Key findings

1
191 employers listed the 376 open roles in Governance, Risk & Compliance (GRC); Thales held 12 of them (3.2%) and the three largest 33 (8.8%).
Figure 1
2
184 of the 376 open roles in Governance, Risk & Compliance (GRC) (48.9%) stated pay, with a median of $168k/yr (typical pay $139k to $298k a year), 16% below the $200k/yr of all security roles.
Figure 2
3
6 of the 376 open roles in Governance, Risk & Compliance (GRC) (1.6%) accepted applicants from any country, against 3.1% of all open security roles; of the 20 countries compared, residents of the United States (212), the United Kingdom (40) and France (27) could apply to the most, and residents of Sweden to the fewest (9).
Figure 5
4
The words used most in the titles of open roles in Governance, Risk & Compliance (GRC) were Manager (95), Analyst (78) and Engineer or developer (70), of 376 open roles.
Figure 6
5
Of the 376 open roles in Governance, Risk & Compliance (GRC) with a full description, 139 (37.0%) mention a degree, 32 (8.5%) mention a security clearance and 181 (48.1%) state years of experience, a median of 5 years.
Figure 7
6
189 of the 376 described roles in Governance, Risk & Compliance (GRC) (50.3%) name a security certification; CISSP (158), CISA (Certified Information Systems Auditor, 121) and CISM (109) were named most.
Figure 8
7
Among the 20 employers with at least 3 distinct advertised salaries in Governance, Risk & Compliance (GRC), Anthropic advertised the highest median ($308k/yr) and Rocket Lab the lowest ($37.4k/yr).
Figure 1

Figure 1

Who hires for it

Which employers list security roles in Governance, Risk & Compliance (GRC), and what does each advertise?

Employer	Open roles	Share of open roles	Stating pay	Median pay a year
Thales	12	3.2%	0.0%	n/a
Anthropic	11	2.9%	100.0%	$308,000
Capco	10	2.7%	0.0%	n/a
Tevora	10	2.7%	100.0%	$56,200
Inetum	9	2.4%	0.0%	n/a
Coupang	8	2.1%	25.0%	n/a
OpenAI	7	1.9%	85.7%	$231,000
Chainguard	6	1.6%	83.3%	$120,000
Databricks	6	1.6%	83.3%	$223,000
Anduril Industries	5	1.3%	80.0%	$158,000
Kraken	5	1.3%	40.0%	n/a
Oneleet	5	1.3%	100.0%	$62,500
SpaceX	5	1.3%	100.0%	$163,000
xAI	5	1.3%	80.0%	$149,000
CrowdStrike	4	1.1%	50.0%	n/a
Delinea	4	1.1%	25.0%	n/a
Kalles Group	4	1.1%	100.0%	$148,000
Plaid	4	1.1%	100.0%	$172,000
Rhymetec	4	1.1%	0.0%	n/a
Roblox	4	1.1%	100.0%	$225,000
Scalian	4	1.1%	0.0%	n/a
Stripe	4	1.1%	0.0%	n/a
Airwallex	3	0.8%	66.7%	n/a
Apex	3	0.8%	100.0%	$180,000
Applied Intuition	3	0.8%	100.0%	$175,000
Box	3	0.8%	66.7%	n/a
Coalfire	3	0.8%	0.0%	n/a
Ebury	3	0.8%	0.0%	n/a
Fivetran	3	0.8%	100.0%	$178,000
GitLab	3	0.8%	100.0%	$203,000
Integrity360	3	0.8%	0.0%	n/a
Mozilla	3	0.8%	33.3%	n/a
Optiveum	3	0.8%	0.0%	n/a
Rocket Lab	3	0.8%	100.0%	$37,400
Rogo	3	0.8%	33.3%	n/a
Smartsheet	3	0.8%	100.0%	$169,000
Trace3	3	0.8%	100.0%	$149,000
Zscaler	3	0.8%	100.0%	$158,000
Abacus	2	0.5%	0.0%	n/a
Advens	2	0.5%	0.0%	n/a
Affirm	2	0.5%	50.0%	n/a
Anaplan	2	0.5%	50.0%	n/a
Asana	2	0.5%	0.0%	n/a
Brex	2	0.5%	50.0%	n/a
Bybit	2	0.5%	0.0%	n/a
Cape	2	0.5%	100.0%	n/a
DeepHealth	2	0.5%	0.0%	n/a
Deploy	2	0.5%	100.0%	n/a
European Dynamics	2	0.5%	0.0%	n/a
Garner Health	2	0.5%	100.0%	n/a

The other 141 rows, in the same order (every value of every row is in the report's data, sent by email):

Harness, Infosys Consulting, IONOS, Kapres Technology, Keeper Security, Legora, MongoDB, Nebius, Nscale, Nubank, Okta, OKX, Palantir, Palo Alto Networks, Plain Concepts, Ripple, Rubrik, Second Front, Semperis, SentinelOne, Sierra, Snowflake, Superhuman, Talkdesk, Thoropass, Two Six Technologies, Workstreet, 1Password, 7AI, Ada, AEG, Airbnb, Alan, Alpaca, AlphaSense, Anovia, Appian, Arancia, AvePoint, Beast Industries, BeyondTrust, Block, Bloomreach, Brain Co., Braze, Canonical, Case IQ, Cloudflare, Coalition, Cohesity, Coinbase, Colliers, Coupa, CREALOGIX, Cribl, Crusoe, Deliveroo, Discord, Elastic, emerchantpay, Emergent, Flodesk, Gainsight, Glia, Gong, Griffin, Habitat Learn, Halcyon, Higgsfield AI, Hightouch, Humanoid, ID.me, incident.io, Inductive Automation, InterSystems, Ivalua, JumpCloud, Klaviyo, knowmad mood, Kobalt.io, LaunchDarkly, Lyft, MARGO, Methods, micro1, Mistral AI, Monks, MOXFIVE, Muon Space, Netcompany, NETGEAR, Nexxa.AI, OneTrust, Orbia, Payoneer, People Data Labs, Peregrine, Perplexity, Ping Identity, Pinterest, Plata, Pliancy, Pomelo Care, Pure Storage, qlub, Qualtrics, Qualys, Ramp, Reddit, Redflags, Redgate, Reflection AI, Rescale, Riveron, SafePaaS, SailPoint, Salesloft, Secfix, Socure, Sonar, Starling Bank, Supabase, Sword Group, Synack, team.blue, Tenable, Thinking Machines Lab, Thunes, TrellisWare Technologies, Trigger.dev, UltraViolet Cyber, Upstart, Valence, Vercel, Verkada, vivenu, WHOOP, Wrike, Yopeso, Zania, zerohash

Sample. 376 roles in Governance, Risk & Compliance (GRC) open at the end of 14 Nov 2026, by the employer that lists them: HHI 99 (unconcentrated), against 60 for all security roles.

HHI: the sum of every employer's squared percentage share of the open roles, 0 to 10,000; under 1,500 is unconcentrated, 1,500 to 2,500 moderately and above 2,500 highly concentrated (US merger-guideline thresholds).

Shares are of listings, not of people hired: an employer posting one role for each city or country it hires in weighs more here than its hiring may.

A median needs at least 3 distinct advertised salaries.

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 2

What it pays

What do security roles in Governance, Risk & Compliance (GRC) advertise a year, against every security role on the board?

Roles	Median pay a year	Typical pay from	Typical pay to	Stating pay	Roles stating pay
Governance, Risk & Compliance (GRC)	$168,000	$139,000	$298,000	48.9%	184
All security roles	$200,000	$160,000	$332,000	40.7%	1,237

Sample. Roles open on 14 Nov 2026: 376 in Governance, Risk & Compliance (GRC), 184 of them stating pay; 3,041 across all security roles.

Pay is the year's pay a posting advertises (the middle of a stated range; an hourly rate counts as 2,080 hours), counted once per distinct salary as the job board counts it. The median and typical pay are the board's: typical pay is the span from the 25th percentile of range midpoints to the 90th percentile of range tops, every figure taken as a full-time year (an hourly rate times 2,080 hours), stated from 3 distinct salaries.

A role whose posting gives no salary or pay range counts as not stating pay.

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 3

How its pay is spread

How is the advertised pay of security roles in Governance, Risk & Compliance (GRC) spread across salary bands?

Advertised pay a year	Open roles	Share of roles stating pay	This band or lower	All security roles
Under $75k a year	15	8.2%	8.2%	2.3%
$75k to $100k	7	3.8%	12.0%	2.2%
$100k to $125k	9	4.9%	16.8%	4.4%
$125k to $150k	30	16.3%	33.2%	10.4%
$150k to $175k	45	24.5%	57.6%	14.0%
$175k to $200k	18	9.8%	67.4%	16.3%
$200k to $250k	38	20.7%	88.0%	28.9%
$250k to $300k	12	6.5%	94.6%	13.0%
$300k a year or more	10	5.4%	100.0%	8.5%

Sample. 184 roles in Governance, Risk & Compliance (GRC) open on 14 Nov 2026 that state pay, against 1,237 across all security roles.

Each role counts once, at the middle of its advertised range, on the board's one scale (a year's pay; an hourly rate counts as a full-time year). The bands are those of the salary-transparency report.

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 4

Who may apply: location rules

Can people apply to security roles in Governance, Risk & Compliance (GRC) from anywhere, or are they based in some countries?

Location rule	Open roles	Share of its open roles	All security roles
Open to applicants anywhere	6	1.6%	3.1%
Anywhere except listed countries	1	0.3%	0.2%
Based in or limited to listed countries	369	98.1%	96.7%
No location rule stated	0	0.0%	0.0%

Sample. 376 roles in Governance, Risk & Compliance (GRC) open at the end of 14 Nov 2026, against 3,041 across all security roles.

The rule is read from each posting's location text, then, where that names no country, from what the posting's own description states, and where both are silent from what the employer states about where it hires.

Most security roles are based in one country, on site, hybrid or remote within it, and count as limited to that country; a role open to applicants anywhere is remote from any country.

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 5

Who may apply: roles open to each country

How many roles in Governance, Risk & Compliance (GRC) can a resident of each country apply to?

Country	Open roles	Share of its open roles	Median pay a year
Any country (roles open to applicants anywhere)	6	1.6%	$125,000
United States	212	56.4%	$169,000
United Kingdom	40	10.6%	$120,000
France	27	7.2%	$120,000
Spain	25	6.6%	$120,000
Canada	24	6.4%	$139,000
Mexico	22	5.9%	$100,000
India	21	5.6%	$120,000
Germany	17	4.5%	$120,000
Poland	17	4.5%	$120,000
Portugal	15	4.0%	$120,000
Belgium	13	3.5%	$120,000
Ireland	13	3.5%	$120,000
Czechia	12	3.2%	$120,000
Greece	12	3.2%	$120,000
Netherlands	12	3.2%	$120,000
Romania	12	3.2%	$120,000
Israel	11	2.9%	$120,000
Italy	10	2.7%	$120,000
Slovakia	10	2.7%	$120,000
Sweden	9	2.4%	$120,000

Sample. 376 roles in Governance, Risk & Compliance (GRC) open at the end of 14 Nov 2026, for residents of a fixed set of 20 countries.

A country's count is the roles open to applicants anywhere (including roles that state no rule, as on the job board), plus roles whose list names it, plus roles whose exclusion list does not.

The 20 countries are the same in every report of this series: those named most often by the location rules of open security roles on 14 Nov 2026, as the countries a role is based in or limited to or as excluded.

Median pay is over the roles open to that country that state pay (at least 3 distinct advertised salaries).

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 6

What the roles are called

Which words do the titles of security roles in Governance, Risk & Compliance (GRC) use most?

Title word	Open roles	Share of its open roles	Median pay a year	Employers
Manager	95	25.3%	$212,000	64
Analyst	78	20.7%	$150,000	55
Engineer or developer	70	18.6%	$173,000	49
Specialist	28	7.4%	$144,000	24
Consultant or advisor	27	7.2%	$160,000	14
Lead	23	6.1%	$198,000	22
Officer	15	4.0%	$148,000	12
Auditor or assessor	4	1.1%	n/a	4
Expert or SME	4	1.1%	n/a	4
Architect	3	0.8%	n/a	3
Director, head or VP	3	0.8%	n/a	3
Administrator	2	0.5%	n/a	2
Penetration tester or red teamer	2	0.5%	n/a	2
CISO or chief security officer	1	0.3%	n/a	1

Sample. 339 of the 376 roles in Governance, Risk & Compliance (GRC) open on 14 Nov 2026 use one of these words in their title (90.2%); 14 title words are used.

A title can use several of these words and counts for each. The vocabulary is the job-titles report's.

Median pay needs at least 3 distinct advertised salaries.

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 7

What the descriptions ask for

Do security roles in Governance, Risk & Compliance (GRC) ask for a degree, a certification, a clearance, years of experience or a test?

Requirement	Roles	Share of described roles	All described roles
Mentions a PhD	6	1.6%	2.6%
Mentions a PhD or master's	27	7.2%	9.6%
Mentions any degree	139	37.0%	31.8%
Names a security certification	189	50.3%	30.0%
Mentions a security clearance	32	8.5%	6.0%
States years of experience	181	48.1%	52.3%
Asks for 5 years or more	124	33.0%	36.3%
States weekly hours	3	0.8%	0.8%
Mentions a technical assessment or test	4	1.1%	1.9%
Mentions a background check	21	5.6%	6.1%

Sample. 376 roles in Governance, Risk & Compliance (GRC) open on 14 Nov 2026 whose job board publishes a full description (at 191 employers), 100.0% of its open roles; 3,037 described roles across all security roles.

A mention can be a requirement or a preference ('a CISSP is a plus'): the figure counts both. The patterns are those of the requirements report, and a certification is one of the one list the certification pages count.

Only roles whose job board publishes a full description are read, so this figure describes those roles.

A specialty's figure is shown when its described roles outweigh the average of the specialties (93.3 described roles: the weight of every specialty's shares around the shares of all described roles, fitted on their own counts).

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

Figure 8

Certifications the postings name

Which security certifications do the postings for roles in Governance, Risk & Compliance (GRC) name?

Certification	Roles naming it	Share of described roles	All described roles
CISSP	158	42.0%	18.8%
CISA (Certified Information Systems Auditor)	121	32.2%	5.8%
CISM	109	29.0%	8.3%
CRISC	68	18.1%	3.0%
ISO 27001 Lead Auditor or Lead Implementer	49	13.0%	1.9%
CompTIA Security+	37	9.8%	4.9%
CIPP (privacy)	23	6.1%	0.9%
CCSP	18	4.8%	4.1%
GIAC certifications (GSEC, GCIH, GPEN and others)	14	3.7%	10.9%
PCI QSA or ISA	10	2.7%	0.4%
CEH (Certified Ethical Hacker)	7	1.9%	3.3%
CGRC (formerly CAP)	7	1.9%	0.3%
SSCP	5	1.3%	0.5%
CompTIA SecurityX (CASP+)	4	1.1%	0.4%
Cisco CCNA or CCNP	4	1.1%	1.6%
CompTIA CySA+	4	1.1%	1.4%
OSCP	4	1.1%	6.9%
AWS certifications	3	0.8%	3.3%
CCSK	3	0.8%	0.3%
CompTIA Network+	1	0.3%	0.3%

Sample. 189 of the 376 roles in Governance, Risk & Compliance (GRC) open on 14 Nov 2026 with a full description name at least one security certification (50.3%); 20 certifications are named.

A certification counts where the description names it, required or preferred alike, by the rules of the certification pages (lib/certifications.ts): CISA, also a US government agency, counts only beside another certification's name. A description naming several counts for each.

A specialty's figure is shown when its described roles outweigh the average of the specialties (20.3 described roles: the weight of every specialty's shares of each certification, fitted on their own counts).

Source. CyberJobs.cc Research, The Governance, Risk & Compliance (GRC) Job Market, live data.

For employers, recruiters and researchers

Buy the data behind this report

The figures above are a summary. Behind them are records we collect ourselves, every day:

3,462 roles tracked, each with its history
Every role on 696 job boards, read since 11 Nov 2026 (every hour since 11 Nov 2026): its pay and place, and the first and last day it was open.
3,347 apply clicks in 4 days
Which security roles people actually apply to, by specialty, pay and where the role is open. It happens on this site, so nobody else can count it.
fit checks of members against open roles
How the people looking for security jobs here measure up against real postings, and what they lack when they fall short: years, a tool, a certification, a clearance.

What you can buy

The records
The rows behind any figure, with their history, not only the totals.
A regular feed
The same figures every week or month, as files.
A custom cut or benchmark
Your countries, specialties or certifications, or your own company against the market.

Hiring for security and want to reach the people behind this data? (you make the hire).

Method and definitions

The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. Apply clicks are made on CyberJobs.cc; full descriptions come from the employers whose boards publish them. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.

Specialty: Each role is classified from its title and description into one of the 10 security specialties this site tracks (Security Operations & Incident Response, Security Engineering, Cloud Security, Application & Product Security, Identity & Access Management, Penetration Testing & Red Team, Threat Intelligence & Security Research, Governance, Risk & Compliance (GRC), Security Architecture & Consulting, Security Leadership). Every specialty links to its own page.
Open role: A role listed by a given day and still on its employer's board that day.
New listing: A role that first appeared during the window on an employer already tracked before that week. An employer's first week in this dataset is its back catalogue (the roles it already had up) and is not counted as new. When this site changes how it reads an employer's board (a page or department read too, a relevance rule changed), the roles that came into view or left it from that change to the end of its week are this site's reading, not the employer's hiring: they are not new listings or removals, and changes in open roles are measured like for like across it. Each employer's report says what changed.
Removed listing: A role that left its employer's board during the window, other than with a change in how this site reads the board (see New listing).
HHI: Herfindahl-Hirschman Index: the sum of every employer's squared percentage share of open roles, 0 to 10,000. Under 1,500 unconcentrated, 1,500 to 2,500 moderately, above 2,500 highly concentrated.
Advertised pay: The pay a posting publishes, on one scale: a year's pay in US dollars (the middle of a stated range; an hourly rate counts as 2,080 hours, a monthly one as 12 months). Pay in another currency is kept in that currency and left out of these medians. Counted once per distinct figure, as the job board counts it. Typical pay is the span from the 25th percentile of range midpoints to the 90th percentile of range tops, every figure taken as a full-time year (an hourly rate times 2,080 hours), stated from 3 distinct figures.
Clicks per open role a week: Apply clicks on CyberJobs.cc on a specific role, divided by the days the roles were open, times 7.
Demand index: Clicks per open role a week divided by the same rate across every role on the site. Above 1, the roles draw more applicants than the average role.
Where it is open: Read from each posting's location text and, where that names no country, from what the posting's own description states: open to applicants anywhere (remote worldwide), worldwide except listed countries, only listed countries (the country or countries the role is based in or hires from), or no rule stated.
Window: Live: the last 28 complete days, in UTC, and the last twelve complete ISO weeks (from the week of 11 Nov 2026 at the earliest) for the weekly series. Edition: one calendar month, in UTC, and its weeks.

What this data cannot tell you

Employers that hire without a public job board, or post only on LinkedIn or through recruiters, are not counted; government agencies and most staffing firms are not read.
A listing is not a hire. Some employers keep a role open for months, and some post one listing per city or country.
Apply clicks measure interest among the people who use this site, and what is shown first gets clicked more. Clicks are never published by employer.
Since 14 Nov 2026 an employer's own application opens from this site only where the employer pays this site for it, so apply clicks per open role are left out of any window that reaches that day: they would measure where the site sends people. The searches for the specialty are in What People Search For in Cybersecurity Jobs.
The weekly series and the new and removed listings appear once the board has six weeks of its own history (from 28 Dec 2026): in its first weeks the removals include roles this site's own relevance rules took off the board, and the first week is every employer's back catalogue.
A specialty with few open roles gives figures that move with a handful of postings: rows on too little data are marked as a small sample.

How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.

Editions

The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.

Live data (this page)Last 28 complete days, recomputed daily

Cite and reuse

Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.

Citation

CyberJobs.cc (2026). The Governance, Risk & Compliance (GRC) Job Market (live data, 11 Nov 2026 to 14 Nov 2026). https://cyberjobs.cc/research/governance-risk-compliance-job-market (accessed 15 Nov 2026)

BibTeX

@misc{cyberjobscc_governance_risk_compliance_job_market_live,
  author = {{CyberJobs.cc}},
  title = {The Governance, Risk & Compliance (GRC) Job Market (live data, 11 Nov 2026 to 14 Nov 2026)},
  year = {2026},
  howpublished = {\url{https://cyberjobs.cc/research/governance-risk-compliance-job-market}},
  note = {Accessed 15 Nov 2026},
}

Data: every figure as CSV (one line per value) and JSON, sent to your work email.Pay and open-roles data

More research

The same figures for every other security specialty:

All 50 research reports