% |
| ISO 27001 Lead Auditor or Lead ImplementerSmall sample | 0.0% | 0.0% |
| CCSPSmall sample | 0.0% | 0.0% |
| CRISCSmall sample | 0.0% | 0.0% |
| CRTOSmall sample | 0.0% | 0.0% |
| eJPT and eCPPTSmall sample | 0.0% | 0.0% |
| Google Cloud Professional Cloud Security EngineerSmall sample | 0.0% | 0.0% |
| PCI QSA or ISASmall sample | 0.0% | 0.0% |
| PNPTSmall sample | 0.0% | 0.0% |
Sample. A simple random sample of 38,415 of the 40,456 members' fit checks made 11 Nov 2026 to 14 Nov 2026, with the gaps the judge wrote; a share of all checks is within 0.1 points of the whole window's, 19 times in 20. 13,483 of the sampled checks name a tool or a certification of the lists in a gap.
The tools are the list the site's skill pages count and the certifications the list its certification pages count, each read by the words a gap writes it with. A check counts once for each one its gaps name.
Rows with fewer than 10.5 sampled checks are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own sampled checks (the weight fitted on the rows' own counts).
Source. CyberJobs.cc Research, Do Applicants Qualify for Cybersecurity Jobs?, live data.
For employers, recruiters and researchers
Buy the data behind this report
The figures above are a summary. Behind them are records we collect ourselves, every day:
3,462 roles tracked, each with its history
Every role on 696 job boards, read since 11 Nov 2026 (every hour since 11 Nov 2026): its pay and place, and the first and last day it was open.
3,347 apply clicks in 4 days
Which security roles people actually apply to, by specialty, pay and where the role is open. It happens on this site, so nobody else can count it.
fit checks of members against open roles
How the people looking for security jobs here measure up against real postings, and what they lack when they fall short: years, a tool, a certification, a clearance.
What you can buy
The records
The rows behind any figure, with their history, not only the totals.
A regular feed
The same figures every week or month, as files.
A custom cut or benchmark
Your countries, specialties or certifications, or your own company against the market.
Hiring for security and want to reach the people behind this data? (you make the hire).
Method and definitions
The fit checks CyberJobs.cc runs between members' profiles and open roles, aggregated with a privacy floor. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.
- Fit check
- The site's reading of a member's profile against one posting: strong fit, possible fit or unlikely, with the gaps it found.
- Specialty
- Each role is classified from its title and description into one of the 10 security specialties this site tracks (Security Operations & Incident Response, Security Engineering, Cloud Security, Application & Product Security, Identity & Access Management, Penetration Testing & Red Team, Threat Intelligence & Security Research, Governance, Risk & Compliance (GRC), Security Architecture & Consulting, Security Leadership). Every specialty links to its own page.
- Window
- Live: the last 28 complete days, in UTC. Edition: one calendar month, in UTC.
What this data cannot tell you
- Members are the people who made a profile on CyberJobs.cc; they are not a sample of every security job seeker, and the countries they come from follow where the site was found first.
- Profiles say what a person chose to write; a fit check reads that profile against the posting, never a CV it was not given.
- A check reads the posting's words: a posting that overstates its requirements makes fewer people fit it than an employer would hire.
How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.
Editions
The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.
- Live data (this page)Last 28 complete days, recomputed daily
Cite and reuse
Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.
Citation
CyberJobs.cc (2026). Do Applicants Qualify for Cybersecurity Jobs? (live data, 11 Nov 2026 to 14 Nov 2026). https://cyberjobs.cc/research/do-applicants-qualify-for-cybersecurity-jobs (accessed 15 Nov 2026)
BibTeX
@misc{cyberjobscc_do_applicants_qualify_for_cybersecurity_jobs_live,
author = {{CyberJobs.cc}},
title = {Do Applicants Qualify for Cybersecurity Jobs? (live data, 11 Nov 2026 to 14 Nov 2026)},
year = {2026},
howpublished = {\url{https://cyberjobs.cc/research/do-applicants-qualify-for-cybersecurity-jobs}},
note = {Accessed 15 Nov 2026},
}More research
- How Cybersecurity Job Applications WorkWhat do security employers' application forms ask for: a CV, a cover letter, work authorization, sponsorship, a clearance, links?Read the report
- Entry-Level Cybersecurity Jobs by the NumbersHow many open security roles are open to people early in their career, in which specialties, and what do they pay?Read the report
- Cybersecurity Talent: Supply and DemandHow many people are looking for each open security role, in which specialties are qualified people scarce, and in which countries?Read the report
- Who Looks for Cybersecurity JobsWho are the people looking for security jobs on this site: where they are, which specialties they look at, and what they hold?Read the report
- What People Search For in Cybersecurity JobsWhich security specialties do people search for most against how many roles are open, and what pay do they ask for?Read the report
- Cybersecurity Employers ComparedWhich employers list the most security roles, what do they pay, who may apply to them and what do they hire for?Read the report
- The Cybersecurity Salary ReportWhat do security roles pay, by specialty and by employer?Read the report