More than half of all cybersecurity job postings still don't say what they pay. Of the 3,033 open security roles at 696 employers we read on 15 November 2026, a little under half state a salary, and 1,223 of them give a range we can compare. Those ranges are the most direct answer there is to "what does this job pay", because they are what the employer itself is offering today, not what someone remembers earning.
Here is what they say, specialty by specialty.
The middle of each specialty's stated pay
| Specialty | Middle of stated pay | Typical range | Postings with a range | Employers |
|---|---|---|---|---|
| Security leadership | $246k | $211k to $400k | 141 | 98 |
| Security engineering | $205k | $172k to $375k | 322 | 149 |
| Application and product security | $205k | $169k to $341k | 139 | 104 |
| Identity and access management | $202k | $173k to $300k | 60 | 50 |
| Security architecture and consulting | $200k | $160k to $309k | 119 | 59 |
| Penetration testing and red team | $194k | $146k to $320k | 68 | 42 |
| Cloud security | $192k | $150k to $312k | 51 | 43 |
| Security operations and incident response | $175k | $140k to $279k | 108 | 78 |
| Threat intelligence and research | $172k | $148k to $248k | 35 | 26 |
| Governance, risk and compliance | $167k | $139k to $295k | 180 | 96 |
"Middle" is the median of the midpoints of the ranges postings state. "Typical" runs from the 25th percentile of those midpoints to the 90th percentile of the ranges' tops, so it covers what most offers in the specialty look like, top end included. Every figure is a full-time year in US dollars; an hourly rate counts as 2,080 hours.
What stands out
Engineering pays more than operations. Security engineers and AppSec engineers sit at a $205k middle, $30k above SOC and incident response ($175k). The jobs that build and fix pay more than the jobs that watch and respond, even inside the same security team.
Leadership is the only specialty above $240k. Its typical range starts at $211k, higher than the middle of every other specialty.
GRC has the lowest middle, but not a low ceiling. Governance, risk and compliance tops out near $295k for its best-paid roles, while its middle ($167k) is the lowest of the ten. It is also the specialty most likely to state its pay: 53% of its postings do.
SOC roles are the least transparent. Only 33% of security operations postings state a range, and architecture and consulting postings are close behind at 35%. If you are job hunting in those areas, a stated range is worth more as a signal, because most employers don't give one.
Pentest pay spreads wide. Penetration testing and red team roles run from $146k to $320k typical, a $174k spread, wider than cloud or IAM.
Where this comes from
These are not surveys. CyberJobs.cc reads the hiring pages of security vendors, cloud and AI companies, banks, defense contractors and software firms every hour, keeps the security roles, and counts the salary ranges their postings state. The full figures are on the salaries page, refreshed with every read, and the open dataset behind them (CC BY 4.0) is on Hugging Face and Kaggle.
If you want the roles themselves rather than the averages, every open posting with its stated pay is at CyberJobs.cc.
