2026 Is Shaping Up to Be the Worst Year to Look for a Cybersecurity Job in Four Years
If you’re job hunting in security right now, the market has fewer doors to knock on than at any point in the past four years. The CyberSN Jobs Report counted 235,786 US cybersecurity job postings between January and September 2026, a 26.4% drop from the 320,210 posted over the same nine months of 2025. Eight of those nine months came in below their 2025 counterparts. Some of that gap is a base effect. 2025 was the busiest year the report has tracked, so measuring against it flatters the decline. Even against 2024, though, 2026 runs lower, and against 2023 it trails by nearly 14%, so this is still the thinnest nine months on record, not just a correction off a peak. If historical seasonal patterns hold, 2026 finishes between 288,911 and 325,540 postings, applying the average October-through-December share from prior years, and even the top of that range sits beneath every completed year the report has tracked, including 2023’s 353,368, 2024’s 338,138, and 2025’s 392,356.
The market for security talent hasn’t closed. It has gotten choosier, rewarding people who can already do the work and shutting out the ones who can’t yet.
The broader economy isn’t in crisis, which makes the contraction stranger. The macro data, laid out below, shows a country growing moderately while one profession’s hiring is falling off a cliff. What’s declining, and what isn’t, says more than the headline number.
What the data shows
| Year | Job postings, January through September |
|---|---|
| 2023 | 273,498 |
| 2024 | 244,911 |
| 2025 | 320,210 |
| 2026 | 235,786 |
CyberSN pulls postings from JobSpikr, filters to the United States, deduplicates them, and maps everything onto their taxonomy of 45 functional security roles, with the dataset behind this edition pulled on October 7, 2026. It counts postings, and a posting is a signal of employer intent, not a person in a chair. A requisition sitting open for ninety days waiting for a unicorn architect counts exactly once.
The mix of demand changed along with the volume
Defense roles still carry the largest share at 41.5%, but that’s down 5.6 percentage points since 2023. Governance, Risk, and Compliance (GRC) climbed 5.4 points to 14.8%, while Product Security slipped 1.5 points to 12.8%. None of this should surprise anyone who has sat through a budget review. Compliance work survives belt-tightening because regulators don’t take a break, and a penetration test is easier to postpone than a statutory audit that reduces sales friction.
The three Product Security roles in the taxonomy averaged 10,082 postings apiece. DevSecOps, a single role tracked separately from that category, generated 24,317 postings on its own. Defense, spread across eleven tracked roles, averaged 8,887 each. Employers are competing hard for a narrow set of specialists and doing far less everywhere else.
Between the second and third quarters of 2026, among roles with at least 300 postings in Q2, the split widened sharply. Cyber Risk Analyst postings rose 20.2%, CISO climbed 19.5%, and Security Architect gained 14.0%. The losses were uglier, with Cybersecurity Director collapsing 38.9%, Penetration Tester falling 26.6%, and Security Analyst dropping 11.3%.
The quarterly uptick in CISO postings comes off a low base. Across the full nine months, the CISO area drew 2,832 postings, down from 4,632 in the same stretch of 2025, which puts it right back at 2024’s level of 2,808. The wave of companies appointing their first dedicated security chiefs has crested, and the follow-on leadership layer beneath the CISO is thinning out at the same time.
The macro backdrop
The Bureau of Economic Analysis third estimate for Q2 2026 put real GDP growth at 2.2% annually, revised up 0.7 percentage points from the second estimate, with consumer spending, investment, and exports all contributing. The Bureau of Labor Statistics Employment Situation for September shows payrolls up 29,000 and unemployment at 4.2%, parked in a 4.1% to 4.3% band it has occupied since March. Meanwhile the Job Openings and Labor Turnover Survey (JOLTS) for August counted 7.1 million openings, 5.2 million hires, and a stable 1.9% quits rate. Corporate profits rose $384 billion during the second quarter.
None of this is boomtown, and the soft spots are genuine. Payroll growth of 29,000 compares badly with the 45,000 monthly average of the preceding twelve months, and July and August were revised down by a combined 60,000. Average hourly earnings rose 3.0% over the year to $37.81, so budgets feel tighter than the headline numbers imply. Even so, a general slowdown from moderate growth to slow growth doesn’t produce a 26% collapse in one profession’s postings while national openings sit flat at 7.1 million. The macro data sets a mood, not a cause.
Job postings measure employer intent rather than filled seats, and the monthly payroll report doesn’t break security out as its own category, so a clean comparison of security employment against the national workforce simply doesn’t exist.
The old story about the talent shortage
For years the industry has repeated a line about millions of unfilled cybersecurity jobs worldwide, figures widely circulated in 2024 workforce studies and quietly dropped once the methodology received well-deserved criticism. Survey work published this year points elsewhere, with security leaders rating skill gaps well ahead of headcount shortfalls when asked about workforce problems. The complaint is rarely that seats sit empty. It’s that applicants can’t do the work the remaining seats require.
The CyberSN data fits that reading almost uncomfortably well. Entry-level postings make up just 9.5% of the total, and contract roles account for 9.2%, which suggests plenty of employers are hiring on trial terms and deciding later. Another 14.6% of postings now mention AI or machine learning terms, with September’s figure hitting 20.0%, the highest single month since January 2025. Teams are built around people who can already operate, in a discipline where the tooling is being rewritten quarterly, while companies are posting fewer openings and screening them harder.
Practical implications
For hiring managers
The same concentration cuts against you. If you need a DevSecOps engineer or a security architect, you’re bidding against every other employer in the report, so expect slower fills and firmer comp demands. Where demand has actually fallen, Penetration Tester and Security Analyst among them, you have leverage, and the postings data suggests employers are screening harder even in soft categories. Rigor beats a lowball offer. The candidate you cheap out on today is the one re-entering a hot market later.
For job seekers
Timing matters, because January and August run hottest in the report’s posting calendar while December runs coldest. Aim your search accordingly, and go in knowing whoever screens your resume wants proof you’ve done the exact work before. Contract roles at 9.2% of postings offer a way in for candidates who can demonstrate the skills without a title to match.
Among postings with known company size, the split runs 47.3% from firms with 1,001 or more employees against 52.6% from companies under 1,000 (percentages rounded). Neither segment can claim the other one is retreating while it expands, so treat hiring caution as sector-wide rather than pinning it on any single employer class.
