Which security roles' posted pay ranges rose most since 2024?Posted pay rose across security postings, after inflation too.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026. Pay from Ashby and Lever job boards as of 30 September 2026.
Read the full research paperAcross security postings that show pay, US postings in spring 2024 against postings at US-headquartered companies in 2026, the midpoint of the posted range is 27.4% higher, $142k against $181k, or 19.3% after inflation. GRC, privacy and program roles (+29.3%), engineering (+28.1%) and detection, response and offensive roles (+29.5%) each rose, and the gaps between them are not measurable. Each figure comes with a range of likely values, and where that range includes zero we can't tell the change from no change. Architecture is not measurable. Leadership (+21.0%) and managers (+15.4%) show a likely but borderline rise.
The 2026 postings lean more senior than the 2024 ones: senior individual contributors are 50% of 2026 postings with pay against 34% in 2024. With 2024's mix of seniority levels, the rise is smaller: the 2026 median is $175k, +23.3% on 2024. Within each level, entry individual contributors rose +18.7% (likely range +11 to +34) and senior individual contributors +28.7% (+18 to +38).
Inside the 37 companies that posted pay for security roles in both years, the change is not measurable: +12.9%, with a likely range from −1 to +38. The two years were collected in different ways, and only 37 companies posted pay in both. The rise across all postings describes the postings, not what any one employer changed. For paid wages rather than posted ranges, the Bureau of Labor Statistics median for information security analysts rose 3.4% from May 2024 to May 2025.
The answer at a glance
Across all security postings with pay, posted midpoints are 27.4% higher than in spring 2024, 19.3% after inflation
Within the 37 companies that posted pay in both years, the change in posted midpoints is not measurable: +12.9% (−1 to +38)
GRC, privacy and program roles rose +29.3%
Engineering rose +28.1% and detection, response and offensive roles +29.5%
No family measurably rose more than another
Architecture is not measurable. Leadership and managers show a likely but borderline rise
Individual contributors rose +29.9%
The numbers
Midpoint means the middle of the posted base-pay range, annualised. Hourly pay counts 2,080 hours a year.
| Role family | Postings, 2024 → 2026 | Median midpoint, 2024 | Median midpoint, 2026 | Change | Likely range (95%) | After inflation |
|---|---|---|---|---|---|---|
| All security | 395 → 2,194 | $142k | $181k | +27.4% | +19 to +36 | +19.3% |
| GRC, privacy and programs | 86 → 281 | $135k | $175k | +29.3% | +16 to +47 | +21.0% |
| Engineering | 183 → 1,329 | $146k | $187k | +28.1% | +19 to +41 | +19.9% |
| Detection, response and offensive | 83 → 410 | $128k | $165k | +29.5% | +17 to +45 | +21.2% |
| Architecture | 19 → 105 | $182k | $182k | −0.1% | −7 to +24 | −6.5% |
| Leadership | 24 → 69 | $183k | $222k | +21.0% | +2 to +47 | +13.3% |
| Individual contributors | 336 → 1,913 | $137k | $177k | +29.9% | +22 to +39 | +21.6% |
| Managers | 36 → 159 | $170k | $196k | +15.4% | +3 to +42 | +8.0% |
| Executives | 23 → 122 | $193k | $233k | +21.0% | +2 to +47 | +13.3% |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | ||||||
Source: AKA Security analysis. 2024: US postings from a public LinkedIn dataset (5 to 19 April 2024). 2026: postings at US-headquartered companies in AKA's job-board data. Staffing firms removed in both years. Likely ranges (95%) are found by redrawing the set of companies many times and recomputing each figure. Inflation uses the Consumer Price Index for All Urban Consumers (CPI-U), April 2024 (313.548) to August 2026 (334.980). A change in bold is a clear rise. Leadership, managers and executives show a likely but borderline rise, and architecture is not measurable.
| Title level, postings with pay | 2024 | 2026 |
|---|---|---|
| Entry individual contributor | 51% | 37% |
| Senior individual contributor | 34% | 50% |
| Manager | 9% | 7% |
| Executive | 6% | 6% |
Source: AKA Security analysis, same postings. With 2024's mix of seniority levels, the 2026 median midpoint is $175k, +23.3% on 2024 rather than +27.4%. Entry individual contributors rose +18.7% (+11 to +34) and senior individual contributors +28.7% (+18 to +38).
The posted range also widened. The median gap between the top and bottom of a range was $40k in 2024 and $68k in 2026, +68.8% (+35 to +105).
No family measurably led
On the central figures, GRC, privacy and programs rose more than engineering, and detection, response and offensive rose most of all. None of the gaps between families is clear: each is too small to tell apart from no difference.
| Family against family | Gap in change, points | Likely range (95%) |
|---|---|---|
| GRC, privacy and programs against engineering | +1.2 | −18 to +20 |
| GRC, privacy and programs against detection, response and offensive | −0.2 | −20 to +20 |
| Engineering against detection, response and offensive | −1.4 | −19 to +16 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | ||
Source: AKA Security analysis. Likely ranges (95%) are found by redrawing each family's companies many times.
The families pool these specialties. Engineering: general security engineer, AppSec / product, infra / network, cloud security, IAM and AI security. Detection, response and offensive: detection & response, threat intel, vuln management, offensive and general security analyst. GRC, privacy and programs: GRC, privacy and program / project. Architecture and leadership stand alone.
By specialty
| Specialty | Postings, 2024 → 2026 | Change | Likely range (95%) | Thin in 2024 |
|---|---|---|---|---|
| Privacy | 6 → 58 | +42.6% | +20 to +72 | Yes |
| IAM | 18 → 73 | +36.6% | +16 to +65 | Yes |
| GRC | 69 → 169 | +26.1% | +13 to +44 | |
| General security engineer | 93 → 398 | +23.8% | +11 to +38 | |
| Offensive | 10 → 70 | +19.2% | −9 to +58 | Yes |
| Infra / network | 23 → 214 | +34.9% | +18 to +48 | Yes |
| Program / project | 11 → 54 | +24.5% | +10 to +72 | Yes |
| Cloud security | 8 → 72 | +15.6% | +6 to +93 | Yes |
| Detection & response | 28 → 222 | +23.8% | +15 to +43 | Yes |
| General security analyst | 30 → 60 | +28.2% | +0 to +58 | |
| AppSec / product | 39 → 411 | +15.3% | +2 to +40 | |
| Vuln management | 9 → 30 | +1.2% | −14 to +53 | Yes |
| Architecture | 19 → 105 | −0.1% | −7 to +24 | Yes |
| Threat intel | 6 → 28 | +10.6% | −17 to +39 | Yes |
| AI security | 2 → 161 | Not answerable | Yes | |
| General security leadership | 24 → 69 | +21.0% | +2 to +47 | Yes |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | ||||
Source: AKA Security analysis, same populations as above. Thin means fewer than 30 postings or 10 companies with pay in that year. A change whose likely range includes zero is not measurable. General security analyst (+0 to +58) is a likely but borderline rise.
Inside the same companies
74 companies had security postings in both years. 37 of them posted pay in both. Their 61 postings in 2024 and 382 in 2026 moved +12.9%, with a likely range from −1 to +38. No family shows a clear change there: engineering +11.3% (−2 to +44), detection, response and offensive +31.8% (−7 to +57), GRC, privacy and programs +13.5% (−4 to +57).
Two explanations fit that range. Posted ranges at these companies may have moved little while the rise came from which companies post pay. Or the 37 companies are too few to show a rise of the size seen across all postings. The data cannot separate the two.
Paid wages for comparison
The Bureau of Labor Statistics survey of employers (Occupational Employment and Wage Statistics) reports what information security analysts are paid, not what postings offer.
| Information security analysts, US | May 2024 | May 2025 | Change |
|---|---|---|---|
| Median annual wage | $124,910 | $129,180 | +3.4% |
| Mean annual wage | $127,730 | $132,510 | +3.7% |
Source: Bureau of Labor Statistics, Occupational Employment and Wage Statistics, national estimates for occupation 15-1212. May 2025 is the latest release. No 2026 figure exists yet.
The survey covers one year of the two and a half between the posting samples, and one occupation code that includes many analyst roles and few engineers or leaders.
The question as asked
Which cybersecurity roles are seeing the largest increases in salary ranges
Asked by Ross Young
Where the data comes from
The 2024 postings come from the LinkedIn Job Postings dataset (Hugging Face datastax/linkedin_job_listings): postings located in the US and listed between 5 and 19 April 2024. 1,038 postings are in scope and 872 remain after removing staffing firms. 305 carry pay in LinkedIn's structured fields. 90 more state a range only in the description, and a parser (a program that pulls the pay range out of the posting text) read those.
The 2026 postings come from AKA's daily read of company job boards: 4,587 security postings at US-headquartered companies, 4,442 after removing staffing firms. Both years go through one set of rules: the series' security title rules, a local model's read of whether each posting is a security role, and one posting per company and title. Job aggregators, which repost other employers' openings, are left out in both years, and the 2026 postings are those still open on or after 23 September 2026.
The same parser read the pay range from each description. For Ashby and Lever boards, which publish pay in a separate field, AKA read the field from each board on 30 September for postings still open. That added pay for 246 postings that state none in their text. Where a posting lists several ranges by location, the highest counts. Counting the lowest instead gives +25.6%.
The two years read pay differently. In 2024, 305 of the 395 ranges come from structured posting fields. In 2026, pay comes from posting text for 1,948 postings and from the board field for 246. Within the 37 companies that posted pay in both years, the change is +12.9% (−1 to +38).
An AI model read 300 of the 2026 postings blind and extracted the pay itself. The parser agreed on whether pay was posted with 99.0% precision and 97.5% recall, and on the range within 2% for 194 of 198 postings. Of the postings it said showed pay, 99.0% did, and it found 97.5% of those that showed pay.
The share of eligible postings showing pay was 46% in 2024 and 50% in 2026 (likely range −2.1 to +10.0 percentage points, too small to tell apart from no change). Without the Ashby and Lever field, the 2026 share is 44%.
No causal claim follows. A posted range is what a company advertises for an opening, not what a hire is paid.
How this answer was stress-tested
| Test | What it found |
|---|---|
| Same companies. The 37 companies with pay in both years. | +12.9% (−1 to +38). No clear change. A finding of a rise whose same-companies check shows no clear change is kept at Medium. |
| Outside technology companies. | +18.8% (+12 to +26). |
| Postings of similar length. | +29.2% (+17 to +46). |
| Each company weighted once. | +31.8% (+26 to +40). |
| Largest contributing company removed. | +28.7% (+20 to +37). |
| 2024 structured pay only, without the parsed descriptions. | +28.9% (+20 to +37). |
| Lowest range for 2026 postings that list several. | +25.6% (+17 to +33). |
| Without the Ashby and Lever pay field. | +25.1% (+17 to +34). |
| 2024 postings where people applied through the company's own site. | +18.1% (+6 to +36). |
| 2026 reweighted to 2024's mix of seniority levels. | +23.3%. |
| Parser against a blind AI model read, 300 postings. | 99.0% precision, 97.5% recall, 194 of 198 ranges within 2%. |
The same checks by family:
| Check | GRC, privacy and programs | Engineering | Detection, response and offensive | Individual contributors |
|---|---|---|---|---|
| Headline | +29.3% (+16 to +47) | +28.1% (+19 to +41) | +29.5% (+17 to +45) | +29.9% (+22 to +39) |
| Same companies | +13.5% (−4 to +57) | +11.3% (−2 to +44) | +31.8% (−7 to +57) | +18.1% (−0 to +38) |
| Outside technology companies | +20.1% (+9 to +37) | +16.8% (+10 to +29) | +26.5% (+12 to +41) | +20.9% (+14 to +28) |
| Postings of similar length | +25.9% (+9 to +72) | +33.8% (+16 to +48) | +35.6% (+18 to +69) | +34.1% (+20 to +49) |
| Each company weighted once | +30.8% (+17 to +48) | +33.5% (+22 to +42) | +33.3% (+20 to +52) | +33.7% (+28 to +44) |
| Largest contributing company removed | +27.2% (+15 to +44) | +27.4% (+19 to +40) | +29.4% (+16 to +44) | +30.0% (+22 to +39) |
| 2024 structured pay only | +29.4% (+17 to +53) | +29.5% (+18 to +42) | +32.1% (+20 to +50) | +31.1% (+23 to +40) |
| Lowest range, 2026 | +26.9% (+15 to +43) | +25.5% (+17 to +38) | +29.4% (+16 to +44) | +28.3% (+20 to +37) |
| Without the Ashby and Lever pay field | +29.3% (+16 to +45) | +25.7% (+17 to +38) | +29.4% (+17 to +44) | +28.2% (+20 to +36) |
| 2024 postings through the company site | +14.3% (−1 to +40) | +10.5% (−2 to +38) | +39.3% (+10 to +76) | +20.2% (+7 to +41) |
Source: AKA Security analysis, likely ranges (95%) from redrawing companies. Individual contributors at the same companies (−0 to +38) show a likely but borderline rise. Engineering and GRC, privacy and programs through the company site, and the three families at the same companies, show no clear change.
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| More companies with pay in both years | Whether the rise holds within the same employers | 37 companies is what the two samples share. The number grows as more 2026 boards publish pay. |
| H-1B wage filings, fiscal 2024 to 2026 | A single-source series by title and employer across all three years | A different measure (wages filed for sponsored hires), and a separate analysis. Planned for the next release. |
| A 2026 LinkedIn sample | Removes the difference in collection method | No public 2026 LinkedIn dataset exists. |
| Pay from every board, for every posting | Pay for Ashby and Lever postings that closed before 30 September | Collection now keeps the field. The August and September postings that closed cannot be read again. |
| Paid wages for 2026 | Whether paid wages for information security analysts rose over the same period as posted ranges | The next Bureau of Labor Statistics release covers May 2026 and is due in spring 2027. |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- Posted pay midpoints rose 27.4%, or 19.3% after inflation. The early-access draft said 21.7% and 13.9%.
- Which security roles had the largest rise in posted pay ranges, spring 2024 to 2026? Figures as of 1 October 2026, with pay from Ashby and Lever job boards as of 30 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued