Key findings

1
Within the same specialty, roles whose description asks for 5 or more years of experience advertised 27.1% more than described roles asking for fewer, the largest premium measured; roles with an early-career title advertised 54.9% less than roles whose title names no level.
Figure 1
2
Roles with a senior, staff or principal title advertised 11.3% more than roles whose title names no level in the same specialty, across 10 specialties (medians $206k/yr and $180k/yr overall).
Figure 2
3
Roles whose posting names a certification (CISSP, Security+, OSCP and the like) advertised 11.0% less than described roles naming none in the same specialty, across 9 specialties (medians $175k/yr and $210k/yr overall).
Figure 3
4
Roles whose description asks for a security clearance (Secret, Top Secret, TS/SCI and the like) advertised 9.2% less than described roles asking for none in the same specialty, across 10 specialties (medians $174k/yr and $203k/yr overall).
Figure 4
5
On-site or hybrid roles advertised 2.5% more than remote roles in the same specialty, across 10 specialties (medians $205k/yr and $195k/yr overall).
Figure 5
6
Among roles with a full description, asking for 5 or more years of experience went with +27.1% in advertised pay within the same specialty, and mentioning a degree with -5.4%: years in the field are priced above a degree.
Figure 1
7
Within the same specialty, roles at AI labs advertised 59.6% more than roles at other employers, the most of any employer group; roles at security consultancies and managed services advertised 35.7% less than the rest.
Figure 7

Figure 1

What goes with higher pay, compared within each security specialty

Which traits of a security role come with higher advertised pay, the specialty held equal?

Trait	Premium within specialty	Median a year with	Median a year without	Specialties compared	Roles publishing pay with / without
5 or more years of experience asked	+27.1%	$210,000	$150,000	10	548 / 186
Senior, staff or principal title	+11.3%	$205,500	$180,000	10	635 / 395
Lead, manager, director or executive title	+8.1%	$225,200	$180,000	7	219 / 395
Based only in the US, against open worldwide	+7.5%	$200,000	$203,750	5	1,113 / 42
On-site or hybrid, against remote	+2.5%	$205,000	$195,049	10	257 / 530
Degree mentioned in the description	-5.4%	$192,500	$205,000	10	508 / 729
Security clearance asked in the description	-9.2%	$174,250	$202,750	10	127 / 1,110
Certification named in the posting	-11.0%	$175,000	$210,000	9	333 / 904
Early-career title (junior, associate, intern, graduate)	-54.9%	$61,080	$180,000	4	40 / 395

Sample. Security roles open on 14 Nov 2026 that publish pay. The certification, clearance, years and degree traits compare the 3,037 open roles whose full description this site reads, at 696 employers.

Premium within specialty: for each specialty with at least 3 roles publishing pay on both sides, the median pay with the trait over the median without it, minus one; then the average across those specialties, weighted by the roles with the trait. The medians with and without are across all specialties, for context: where they disagree with the premium, the trait is concentrated in better or worse paid specialties.

A premium is an association in advertised pay, not a cause: traits travel together (a role that names a CISSP is often also senior).

A title names a level by its words: senior, staff or principal; lead, manager, head, director, chief or VP; or an early-career word (junior, associate, intern, graduate, tier 1) with no higher level beside it.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 2

A senior title, specialty by specialty

How much more does a senior, staff or principal title advertise than a title with no level, in each security specialty?

Specialty	Premium	Median a year with	Median a year without	Roles publishing pay with / without
Security Engineering	+16.2%	$213,600	$183,875	196 / 116
Application & Product Security	+13.7%	$220,000	$193,500	81 / 52
Governance, Risk & Compliance (GRC)	+14.6%	$170,750	$149,000	76 / 59
Security Architecture & Consulting	-3.1%	$198,625	$205,000	62 / 44
Security Operations & Incident Response	+16.3%	$176,750	$152,000	58 / 43
Identity & Access Management	+17.1%	$205,000	$175,000	48 / 13
Security Leadership	-4.3%	$251,108	$262,500	33 / 5
Cloud Security	+8.8%	$197,500	$181,500	33 / 17
Penetration Testing & Red Team	+5.9%	$203,500	$192,155	29 / 32
Threat Intelligence & Security Research	-4.4%	$172,000	$180,000	19 / 14

Sample. Roles with a senior, staff or principal title, against roles whose title names no level, open on 14 Nov 2026; specialties with at least 3 roles publishing pay on both sides.

Each median rests on at least 3 roles publishing pay (the one minimum of every median: the fewest whose span holds the true middle more likely than not), and the counts behind each are shown: a median of a few roles moves with a few postings.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 3

A named certification, specialty by specialty

Do security roles whose posting names a certification advertise more than roles naming none, in each specialty?

Specialty	Premium	Median a year with	Median a year without	Roles publishing pay with / without
Governance, Risk & Compliance (GRC)	-9.6%	$164,050	$181,435	94 / 90
Security Engineering	-14.3%	$180,000	$210,000	43 / 284
Security Architecture & Consulting	-6.8%	$193,875	$208,050	40 / 79
Security Operations & Incident Response	-21.3%	$147,500	$187,350	38 / 70
Security Leadership	-11.2%	$221,500	$249,550	34 / 108
Application & Product Security	-6.5%	$200,000	$214,000	32 / 108
Cloud Security	-10.1%	$183,000	$203,500	22 / 29
Penetration Testing & Red Team	-2.1%	$191,075	$195,230	20 / 48
Identity & Access Management	-25.6%	$152,500	$205,000	8 / 55

Sample. Roles whose posting names a certification (CISSP, Security+, OSCP and the like), against described roles naming none, open on 14 Nov 2026; specialties with at least 3 roles publishing pay on both sides.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 4

A security clearance, specialty by specialty

Do security roles that ask for a clearance advertise more than roles that do not, in each specialty?

Specialty	Premium	Median a year with	Median a year without	Roles publishing pay with / without
Security Engineering	-13.3%	$178,200	$205,425	33 / 294
Governance, Risk & Compliance (GRC)	-7.0%	$157,500	$169,375	27 / 157
Security Operations & Incident Response	-2.9%	$170,000	$175,050	15 / 93
Security Leadership	-0.7%	$245,000	$246,850	13 / 129
Penetration Testing & Red Team	-6.4%	$184,834	$197,500	13 / 55
Application & Product Security	-22.0%	$165,000	$211,500	9 / 131
Security Architecture & Consulting	+2.6%	$205,000	$199,750	7 / 112
Cloud Security	-42.3%	$117,500	$203,500	4 / 47
Threat Intelligence & Security Research	-1.4%	$172,000	$174,481	3 / 32
Identity & Access Management	-18.0%	$167,500	$204,250	3 / 60

Sample. Roles whose description asks for a security clearance (Secret, Top Secret, TS/SCI and the like), against described roles asking for none, open on 14 Nov 2026; specialties with at least 3 roles publishing pay on both sides.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 5

On-site against remote, specialty by specialty

Do on-site and hybrid security roles advertise more or less than remote roles of the same specialty?

Specialty	Premium	Median a year with	Median a year without	Roles publishing pay with / without
Security Engineering	+2.1%	$210,000	$205,675	84 / 112
Governance, Risk & Compliance (GRC)	-0.2%	$163,750	$164,000	46 / 67
Security Leadership	+9.8%	$252,500	$230,000	27 / 63
Application & Product Security	+23.9%	$246,338	$198,888	22 / 66
Security Operations & Incident Response	-7.9%	$161,250	$175,025	22 / 52
Security Architecture & Consulting	-10.6%	$177,500	$198,625	20 / 74
Identity & Access Management	+11.0%	$208,050	$187,500	13 / 22
Cloud Security	-11.5%	$181,500	$205,000	11 / 19
Penetration Testing & Red Team	+22.7%	$239,200	$195,000	9 / 33
Threat Intelligence & Security Research	-46.0%	$95,000	$176,000	3 / 22

Sample. On-site or hybrid roles, against remote roles, open on 14 Nov 2026; specialties with at least 3 roles publishing pay on both sides.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 6

Based only in the US, specialty by specialty

Do security roles open only to people in the US advertise more than roles open worldwide, in each specialty?

Specialty	Premium	Median a year with	Median a year without	Roles publishing pay with / without
Security Engineering	-2.4%	$205,000	$210,000	290 / 15
Governance, Risk & Compliance (GRC)	+36.0%	$170,000	$125,000	169 / 4
Security Leadership	-1.9%	$245,250	$250,000	132 / 4
Application & Product Security	+11.7%	$214,000	$191,500	118 / 10
Security Operations & Incident Response	-5.2%	$174,700	$184,350	96 / 4

Sample. Roles open only to people in the US, against roles open worldwide, open on 14 Nov 2026; specialties with at least 3 roles publishing pay on both sides.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

Figure 7

Pay by employer group, compared within each specialty

Do security software companies, AI labs or banks pay more than other employers for the same specialty?

Employer group	Premium within specialty	Median a year in the group	Median a year elsewhere	Specialties compared	Employers with open roles	Roles publishing pay in the group / elsewhere
AI labs	+59.6%	$307,500	$195,000	8	23	102 / 1,135
Software and internet companies	+5.3%	$211,500	$196,955	9	262	299 / 938
Finance, payments and crypto	+3.5%	$204,000	$199,750	10	114	121 / 1,116
Cloud, data and infrastructure	+1.1%	$202,500	$200,000	9	101	233 / 1,004
Security software companies	-6.5%	$186,325	$203,500	10	122	246 / 991
Defense, aerospace and hardware	-8.0%	$180,000	$202,491	8	18	127 / 1,110
Security consultancies and managed services	-35.7%	$132,500	$204,700	9	50	97 / 1,140
AI expert networksSmall sample	n/a	$179,400	$200,000	1	6	12 / 1,225

Sample. Security roles open on 14 Nov 2026 that publish pay, by the group of the employer that posts them (the groups of the employers page).

Each group's roles are compared with the roles of every other group, specialty by specialty, exactly as a trait is: at least 3 roles publishing pay on both sides of a specialty, weighted by the group's roles.

An employer belongs to one group, the one the employers page lists it in.

Source. CyberJobs.cc Research, What Raises Cybersecurity Pay, live data.

For employers, recruiters and researchers

Buy the data behind this report

The figures above are a summary. Behind them are records we collect ourselves, every day:

3,462 roles tracked, each with its history
Every role on 696 job boards, read since 11 Nov 2026 (every hour since 11 Nov 2026): its pay and place, and the first and last day it was open.
3,347 apply clicks in 4 days
Which security roles people actually apply to, by specialty, pay and where the role is open. It happens on this site, so nobody else can count it.
fit checks of members against open roles
How the people looking for security jobs here measure up against real postings, and what they lack when they fall short: years, a tool, a certification, a clearance.

What you can buy

The records
The rows behind any figure, with their history, not only the totals.
A regular feed
The same figures every week or month, as files.
A custom cut or benchmark
Your countries, specialties or certifications, or your own company against the market.

Hiring for security and want to reach the people behind this data? (you make the hire).

Method and definitions

The public job boards of the employers this site tracks (Greenhouse, Ashby, Lever, Workday, SmartRecruiters and the other systems they post on), read every hour, keeping the postings whose title and description read as security work. The full description of every open role whose board publishes one. Every figure is computed by one database query over the window shown, the same query for the live report and for every edition. Each figure states its sample beneath it.

Coverage: The employers whose public job boards CyberJobs.cc reads in full every hour, from 11 Nov 2026. Each figure states how many were read.
Advertised pay: The pay a posting publishes, on one scale: a year's pay in US dollars (the middle of a stated range; an hourly rate counts as 2,080 hours, a monthly one as 12 months). Pay in another currency is kept in that currency and left out of these medians. Counted once per distinct figure, as the job board counts it. Typical pay is the span from the 25th percentile of range midpoints to the 90th percentile of range tops, every figure taken as a full-time year (an hourly rate times 2,080 hours), stated from 3 distinct figures.
Premium within specialty: For each specialty with at least 3 roles publishing pay on both sides (the one minimum of every median), the median with the trait over the median without it, minus one; averaged across those specialties, weighted by the roles with the trait. A trait needs two such specialties to show a premium.
Specialty: Each role is classified from its title and description into one of the 10 security specialties this site tracks (Security Operations & Incident Response, Security Engineering, Cloud Security, Application & Product Security, Identity & Access Management, Penetration Testing & Red Team, Threat Intelligence & Security Research, Governance, Risk & Compliance (GRC), Security Architecture & Consulting, Security Leadership). Every specialty links to its own page.
Window: Live: the last 28 complete days, in UTC. Edition: one calendar month, in UTC.

What this data cannot tell you

Employers that hire without a public job board, or post only on LinkedIn or through recruiters, are not counted; government agencies and most staffing firms are not read.
A listing is not a hire. Some employers keep a role open for months, and some post one listing per city or country.
A premium is a difference between advertised figures, not the effect of the trait: a role that asks for a CISSP is also often more senior.

How the job feeds are read and roles are classified: site methodology. How fresh, complete and consistent the data is, checked every day: data quality and coverage.

Editions

The live report covers the last 28 complete days and changes every day. Each complete month is also published as an edition, frozen two days after the month ends, so a figure you cite from an edition never moves.

Live data (this page)Last 28 complete days, recomputed daily

Cite and reuse

Free to quote, chart and republish under CC BY 4.0 (creativecommons.org/licenses/by/4.0) with a link to this page. Live figures change daily: cite a monthly edition for numbers that will read the same later, or keep the access date.

Citation

CyberJobs.cc (2026). What Raises Cybersecurity Pay (live data, 11 Nov 2026 to 14 Nov 2026). https://cyberjobs.cc/research/what-raises-cybersecurity-pay (accessed 15 Nov 2026)

BibTeX

@misc{cyberjobscc_what_raises_cybersecurity_pay_live,
  author = {{CyberJobs.cc}},
  title = {What Raises Cybersecurity Pay (live data, 11 Nov 2026 to 14 Nov 2026)},
  year = {2026},
  howpublished = {\url{https://cyberjobs.cc/research/what-raises-cybersecurity-pay}},
  note = {Accessed 15 Nov 2026},
}

Data: every figure as CSV (one line per value) and JSON, sent to your work email.Pay and open-roles data

More research

All 50 research reports