Skip to content

Research report · Live data

What Cybersecurity Jobs Require

Of 3,037 open security postings with a full description on 14 Nov 2026, 31.8% name a degree, 30.0% a certification and 6.0% a security clearance; where years of experience are stated, the median ask is 5 years.

Data window
11 Nov 2026 to 14 Nov 2026
4 days, UTC
Computed
15 Nov 2026, 14:41 UTC
Recomputed every day
Source
The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. The full description of every open role whose board publishes one.
Method
Version 1. Definitions
CC BY 4.0, how to cite

Every figure on this page as CSV and JSON, sent to your work email.

open security postings with a full description read
3,037
name a master's or a PhD
10%
name a certification
30%
name a security clearance
6%
median experience asked, where stated
5 years

Key findings

  1. 1

    31.8% of the 3,037 security postings with a full description name a degree: 22.2% a bachelor's as the highest, 7.1% a master's and 2.6% a PhD. Of the postings naming a degree, 47.9% accept experience in its place.

    Figure 1
  2. 2

    30.0% name at least one certification; the most named are CISSP (572 postings), GIAC certifications (332 postings) and CISM (251 postings).

    Figure 2
  3. 3

    6.0% name a security clearance (181 postings), 62 of them at TS/SCI and 17 with a polygraph; 22.1% of those ask only that the applicant can obtain one.

    Figure 3
  4. 4

    Where a posting states years of experience (52.1% of postings), the median ask is 5 years; 69.6% ask for 5 years or more and 11.1% for 2 years or fewer.

    Figure 4
  5. 5

    6.1% of postings mention a background check and 1.9% a technical assessment, take-home or coding test.

    Figure 5
  6. 6

    The tools and skills named most often are Python (1,285 postings), AWS (1,128 postings) and Google Cloud (763 postings).

    Figure 7
  7. 7

    Among the specialties, Governance, Risk & Compliance (GRC) postings name a certification most often (50.3%, CISSP above all) and Threat Intelligence & Security Research postings least often (5.8%).

    Figure 8

Figure 1

Degrees named, by specialty

How many security job postings name a bachelor's, a master's or a PhD, and how many accept experience instead?

SpecialtyBachelor'sMaster'sPhDNo degree named
All postings read
22.2%
7.1%2.6%68.2%
Governance, Risk & Compliance (GRC)
29.8%
5.6%1.6%63.0%
Security Engineering
23.9%
9.4%3.4%63.3%
Application & Product Security
25.4%
6.1%1.9%66.6%
Penetration Testing & Red TeamSmall sample
21.1%
3.7%5.3%70.0%
Security Operations & Incident Response
20.8%
6.6%2.5%70.1%
Security Architecture & Consulting
21.7%
6.5%1.0%70.8%
Security Leadership
16.9%
8.6%2.2%72.3%
Identity & Access ManagementSmall sample
15.6%
6.8%3.4%74.1%
Threat Intelligence & Security ResearchSmall sample
12.8%
5.8%5.8%75.6%
Cloud SecuritySmall sample
16.0%
6.7%0.8%76.5%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

Each posting counts once, at the highest degree its description names. A mention can be a requirement or a preference ('a master's is a plus'): the figure counts both. A posting that asks only for current enrolment (an internship) is in none of the four columns.

Experience accepted instead: of the postings naming a degree, the share that also accepts experience in its place ('or equivalent practical experience', 'in lieu of a degree').

Descriptions written in another language are read by the same English patterns, so a French 'Bac+5' or a German 'Studium' counts as no degree named.

Rows with fewer than 250.3 postings read are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own postings read (the weight fitted on the rows' own counts).

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 2

Certifications named

Which certifications do security job postings name, and in which specialty most?

CertificationPostings naming itShare of postings read
Any certification on the list912
30.0%
CISSP572
18.8%
GIAC certifications (GSEC, GCIH, GPEN and others)332
10.9%
CISM251
8.3%
OSCP210
6.9%
CISA (Certified Information Systems Auditor)175
5.8%
CompTIA Security+149
4.9%
CCSP126
4.1%
OffSec advanced (OSEP, OSWE, OSED, OSCE3)101
3.3%
AWS certifications100
3.3%
CEH (Certified Ethical Hacker)99
3.3%
CRISC91
3.0%
Microsoft security certifications (AZ-500, SC-200, SC-100, SC-300)66
2.2%
ISO 27001 Lead Auditor or Lead Implementer59
1.9%
Cisco CCNA or CCNP49
1.6%
CompTIA CySA+43
1.4%
CKS (Certified Kubernetes Security Specialist)32
1.1%
CIPP (privacy)28
0.9%
CRTO24
0.8%
Google Cloud Professional Cloud Security Engineer16
0.5%
SSCP16
0.5%
CompTIA SecurityX (CASP+)12
0.4%
PCI QSA or ISA11
0.4%
CCSK10
0.3%
CompTIA Network+9
0.3%
PNPT9
0.3%
CGRC (formerly CAP)8
0.3%
eJPT and eCPPT6
0.2%
CompTIA PenTest+3
0.1%
The DoD 8570 or 8140 baseline30
1.0%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

The certifications are the list the site's certification pages count, each read by the words postings write it with; CISA counts only beside another certification in the same sentence, since the letters also name the US cyber agency. A mention can be a requirement or a preference ('CISSP preferred'): both count.

A posting can name several certifications and counts once for each; Any certification counts it once. The DoD 8570 or 8140 baseline is not a certification but the US defense rule that makes a cleared seat require one of its approved certifications.

Specialty naming it most often: the specialty where the largest share of its own postings names it, among the specialties with at least 21 postings read: below that a specialty's share leans more on the average of all specialties than on its own postings (the weight fitted on the specialties' own counts).

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 3

Security clearance named

How many security job postings ask for a security clearance, at which level, and must the applicant already hold it?

Clearance namedPostingsShare of postings read
Any security clearance181
6.0%
TS/SCI62
2.0%
Top Secret (no SCI named)29
1.0%
Secret21
0.7%
Public Trust5
0.2%
A clearance with no level named64
2.1%
A polygraph17
0.6%
A clearance already held119
3.9%
Eligibility to obtain one109
3.6%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

The level rows (TS/SCI to a clearance with no level named) count each posting once, at the highest level it names; the last three rows can overlap them and each other. TS/SCI, Top Secret, Secret and Public Trust are US government levels; another country's clearance (the UK's SC or DV, Canada's) counts at the level it names, or with no level.

Already held: the sentence naming the clearance asks for an active, current or held one. Eligibility: it asks that the applicant can obtain one. A posting may ask for either ('an active TS/SCI or the ability to obtain one') and then counts in both.

Specialty naming it most often: the specialty where the largest share of its own postings names it, among the specialties with at least 330 postings read: below that a specialty's share leans more on the average of all specialties than on its own postings (the weight fitted on the specialties' own counts).

Patterns: a clearance (?<!\bFacility\s)\b[Cc]learances?\b|\bCLEARANCE\b|\b(?:SC|DV|eDV|NV1|NV2)\s+(?:[Cc]leared|[Cc]learance|level|[Vv]etting)\b|\b[Ss]ecurity [Vv]etting\b; TS/SCI \bTS\s*\/\s*SCI\b|\bTS-SCI\b|\bTop Secret\s*\/\s*SCI\b|\bSCI\b(?=[^.\n]{0,30}\b(?:eligib|access|clearance)); Top Secret \b(?:Top[- ]Secret|TOP SECRET)\b|\bTS\b(?=\s+(?:security\s+)?[Cc]learance); Secret, in a sentence naming a clearance; a polygraph \bpolygraph\b(?!\s+protection)|\b(?:CI|FS|full[- ]scope|counter-?intelligence|lifestyle)\s+poly(?:graph)?\b.

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 4

Years of experience asked for

How many years of experience do security job postings ask for?

Experience statedPostingsShare of postings stating years
1 to 2 years175
11.1%
3 to 4 years306
19.3%
5 to 9 years896
56.6%
10 years or more205
13.0%

Sample. 1,582 of the 3,037 postings read state a number of years of experience (52.1%).

The first figure stated before 'years of experience' counts ('5+ years of security engineering experience' is 5; '3 to 5 years of experience' is 3).

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 5

Hiring steps mentioned

Which hiring steps do security job postings mention: interviews, background checks, technical tests?

StepPostings mentioning itShare of postings read
An interview857
28.2%
A background check186
6.1%
A technical assessment, take-home or coding test59
1.9%
Identity verification43
1.4%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

An interview counts wherever the description names one, including an employer's equal-opportunity note on accommodation during the interview process.

A technical assessment counts only by a test's own names (a take-home, a coding test, a technical screen, a skills assessment, HackerRank or Codility): a security assessment, a risk assessment or a vulnerability assessment is the job's work, not a test of the applicant.

A security clearance's investigation is counted on its own in the clearance figure.

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 6

Terms of work mentioned

Do security job postings mention remote work, full-time employment, benefits or contract terms?

TermPostings mentioning itShare of postings read
Remote work1,052
34.6%
Employee benefits (health insurance, paid time off)757
24.9%
Full-time568
18.7%
Contractor or freelance terms53
1.7%
Part-time22
0.7%
A flexible or self-set schedule29
1.0%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

A mention of remote work can be the posting's own terms or a sentence about the team ('remote-first company', 'remote within the US'): the remote and on-site report reads where each role can be done from.

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 7

Tools, clouds, languages and frameworks named

Which tools, clouds, languages and frameworks do security job postings name?

Tool or skillPostings naming itShare of postings read
Python1,285
42.3%
AWS1,128
37.1%
Google Cloud763
25.1%
Microsoft Azure747
24.6%
Kubernetes679
22.4%
SIEM660
21.7%
ISO 27001637
21.0%
NIST frameworks575
18.9%
Go558
18.4%
Linux530
17.5%
SOC 2529
17.4%
Vulnerability management506
16.7%
Terraform411
13.5%
MITRE ATT&CK347
11.4%
Zero trust319
10.5%
PCI DSS310
10.2%
PowerShell271
8.9%
Active Directory and Entra ID263
8.7%
DevSecOps262
8.6%
GDPR249
8.2%
SQL221
7.3%
FedRAMP208
6.8%
Splunk204
6.7%
Rust193
6.4%
HIPAA190
6.3%
Burp Suite112
3.7%
Microsoft Sentinel96
3.2%

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

The tools and skills are the list the site's skill pages count, each read by the words postings write it with (acronyms such as AWS, SIEM or NIST in capitals only). A mention can be a requirement, a preference or a line about the employer's own stack: all count.

Specialty naming it most often: the specialty where the largest share of its own postings names it, among the specialties with at least 12 postings read: below that a specialty's share leans more on the average of all specialties than on its own postings (the weight fitted on the specialties' own counts).

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 8

Certifications, clearance and experience, by specialty

Which security specialties most often name a certification or a clearance, and how many years do they ask for?

SpecialtyNames a certificationCertification named mostNames a clearanceMedian years asked
Governance, Risk & Compliance (GRC)
50.3%
CISSP8.5%5
Cloud Security
41.2%
AWS certifications4.2%5
Penetration Testing & Red Team
41.1%
OSCP10.5%5
Security Architecture & Consulting
37.5%
CISSP4.4%6
Security Operations & Incident Response
36.7%
GIAC certifications (GSEC, GCIH, GPEN and others)5.3%5
Security Leadership
31.5%
CISSP5.4%7
Application & Product Security
21.9%
OSCP4.5%5
Identity & Access Management
15.6%
CISSP2.7%5
Security Engineering
15.6%
CISSP6.5%5
Threat Intelligence & Security Research
5.8%
GIAC certifications (GSEC, GCIH, GPEN and others)5.8%5

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

Medians need at least 3 postings stating years.

Rows with fewer than 22.2 postings read are marked as a small sample and not ranked: below that the average of the rows weighs more than a row's own postings read (the weight fitted on the rows' own counts).

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

Figure 9

Requirements by employer

How do the employers that publish full descriptions differ in what they ask for?

EmployerNames a degreeNames a certificationNames a clearanceMedian years asked
Palo Alto Networks
48.0%
24.5%1.0%6
Thales
10.1%
15.2%3.8%5
SpaceX
93.5%
17.7%22.6%4
Inetum
9.8%
19.7%0.0%5
CrowdStrike
40.0%
20.0%2.0%5
Coupang
37.0%
39.1%0.0%8
GuidePoint Security
59.5%
61.9%16.7%5
Anthropic
100.0%
16.2%8.1%8
OpenAI
0.0%
0.0%5.4%5
Capco
12.1%
45.5%0.0%6
Zscaler
22.6%
22.6%9.7%7
Anduril Industries
26.7%
23.3%100.0%8
Arctic Wolf
32.1%
32.1%0.0%5
SentinelOne
14.3%
14.3%0.0%5
Databricks
73.9%
4.3%13.0%7
Okta
36.4%
4.5%13.6%8
Sophos
40.9%
59.1%0.0%5
AHEAD
47.6%
38.1%0.0%7
Cloudflare
14.3%
14.3%0.0%5
Elastic
9.5%
28.6%4.8%6
Check Point
30.0%
30.0%0.0%3
Nebius
25.0%
65.0%0.0%6
CoreWeave
26.3%
21.1%0.0%5
Integrity360
31.6%
57.9%5.3%5
Qualys
26.3%
63.2%5.3%7
Roblox
21.1%
5.3%0.0%5
Tevora
94.7%
10.5%0.0%n/a
Advens
0.0%
11.8%0.0%n/a
Trend Micro
35.3%
35.3%0.0%5
xAI
62.5%
75.0%6.3%3
Snowflake
53.3%
26.7%6.7%5
Stripe
26.7%
20.0%0.0%7
Airwallex
92.9%
42.9%0.0%7
Two Six Technologies
78.6%
14.3%100.0%6
Applied Intuition
100.0%
53.8%30.8%5
Chainguard
7.7%
7.7%0.0%n/a
Huntress
23.1%
7.7%0.0%5
MongoDB
30.8%
15.4%0.0%5
Scalian
7.7%
30.8%0.0%5
Veeam
7.7%
69.2%7.7%7
ESET
16.7%
41.7%0.0%n/a
Nscale
0.0%
16.7%0.0%6
Workstreet
8.3%
100.0%0.0%5
Canonical
81.8%
0.0%0.0%n/a
Coinbase
0.0%
0.0%0.0%3
Crusoe
72.7%
9.1%0.0%5
DigitalOcean
36.4%
0.0%0.0%5
DoorDash
72.7%
9.1%0.0%8
Dragos
0.0%
9.1%18.2%4
GitLab
0.0%
27.3%0.0%n/a

The other 646 rows, in the same order (every value of every row is in the report's data, sent by email):

Illumio, IOActive, JustMarkets, Kapres Technology, Trace3, UltraViolet Cyber, Wiz, Cato Networks, CyberOne, Flexport, Methods, Netcompany, Artemis, Bitdefender, CENSUS, CertiK, EverAI, Myriad360, Pure Storage, Samsara, Verkada, Affirm, BJAK, Delinea, Gruve, Higgsfield AI, knowmad mood, Kraken, Palantir, Plaid, Ripple, Rocket Lab, Rubrik, Shield AI, Starling Bank, Sword Group, WHOOP, 7AI, Abnormal Security, Agoda, Anaplan, Apex, Asana, AvePoint, Backblaze, Brain Co., Brex, Fastly, Harvey, Infosys Consulting, Intuition Machines, Muon Space, Optiveum, SOFTSWISS, Superhuman, Tenable, 1Password, Abacus, Altruist, Armadin, Box, Braze, Bybit, Coalition, Cyberhaven, Darktrace, Dropbox, Gainsight, Harness, iCapital, IonQ, JFrog, Legora, Logicalis Spain, Mistral AI, MOXFIVE, Neura Robotics, Notion, Obsidian Security, OKX, Oneleet, Ramp, SimSpace, Talan, Tanium, 10a Labs, Aidoc, Aikido Security, AlphaSense, Appian, Arctiq, Avertium, Block, Cape, Checkout.com, ClickHouse, Cohere, Coupa, Dataflow Security, depthfirst, European Dynamics, Firmus, Galaxy, Horizon3.ai, Interrupt Labs, IONOS, Kalles Group, Keeper Security, Klaviyo, Long View Systems, Mozilla, Nubank, OPSWAT, Packetlabs, Proofpoint, Qualtrics, Recorded Future, Reddit, Reflection AI, Robinhood, Rogo, Saviynt, Second Front, SonicWall, TENEX.AI, Trellix, TRM Labs, Vercel, 3Cloud, Alpaca, Arancia, Axonius, Brillio, CLEAR, CloudSEK, Coalfire, Cohesity, Decagon, Deliveroo, Docker, Ebury, Emergent, Endor Labs, Eye Security, Figma, Figure AI, Fivetran, Fullscript, Garner Health, Glean, Gong, Instacart, InterSystems, JumpCloud, Kodex, Mercor, Mirantis, Motive, NinjaOne, Ontinue, Perplexity, Plata, PlayStation (Sony Interactive Entertainment), Rhymetec, Ridgeline, SafePaaS, Scopely, Sentry, Serval, Sierra, Smartsheet, Tailscale, team.blue, Thinking Machines Lab, Thoropass, Trail of Bits, VulnCheck, Writer, Xsolla, Acronis, Addepar, AEG, AfterQuery, AIFT, Alloy, Anovia, Apollo.io, AppsFlyer, Beast Industries, BeyondTrust, Bishop Fox, Black Duck, Bloomreach, Bugcrowd, Carvana, Cribl, Dashlane, DataDome, DeepHealth, Deploy, Discord, Esri, fal, Forus, Gen Digital, Geotab, Hadrian, Headway, HelloFresh, Humanoid, iFood, Instructure, Keenfinity, Liftoff, Lila Sciences, LiteLLM, Lovable, Magnet Forensics, Menlo Security, Metropolis, micro1, Mimecast, Mysten Labs, N-iX, nesto, NETGEAR, Netrix Global, Nord Security, OpenLoop Health, OpenZeppelin, Payoneer, Pinterest, Plain Concepts, Positron AI, QuintoAndar, Rain, RELEX Solutions, Reltio, SailPoint, Salesloft, Sectigo, Sezzle, Skydio, Software Secured, Sonar, Starburst, Talkdesk, The Quality Group, Upstart, Vanta, Vultr, Zeta Global, Zimperium, Zipline, 1GLOBAL, 6sense, Accelerant, AegisAI, Air Apps, Airbnb, Aledade, Anaconda, Angi, Appspace, Arista Networks, Assured, Axios, Axis Communications, Axon, BitGo, Bitsight, BTSE, Canva, Chainalysis, Charlie Health, ClickUp, Cogent Security, Colliers, Cyderes, Datadog, DDN, Distribusion, Ditto, DuckDuckGo, ElevenLabs, emerchantpay, Engine, Ensono, Ethos, FAR.AI, Finite State, Flodesk, Forward Financing, Gemini, Glia, GoDaddy, Halcyon, Hightouch, ID.me, Immersive, incident.io, inovex, Intercom, Intertek, Ivalua, Jane, Job&Talent, K Health, KnowBe4, KOHO, Kong, LaunchDarkly, LemFi, Marqeta, mindsquare, Monks, NEC Software Solutions, Neo4j, Netcraft, Nozomi Networks, Offchain Labs, Olo, OneTrust, Orbia, Paxos, payabl., Peregrine, Phantom, Phoenix Software, Pindrop, Ping Identity, Pomelo Care, Praetorian, Protiviti, Quanata, Quisitive, Redcare Pharmacy, Redgate, Render, Riskified, Riveron, Safe Software, SafeBreach, Scale AI, Secfix, Semperis, SentiLink, Septeo, Shopware, Sigma Software, Snyk, Socket, Solidgate, Squads, Stedi, Stellar Cyber, Super.com, Synack, Tekion, The New York Times, Threatscape, Thunes, Tide, Toast, Trigger.dev, Truelogic, Turing, Turnkey, Twilio, UpGuard, Valence, Valkai, Valon, Vectra AI, vivenu, Wavenet, Wealthsimple, WorkOS, Wrike, Zafran, Zeely, zerohash, 360Learning, A-Gas, Abusix, Action1, Ada, Adyen, AIOS, Airlock Digital, Airship, airSlate, Airtm, Alan, Allium, Ambit Iberia, Anchorage Digital, Anyone AI, Apiiro, Appier, Aptible, Aptos Labs, Ardent, Arionkoder, Asymmetric Research, Atmosera, ATOSS, Auros, Aveniq, Aztec Foundation, Banner Bank, Banyan Software, Base.com, Beam, BibliU, Billigence, BioCatch, Bitwarden, BlackCloak, Blackpanda, Blockstream, Bondora, Bounteous, Brave, Buffer, bunny.net, CampusWorks, Camunda, Canary Technologies, Carrot, Casa, Case IQ, Celonis, Censys, Chartis, Clariness, CloudLinux, Cobalt, commercetools, Commvault, ConnectWise, Consensys, ControlPlane, Cracken, CREALOGIX, Crowell & Moring, CrucialLogics, Deciphex, Deepgram, Digital Asset, DiliTrust, DISCO, Docplanner, DotWorld, Doxy.me, Druva, Duna, EDB, Empirical, Eneba, ENJOY Gaming, ENSEK, Ent, ePlus, Erbis, ESO, Euna Solutions, Exclusive Networks, Exeon Analytics, Expel, ExtraHop, Federato, Filevine, Filigran, FINN, FireMon, First Due, Five9, Flare, Fleetio, Float, Flox, Fly.io, Foley, Form3, FormativGroup, Foundant, FP Digital Business Solutions, Frontline Wildfire Defense, Fuse Energy, FYUL, G-P, gaiia, Gcore, Google Fiber, Grafana Labs, Griffin, Gurobi, GWI, Habitat Learn, HackerOne, HealthVerity, Helius, Hex, Hinge Health, Included Health, Inductive Automation, Injective, Inspectiv, Insurity, Irth Solutions, Island, Istari Digital, JetBrains, Jusbrasil, Kin Insurance, Kobalt.io, Latent Health, Leadtech, Lightning Labs, Linear, LITIT, Lumos, Luxor, Lyft, Malwarebytes, Mama Money, Mapbox, MARGO, Material Security, Maze, MeridianLink, Mesh, Metabase, Miovision, Monzo, Morpho, n8n, Netskope, Newxel, Nexxa.AI, NuHarbor Security, Octus, Oddball, OFX, Opal Security, OpenSesame, Orca Security, Orcrist Technologies, Oshi Health, Overflow, Owner, Pacvue, Partly, PathAI, Payter, Pennylane, People Data Labs, Physitrack, Pico, Pipe, Playlab, Pliancy, Pliant, Prefect, Primer, Project Eleven, Prompt Health, Prowler, PubMatic, qlub, Qoria, Quora, Readdle, Recare, Redflags, Redpanda, Reflow, Rescale, Resend, Resilience, RFA, Roboflow, Robots & Pencils, RootstockLabs, Runway, Salt Security, Sardine, Saronic Technologies, Semgrep, SEON, Shakepay, Signode, SkySlope, Smile Digital Health, Socure, Spark Power, SpecterOps, Sporty Group, Spotify, SpotMe, Sprocket Security, SpyCloud, Staffbase, Stand Together, Statewise, Strata Information Group, Supabase, Swapcard, Sword Health, Synthesia, Sysdig, Tala, Technosylva, Temporal, Terac, The Browser Company, The Mill Adventure, Thumbtack, Tines, Tonic.ai, toogeza, Transmit Security, TrellisWare Technologies, Trolley, Turquoise Health, Unit4, Upgrade, Uvation, vCluster Labs, VGS, Virta Health, Warp, Webflow, Workleap, Xometry, Xplor, YGO, YipitData, Yopeso, Youtrust, Zania, Zapier, Zencoder, Zippy, Zocdoc

Sample. 3,037 security postings open on 14 Nov 2026 whose employer's board publishes a full description (696 employers), 99.9% of all open roles.

Medians need at least 3 postings stating years.

Source. CyberJobs.cc Research, What Cybersecurity Jobs Require, live data.

For employers, recruiters and researchers

Buy the data behind this report

The figures above are a summary. Behind them are records we collect ourselves, every day:

  • 3,462 roles tracked, each with its history

    Every role on 696 job boards, read since 11 Nov 2026 (every hour since 11 Nov 2026): its pay and place, and the first and last day it was open.

  • 3,347 apply clicks in 4 days

    Which security roles people actually apply to, by specialty, pay and where the role is open. It happens on this site, so nobody else can count it.

  • fit checks of members against open roles

    How the people looking for security jobs here measure up against real postings, and what they lack when they fall short: years, a tool, a certification, a clearance.

What you can buy

  • The records

    The rows behind any figure, with their history, not only the totals.

  • A regular feed

    The same figures every week or month, as files.

  • A custom cut or benchmark

    Your countries, specialties or certifications, or your own company against the market.

Hiring for security and want to reach the people behind this data? (you make the hire).

Method and definitions

The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. The full description of every open role whose board publishes one. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.

Coverage
The employers whose public job boards CyberJobs.cc reads in full every hour, from 11 Nov 2026. Each figure states how many were read.
Open role
A role listed by a given day and still on its employer's board that day.
Mention
A description mentions a degree, certification, clearance or tool when it contains one of the patterns published with the figure. A mention may be a requirement or a preference: postings rarely separate the two in a way that can be counted.
Years of experience
The first number of years a description states before "years" and "experience" ("5+ years of experience", "at least three years in security"); a range counts its lower end.
Specialty
Each role is classified from its title and description into one of the 10 security specialties this site tracks (Security Operations & Incident Response, Security Engineering, Cloud Security, Application & Product Security, Identity & Access Management, Penetration Testing & Red Team, Threat Intelligence & Security Research, Governance, Risk & Compliance (GRC), Security Architecture & Consulting, Security Leadership). Every specialty links to its own page.
Window
Live: the last 28 complete days, in UTC. Edition: one calendar month, in UTC.

What this data cannot tell you

  • Employers that hire without a public job board, or post only on LinkedIn or through recruiters, are not counted; government agencies and most staffing firms are not read.
  • A listing is not a hire. Some employers keep a role open for months, and some post one listing per city or country.
  • Descriptions are written by many hands: one posting lists ten certifications as "nice to have", another names none and still expects one.
  • Only boards that publish a full description are read; the figure says how many roles that is.

How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.

Editions

The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.

  • Live data (this page)Last 28 complete days, recomputed daily

Cite and reuse

Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.

Citation

CyberJobs.cc (2026). What Cybersecurity Jobs Require (live data, 11 Nov 2026 to 14 Nov 2026). https://cyberjobs.cc/research/what-cybersecurity-jobs-require (accessed 15 Nov 2026)

BibTeX

@misc{cyberjobscc_what_cybersecurity_jobs_require_live,
  author = {{CyberJobs.cc}},
  title = {What Cybersecurity Jobs Require (live data, 11 Nov 2026 to 14 Nov 2026)},
  year = {2026},
  howpublished = {\url{https://cyberjobs.cc/research/what-cybersecurity-jobs-require}},
  note = {Accessed 15 Nov 2026},
}
Data: every figure as CSV (one line per value) and JSON, sent to your work email.Pay and open-roles data

More research

All 50 research reports