Key findings
- 1
87.8% of security job application forms require a resume and 85.7% ask for a LinkedIn profile; 61% leave room for a cover letter, and 0.5% require one.
- 2
The screening questions asked most often concern work authorization or visa sponsorship (71.5% of forms), a past job or interview at the employer, or a conflict of interest (28.8% of forms) and relocation or working from an office (25.2% of forms).
- 3
A typical form has 15 fields; 44.6% of forms have 16 or more.
- 4
TRM Labs has the longest forms (a median of 38 fields) and LiteLLM the shortest (3).
- 5
Greenhouse runs 60.7% of the application forms read, for 292 employers.
Figure 1
What applications ask for
Which documents and profiles do security job applications ask for, and which do they require?
| Item | Forms asking | Forms requiring it |
|---|---|---|
| Resume or CV | 99.9% | 87.8% |
| Phone number | 92.5% | 76.0% |
| LinkedIn profile | 85.7% | 26.6% |
| Location or country | 84.0% | 77.3% |
| Cover letter | 61.0% | 0.5% |
| Portfolio or website | 37.6% | 0.2% |
| GitHub profile | 16.9% | 1.4% |
| Current employer | 15.1% | 5.8% |
| Other file uploads | 1.9% | 0.0% |
Sample. 2,362 application forms of security roles open on 14 Nov 2026, read from the employers' own applicant-tracking systems (77.7% of all open roles).
Required: the form will not submit without it. Name and email, asked by every form, are not listed.
Source. CyberJobs.cc Research, How Cybersecurity Job Applications Work, live data.
Figure 2
Screening questions asked
What do security job applications ask beyond a resume?
| Question theme | Forms asking |
|---|---|
| Work authorization or visa sponsorship | 71.5% |
| A past job or interview at the employer, or a conflict of interest | 28.8% |
| Relocation or working from an office | 25.2% |
| Expected salary or pay | 19.1% |
| Citizenship or export-control status (US person, ITAR) | 14.2% |
| Experience or years in a field | 13.9% |
| Start date, notice period or availability | 12.6% |
| Degree or field of study | 12.2% |
| A security clearance | 7.2% |
| Age or being over 18 | 4.5% |
| Languages spoken or fluency | 3.5% |
| A certification | 3.0% |
| How you heard about the role | 2.0% |
| Demographics (gender, race, veteran, disability) | 1.0% |
Sample. 2,362 application forms of security roles open on 14 Nov 2026, read from the employers' own applicant-tracking systems (77.7% of all open roles); themes read from the label of each question the employer adds to its form.
A question can match more than one theme. Demographic questions are usually optional and asked for equal-opportunity reporting.
Citizenship and export control: US defense and space employers must know whether an applicant is a US person before sharing controlled technology (ITAR and EAR), and a clearance needs citizenship, so these forms ask apart from work authorization.
Questions in another language than English are read by the same English patterns, so an employer asking in Korean or French counts under none of its themes.
Source. CyberJobs.cc Research, How Cybersecurity Job Applications Work, live data.
Figure 3
How long application forms are
How many fields does a security job application have?
| Form length | Forms | Share |
|---|---|---|
| 1 to 5 fields | 58 | 2.5% |
| 6 to 10 fields | 429 | 18.2% |
| 11 to 15 fields | 821 | 34.8% |
| 16 to 25 fields | 956 | 40.5% |
| 26 fields or more | 98 | 4.1% |
Sample. 2,362 application forms of security roles open on 14 Nov 2026, read from the employers' own applicant-tracking systems (77.7% of all open roles).
Fields: every input on the form, from name and email to the last screening question.
Source. CyberJobs.cc Research, How Cybersecurity Job Applications Work, live data.
Figure 4
Application forms by employer
Which security employers ask the most of applicants?
| Employer | Median fields | Median own questions | Resume required |
|---|---|---|---|
| TRM Labs | 38 | 31 | 100.0% |
| Shield AI | 35 | 23 | 100.0% |
| LeadtechSmall sample | 32 | 20 | 100.0% |
| Smile Digital HealthSmall sample | 32 | 15 | 100.0% |
| YipitDataSmall sample | 30 | 17 | 100.0% |
| 1Password | 29 | 16 | 100.0% |
| Tevora | 29 | 14 | 100.0% |
| CommvaultSmall sample | 27 | 16 | 0.0% |
| Coupang | 27 | 19 | 97.8% |
| GoDaddySmall sample | 27 | 15 | 100.0% |
| CampusWorksSmall sample | 26 | 16 | 100.0% |
| CamundaSmall sample | 26 | 19 | 100.0% |
| The New York TimesSmall sample | 26 | 15 | 100.0% |
| TrellisWare TechnologiesSmall sample | 26 | 15 | 100.0% |
| AHEAD | 25 | 11 | 100.0% |
| Coupa | 25 | 11 | 100.0% |
| Geotab | 25 | 9 | 100.0% |
| AledadeSmall sample | 24 | 10 | 100.0% |
| Inductive AutomationSmall sample | 24 | 15 | 100.0% |
| Long View Systems | 24 | 14 | 100.0% |
| Tenable | 24 | 11 | 100.0% |
| WrikeSmall sample | 24 | 13 | 100.0% |
| airSlateSmall sample | 23 | 7 | 100.0% |
| Block | 23 | 14 | 100.0% |
| CloudLinuxSmall sample | 23 | 12 | 100.0% |
| Coalfire | 23 | 9 | 100.0% |
| ConnectWiseSmall sample | 23 | 8 | 0.0% |
| ePlusSmall sample | 23 | 13 | 0.0% |
| EverAI | 23 | 17 | 100.0% |
| SpaceX | 23 | 13 | 96.8% |
| xAI | 23 | 7 | 100.0% |
| IntercomSmall sample | 23 | 12 | 100.0% |
| KnowBe4Small sample | 23 | 10 | 0.0% |
| Canonical | 22 | 11 | 100.0% |
| Coinbase | 22 | 11 | 100.0% |
| EnsonoSmall sample | 22 | 9 | 100.0% |
| InsuritySmall sample | 22 | 12 | 100.0% |
| Samsara | 22 | 11 | 0.0% |
| Starling Bank | 22 | 15 | 100.0% |
| Two Six Technologies | 22 | 12 | 100.0% |
| Rocket Lab | 22 | 13 | 100.0% |
| SentiLinkSmall sample | 22 | 16 | 100.0% |
| AEG | 21 | 8 | 100.0% |
| Agoda | 21 | 10 | 42.9% |
| Anthropic | 21 | 13 | 10.8% |
| Asana | 21 | 8 | 100.0% |
| CoreWeave | 21 | 10 | 100.0% |
| Fivetran | 21 | 7 | 100.0% |
| HelloFresh | 21 | 12 | 100.0% |
| Infosys Consulting | 21 | 13 | 100.0% |
The other 541 rows, in the same order (every value of every row is in the report's data, sent by email):
JumpCloud, Magnet Forensics, n8n, Palantir, Riveron, Zscaler, Axon, Dropbox, Abusix, Anduril Industries, Appspace, BlackCloak, Brex, Brillio, Crowell & Moring, Fullscript, IONOS, Irth Solutions, Kin Insurance, NinjaOne, QuintoAndar, Recorded Future, Redgate, Robots & Pencils, Super.com, Affirm, PlayStation (Sony Interactive Entertainment), Appian, Cobalt, DigitalOcean, ESO, GuidePoint Security, Mozilla, Quora, Rain, Robinhood, Safe Software, Spotify, Tailscale, Zapier, Job&Talent, 360Learning, Airbnb, Anaplan, Avertium, DotWorld, Fastly, Luxor, Lyft, Methods, Okta, Olo, PathAI, People Data Labs, Sezzle, Stand Together, Swapcard, Sysdig, UltraViolet Cyber, Vercel, Bybit, Ethos, Pindrop, Abnormal Security, Adyen, Airship, Airwallex, Atmosera, Capco, Carrot, Celonis, Coalition, Consensys, Elastic, Filevine, FormativGroup, Google Fiber, Gruve, Included Health, Instructure, Menlo Security, MongoDB, Nubank, OpenZeppelin, Pico, Plaid, Roblox, Scopely, Sierra, Snowflake, Stripe, Temporal, TENEX.AI, VGS, Xsolla, Zipline, Cyderes, Ping Identity, Trail of Bits, 1GLOBAL, Alan, Alloy, Ambit Iberia, Base.com, Beast Industries, Blockstream, Box, Bugcrowd, Databricks, Figma, Gen Digital, GWI, Hadrian, HealthVerity, IonQ, Jusbrasil, Keeper Security, Kodex, Kraken, Mapbox, MeridianLink, Myriad360, Neo4j, Octus, Pinterest, Pure Storage, Qualtrics, Saviynt, Smartsheet, Socure, SonicWall, Sporty Group, Staffbase, Tanium, Tekion, Veeam, Charlie Health, iCapital, Nozomi Networks, Stellar Cyber, Applied Intuition, bunny.net, Canary Technologies, Chainguard, Chartis, Datadog, Delinea, Deploy, Digital Asset, ExtraHop, FINN, FireMon, Frontline Wildfire Defense, Gemini, HackerOne, Harvey, iFood, Instacart, InterSystems, Island, Klaviyo, KOHO, Lovable, Metropolis, Motive, Offchain Labs, Orcrist Technologies, Oshi Health, Prompt Health, RootstockLabs, Scale AI, Second Front, Semperis, SEON, SimSpace, Sonar, Tala, Talkdesk, Upstart, Valkai, Workleap, Axios, Forward Financing, Sentry, Twilio, Action1, AlphaSense, Angi, Aptible, Ardent, ATOSS, DiliTrust, Discord, DoorDash, DuckDuckGo, Five9, Fleetio, Flexport, Galaxy, GitLab, Grafana Labs, Gurobi, Headway, Huntress, Illumio, Istari Digital, Nebius, NETGEAR, Netskope, OKX, OpenAI, OpenSesame, Orca Security, Owner, Peregrine, Pliancy, Reddit, Rhymetec, Ridgeline, Ripple, Saronic Technologies, SpyCloud, Strata Information Group, The Browser Company, Trolley, Valence, Xometry, Zania, Zeta Global, Abacus, BTSE, LaunchDarkly, OneTrust, Riskified, Apollo.io, Arionkoder, AvePoint, BeyondTrust, Braze, Chainalysis, Cloudflare, commercetools, CyberOne, Eneba, Esri, European Dynamics, FAR.AI, Form3, Garner Health, Glean, Ivalua, Kapres Technology, Legora, Lila Sciences, MARGO, Nscale, NuHarbor Security, Pacvue, Plain Concepts, Redpanda, RELEX Solutions, Rubrik, Semgrep, Snyk, SpecterOps, Sprocket Security, Toast, Vectra AI, vivenu, Warp, Webflow, Writer, Zippy, CLEAR, Cogent Security, Engine, Halcyon, Monks, Netcraft, Quanata, Thunes, VulnCheck, Addepar, Apex, Backblaze, Beam, Black Duck, Carvana, CertiK, Checkout.com, Dragos, Emergent, Expel, First Due, Flodesk, G-P, Gainsight, Hex, Immersive, Kalles Group, Kong, Marqeta, Metabase, Miovision, Monzo, Obsidian Security, Prefect, Render, Resend, Rogo, SafeBreach, Sardine, SkySlope, Starburst, Supabase, Superhuman, Sword Group, Thoropass, Thumbtack, Tide, Tines, Trace3, Turquoise Health, Virta Health, Wiz, Zimperium, 6sense, Axonius, BitGo, ID.me, Mistral AI, Plata, 10a Labs, Air Apps, Airtm, Anchorage Digital, Banyan Software, BioCatch, Bitdefender, Bondora, Bounteous, Cribl, Docker, Ent, fal, Firmus, Float, Fly.io, Foley, Glia, Hinge Health, Horizon3.ai, JetBrains, knowmad mood, LemFi, Liftoff, Maze, Mesh, Muon Space, Partly, payabl., Phantom, Primer, Quisitive, Readdle, Reltio, Shakepay, Solidgate, Sword Health, Synthesia, Vanta, Verkada, WorkOS, Zencoder, Ebury, ElevenLabs, WHOOP, Ada, Aidoc, AIFT, Airlock Digital, Alpaca, Anyone AI, Appier, Auros, Bishop Fox, BJAK, Bloomreach, Brave, Buffer, Casa, Censys, Clariness, ClickHouse, Crusoe, Cyberhaven, Dashlane, Decagon, Deepgram, ENSEK, Federato, Gong, Interrupt Labs, K Health, Linear, Nord Security, Notion, Payoneer, Pennylane, Perplexity, Pliant, Resilience, RFA, Salesloft, SentinelOne, The Quality Group, Thinking Machines Lab, Upgrade, Wealthsimple, 3Cloud, AIOS, Aptos Labs, Assured, Bitwarden, ClickUp, Cohere, ControlPlane, Dataflow Security, DISCO, Docplanner, Druva, EDB, Harness, Jane, JFrog, Mama Money, Material Security, N-iX, Oneleet, OPSWAT, Phoenix Software, Physitrack, Pomelo Care, Praetorian, Project Eleven, Runway, Socket, SOFTSWISS, Synack, UpGuard, Valon, Vultr, YGO, Youtrust, Zocdoc, AegisAI, Eye Security, Finite State, Neura Robotics, Secfix, Trigger.dev, 7AI, Allium, Altruist, AppsFlyer, Cato Networks, DataDome, Deliveroo, Duna, Endor Labs, Figure AI, Habitat Learn, Helius, Hightouch, Lightning Labs, mindsquare, Mysten Labs, Oddball, Playlab, PubMatic, Reflection AI, Reflow, Rescale, Salt Security, Sophos, Stedi, The Mill Adventure, Transmit Security, Truelogic, Turnkey, Paxos, Ramp, Apiiro, CloudSEK, DDN, emerchantpay, Empirical, Filigran, Flox, Fuse Energy, Higgsfield AI, Intertek, Lumos, Opal Security, Overflow, Pipe, Skydio, SpotMe, Squads, vCluster Labs, incident.io, MOXFIVE, Artemis, Cape, Cracken, JustMarkets, Morpho, Brain Co., depthfirst, Intuition Machines, Latent Health, OpenLoop Health, qlub, Serval, Tonic.ai, toogeza, Zafran, Zeely, Armadin, Forus, Griffin, Humanoid, Newxel, Asymmetric Research, LiteLLM, Nexxa.AI, Roboflow, Terac, Injective, Inspectiv
Sample. 2,362 application forms of security roles open on 14 Nov 2026, read from the employers' own applicant-tracking systems (77.7% of all open roles).
Own questions: fields the employer adds beyond the applicant system's standard ones (name, contact, resume, profiles).
No row with any forms is a small sample: the rows differ so much that each reads on its own from its first. Medians need at least 3 forms.
Source. CyberJobs.cc Research, How Cybersecurity Job Applications Work, live data.
Figure 5
The applicant-tracking systems behind the forms
Which hiring software do security employers use?
| System | Forms | Share of forms read | Employers |
|---|---|---|---|
| Greenhouse | 1,433 | 60.7% | 292 |
| Ashby | 643 | 27.2% | 209 |
| Lever | 166 | 7.0% | 56 |
| Workable | 72 | 3.0% | 22 |
| Teamtailor | 48 | 2.0% | 12 |
Sample. 2,362 application forms of security roles open on 14 Nov 2026, read from the employers' own applicant-tracking systems (77.7% of all open roles).
Source. CyberJobs.cc Research, How Cybersecurity Job Applications Work, live data.
For employers, recruiters and researchers
Buy the data behind this report
The figures above are a summary. Behind them are records we collect ourselves, every day:
3,462 roles tracked, each with its history
Every role on 696 job boards, read since 11 Nov 2026 (every hour since 11 Nov 2026): its pay and place, and the first and last day it was open.
3,347 apply clicks in 4 days
Which security roles people actually apply to, by specialty, pay and where the role is open. It happens on this site, so nobody else can count it.
fit checks of members against open roles
How the people looking for security jobs here measure up against real postings, and what they lack when they fall short: years, a tool, a certification, a clearance.
What you can buy
The records
The rows behind any figure, with their history, not only the totals.
A regular feed
The same figures every week or month, as files.
A custom cut or benchmark
Your countries, specialties or certifications, or your own company against the market.
Hiring for security and want to reach the people behind this data? (you make the hire).
Method and definitions
The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. The application form of every open role whose applicant-tracking system publishes one. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.
- Coverage
- The employers whose public job boards CyberJobs.cc reads in full every hour, from 11 Nov 2026. Each figure states how many were read.
- Application form
- The fields an applicant fills in on the employer's own application page, read from its applicant-tracking system. Required: the form will not submit without the field.
- Window
- Live: the last 28 complete days, in UTC. Edition: one calendar month, in UTC.
What this data cannot tell you
- Employers that hire without a public job board, or post only on LinkedIn or through recruiters, are not counted; government agencies and most staffing firms are not read.
- A listing is not a hire. Some employers keep a role open for months, and some post one listing per city or country.
- Some systems ask further questions after the first page or by email; only the published form is read.
How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.
Editions
The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.
- Live data (this page)Last 28 complete days, recomputed daily
Cite and reuse
Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.
Citation
CyberJobs.cc (2026). How Cybersecurity Job Applications Work (live data, 11 Nov 2026 to 14 Nov 2026). https://cyberjobs.cc/research/how-cybersecurity-job-applications-work (accessed 15 Nov 2026)
BibTeX
@misc{cyberjobscc_how_cybersecurity_job_applications_work_live,
author = {{CyberJobs.cc}},
title = {How Cybersecurity Job Applications Work (live data, 11 Nov 2026 to 14 Nov 2026)},
year = {2026},
howpublished = {\url{https://cyberjobs.cc/research/how-cybersecurity-job-applications-work}},
note = {Accessed 15 Nov 2026},
}More research
- Entry-Level Cybersecurity Jobs by the NumbersHow many open security roles are open to people early in their career, in which specialties, and what do they pay?Read the report
- Cybersecurity Talent: Supply and DemandHow many people are looking for each open security role, in which specialties are qualified people scarce, and in which countries?Read the report
- Who Looks for Cybersecurity JobsWho are the people looking for security jobs on this site: where they are, which specialties they look at, and what they hold?Read the report
- Do Applicants Qualify for Cybersecurity Jobs?How often do people looking for security jobs fit the roles that suit them best, and what do they lack when they fall short?Read the report
- What People Search For in Cybersecurity JobsWhich security specialties do people search for most against how many roles are open, and what pay do they ask for?Read the report
- Cybersecurity Employers ComparedWhich employers list the most security roles, what do they pay, who may apply to them and what do they hire for?Read the report
- The Cybersecurity Salary ReportWhat do security roles pay, by specialty and by employer?Read the report