Cybersecurity Jobs Hit a Four-Year Low in 2026: Where the Openings Moved

Cybersecurity job postings in the US fell to a four-year low in the first nine months of 2026, but demand did not disappear. It moved. Governance, risk and compliance work and AI security grew while penetration testing shrank sharply. If you are job hunting in security right now, aim at the parts of the field that are hiring, show evidence of the specific skills those roles ask for, and expect a more selective process than the "talent shortage" headlines suggest.

This post explains what the latest posting data shows, what it does and does not mean, and how to adjust your search, whether you already work in security or are trying to break in.

What the 2026 posting data shows

The figures come from CyberSN, a cybersecurity staffing and workforce intelligence firm, as reported by Help Net Security on October 16, 2026. CyberSN analyzed US job postings sourced from the job-data provider JobSpikr, removed duplicates, and grouped listings by the security work they describe. According to that report:

• US employers posted 235,786 cybersecurity jobs from January through September 2026, the lowest total for those months in the four years CyberSN has tracked.
• That is down 26.4% from 320,210 in the same months of 2025, and about 4% below 2024.
• September 2026 was the only one of the nine months to beat its 2025 figure, by fewer than 400 postings.
• Governance, risk and compliance (GRC) grew from 9.4% of postings in 2023 to 14.8%, and was the only one of the ten largest role categories with more listings than in 2025. The report attributes much of that growth to privacy and cybersecurity attorney roles.
• Defense roles fell from 47.1% of postings in 2023 to 41.5%, but still make up roughly four in ten listings.
• Penetration tester postings fell by nearly half compared with 2025.
• AI security engineer postings more than tripled, to about 2,400.
• CISO postings fell 38.9% from 2025's record, back near 2024 levels, though they rose 19.5% from the second to the third quarter of 2026.

CyberSN's CEO, Deidre Diamond, told Help Net Security that risk is "the biggest conversation in the room right now", and suggested that what may be changing is organizations' ability to act on the demand they have, rather than the demand itself.

How to read these numbers

Before you change your plans, keep three caveats in mind.

Postings are not hires

A job posting count measures advertised openings, not people hired. Some roles are filled through referrals or internal moves without a public listing, and some postings never lead to a hire. A drop in postings does mean fewer visible openings to apply for, and usually more applicants per opening, but it does not tell you exactly how many people are being hired.

One data set, one market

This is one firm's analysis of US postings using its own role categories. Other trackers count differently, so their totals are not directly comparable. The direction of the change and the shifts between categories are more useful than any single number.

Growth from a small base

AI security engineering more than tripling sounds dramatic, but about 2,400 postings is a small slice of a market of roughly 236,000. It is a real and growing niche, not a replacement for the larger categories that shrank.

What this means for your search

The practical message is not "security is closed". It is that broad, generic security applications are competing for fewer openings, while some specialisms are growing. Here is how to respond.

1. Map your skills to the categories that are growing

Start by being specific about which kind of security work you do or want to do. The NICE Workforce Framework for Cybersecurity, maintained by NIST, breaks the field into work roles with the tasks, knowledge and skills each involves. It is a useful neutral reference for naming what you do in terms employers recognize.

Then compare your profile with where postings are moving:

• GRC. If you have done audit preparation, policy writing, risk assessments, vendor security reviews or compliance work, even as part of a broader IT or security role, make that experience visible. Remember the report says much of the category's growth is attorney roles, so read GRC postings carefully and target the analyst, program and audit roles that match your background.
• AI security. If you have worked on securing machine learning systems, reviewing AI tools before adoption, or assessing how data flows into AI services, say so concretely. This is a small field, so honest, specific evidence matters more than buzzwords.
• Defense and operations. These are still the largest share of postings. If this is your area, the jobs exist, but competition is tighter, so your resume needs to show results rather than a list of tools.

2. If you are a penetration tester, widen the target

With pen-testing postings down by nearly half, applying only to roles with "penetration tester" in the title will shrink your pipeline. Look for adjacent roles that use the same skills: application security, product security, vulnerability management, red-team or adversary-emulation work inside larger security teams, and security engineering roles that value an attacker's view. Rewrite your resume for each target so your offensive experience is framed in that role's terms, for example "found and helped fix" rather than only "exploited". Our guide to identifying transferable skills walks through that reframing.

3. If you are trying to break in, be realistic about the entry point

Fewer postings usually means employers can ask for more experience, which hits entry-level candidates hardest. A few approaches tend to work better than mass-applying to "junior security analyst" listings:

• Enter through an adjacent role. IT support, systems administration, network operations, compliance or audit roles can lead to security work, especially inside an employer that has a security team you can learn from. Our post on changing careers without direct experience covers this route.
• Build evidence, not just credentials. Certifications can help you pass screens, but a write-up of a home lab, a documented risk assessment of a fictional company, or a policy you drafted shows how you think. See how to build a portfolio to change careers.
• Consider the growing GRC side. If you come from audit, legal support, project management or a regulated industry, GRC may be a more open door than technical operations right now.
• Test before you invest. Training can be expensive. Talk to people doing the work first and try a small project. Our guide on testing a career change before you quit gives a structure for this.

4. Tailor every application to the specific role

"Cybersecurity" covers very different jobs. A GRC analyst posting and a detection engineer posting share few requirements. Sending one generic security resume to both wastes your best chance with each. For each application, lead with the experience that matches that role's core tasks, use the posting's own terms for skills you actually have, and cut what does not apply. Our step-by-step guide to tailoring your resume to a job description shows how, and Tailorapply can speed up that per-posting rewrite so tailoring does not limit how many good applications you can send.

5. Show outcomes, not tool lists

Security resumes often read as long lists of tools and frameworks. In a tighter market, the candidates who stand out show what changed because of their work: alerts reduced, an audit passed, a vulnerability backlog cleared, time to respond shortened, a policy adopted. Use numbers only when you can stand behind them. Our guide to writing resume bullets that show impact has a method you can apply to each role.

6. Lean on referrals and direct contact

When public postings drop, a larger share of hiring tends to happen through people. Security has active local meetups, conferences and online communities, and practitioners are often willing to talk. Ask for advice and information first, not jobs. Our guides to asking for a referral and the hidden job market cover how to do this without it feeling transactional.

Questions to ask employers in this market

A slower market is also a reason to check the role is stable before you accept. In interviews, it is reasonable to ask:

• Is this a new position or a backfill, and why is it open now?
• Where does security report, and who owns the budget for this team?
• What would success look like in the first six months?
• How has the team's headcount changed over the past year?

The answers tell you whether the role has backing, which matters more when hiring is tight. Our guide to questions to ask at the end of an interview has more.

A short plan for the next month

• Week 1: Read 20 to 30 current postings in your target area. Note the role categories and the skills that come up most often. Map your experience to them using the NICE Framework terms.
• Week 2: Rewrite your resume into one version per target category, with outcome-based bullets. Update LinkedIn to match your main target.
• Week 3: Contact five to ten practitioners in your target roles for short conversations. Ask what their teams are hiring for.
• Week 4: Apply to a smaller number of well-matched roles with tailored resumes, and track responses so you can see which target is working. Our weekly job-search system can help.

The data describes a tighter, shifting market, not an empty one. Searchers who match their story to where demand is moving, and prove it with specific evidence, are in a much better position than those sending the same resume everywhere.