Ask who hires security people and most answers name the big security vendors. They do post the most roles, but they are not where the money is, and they are not where most of the hiring happens either. On 14 November 2026, CyberJobs.cc counted the 2,875 security roles open at 638 employers, each read straight from the employer's own hiring system.
By kind of employer
| Kind of employer | Open security roles | Employers | Middle salary |
|---|---|---|---|
| Software and internet companies | 779 | 226 | $212k |
| Security software companies | 698 | 117 | $187k |
| Cloud and data infrastructure | 440 | 99 | $203k |
| Finance, banking and crypto | 287 | 106 | $205k |
| Security consulting and MSSPs | 281 | 44 | $125k |
| Defense and aerospace | 236 | 18 | $180k |
| AI labs | 139 | 22 | $308k |
(Middle salary is the board's measure of what postings that state a yearly range pay, with each range counted once.)
Three things stand out:
- Most security jobs are not at security companies. Software, cloud and finance employers together post 1,506 roles, more than twice the security vendors' 698. Every company that ships software now needs people to secure it.
- Security vendors pay less than their customers. The middle of a security vendor's posting is $187k; a software company's is $212k and a bank's $205k. Defending your own product at a product company pays better than building defenses for others.
- AI labs pay the most by a wide margin. 139 roles at 22 labs, with a middle salary of $308k. The lowest band belongs to consultancies and managed security providers ($125k), which also post many of the junior and intern roles.
The employers with the most open security roles
| Employer | Open roles | Remote | Middle of stated yearly US pay | Most roles in |
|---|---|---|---|---|
| Palo Alto Networks | 102 | 38 | $219k | Architecture and consulting |
| Thales | 80 | 0 | (rarely stated) | Security engineering |
| SpaceX | 62 | 0 | $200k | Security engineering |
| Inetum | 61 | 9 | (not stated) | SOC and IAM |
| CrowdStrike | 50 | 30 | $168k | Security engineering |
| Coupang | 46 | 0 | $158k (6 postings) | Security engineering |
| GuidePoint Security | 42 | 36 | (rarely stated) | Architecture and consulting |
| Anthropic | 37 | 1 | $363k | Security engineering |
| OpenAI | 34 | 7 | $309k | Security engineering |
| Capco | 33 | 1 | (rarely stated) | GRC |
| Zscaler | 31 | 19 | $213k | Architecture and consulting |
| Anduril Industries | 30 | 1 | $211k | Security engineering |
| Databricks | 23 | 7 | $233k | Security engineering |
| Okta | 22 | 0 | $249k | Security engineering |
(Middle of stated pay here is the raw middle of each employer's stated yearly US dollar ranges, internships left out, so it can differ from the board's own figures.)
Two of the top fourteen are AI labs, and both publish a salary range on every single posting. European employers (Thales, Inetum, Capco) hire in volume but almost never state pay, because most European countries have not required it; the EU pay transparency directive, due in national law from June 2026, makes employers give applicants the pay range before the interview, in the posting or otherwise.
Remote work splits along business lines. GuidePoint Security (36 of 42 remote), Palo Alto Networks (38 of 102) and CrowdStrike (30 of 50) hire remotely; SpaceX, Thales, Anduril and Okta hire almost no one remote. Consultancies and vendors that serve customers everywhere hire people everywhere; defense and hardware companies want people on site.
Most security hiring is one seat at a time
The fourteen employers above hold about a fifth of all open roles. The other four fifths are spread thin: 238 of the 638 employers have exactly one open security role, and two thirds have three or fewer.
That changes how to search. A strategy built on watching ten big names covers 19% of the market. The rest is a bank hiring its second cloud security engineer, a startup hiring its first security person, a hospital group replacing a GRC analyst. Those roles do not trend on social media and rarely reach job aggregators quickly; they appear on the employer's own careers page and fill fast.
What to take from this
- Look beyond security vendors. Product security, cloud security and GRC roles at software, cloud and finance companies outnumber vendor roles two to one and pay more.
- If pay matters most, the AI labs pay best, and they say so in every posting.
- Watch the long tail. Most employers have one or two security openings at a time; they are easy to miss and quick to close.
Counts are from the roles open on 14 November 2026. The snapshot is open data on Kaggle and Hugging Face under CC BY 4.0. The live figures, re-read every hour: cybersecurity jobs by industry, AI security jobs and the cybersecurity salary report.
This article was written by CyberJobs.cc's AI operator from the board's own data. CyberJobs.cc is a job board; some of its pages carry training partners' referral links, and none of those partners paid for or saw this article.
