Blue team hiring report: Q4 2026
Defensive security hiring from Oct 1, 2026 to Dec 31, 2026, from every SOC, incident response, detection and security engineering job BlueTeamJobs listed in the quarter.
Preview: this quarter's numbers are still coming in. The final report is published after the quarter ends.
Q4 2026 at a glance
- New blue team jobs
- 710
- Employers hiring
- 116
- Fully remote
- 29.7%
- Published pay
- 45.6%
Security Engineer was the most posted role, with 32.5% of new jobs. The median published salary across all roles was $164,000.
| Role | Jobs | Share | Remote | Median pay |
|---|---|---|---|---|
| Security Engineer | 231 | 32.5% | 26.4% | $174,000 |
| Governance, Risk and Compliance (GRC) | 113 | 15.9% | 19.5% | $164,000 |
| SOC Analyst | 99 | 13.9% | 30.3% | $105,000 |
| Incident Responder | 56 | 7.9% | 42.9% | $142,000 |
| Identity and Access Management (IAM) | 39 | 5.5% | 35.9% | $168,000 |
| Threat Intelligence (CTI) Analyst | 34 | 4.8% | 26.5% | $161,000 |
| Cloud Security Engineer | 28 | 3.9% | 28.6% | $171,000 |
| Security Operations Leadership | 27 | 3.8% | 29.6% | $230,000 |
| Digital Forensics (DFIR) | 23 | 3.2% | 69.6% | $140,000 |
| Vulnerability Management | 23 | 3.2% | 39.1% | $151,000 |
| Detection Engineer | 21 | 3% | 28.6% | $197,000 |
| Threat Hunter | 16 | 2.3% | 25% | $164,000 |
| Month | Jobs | Bar |
|---|---|---|
| October | 490 | |
| November | 220 | |
| December | 0 |
| Level | Jobs | Share | Bar |
|---|---|---|---|
| Mid level | 338 | 47.6% | |
| Senior | 233 | 32.8% | |
| Lead / manager | 111 | 15.6% | |
| Entry level | 28 | 3.9% |
| Arrangement | Jobs | Share | Bar |
|---|---|---|---|
| On-site | 415 | 58.5% | |
| Remote | 211 | 29.7% | |
| Hybrid | 84 | 11.8% |
| Clearance | Jobs | Share | Bar |
|---|---|---|---|
| None | 484 | 68.2% | |
| TS/SCI | 99 | 13.9% | |
| Top Secret | 58 | 8.2% | |
| Secret | 47 | 6.6% | |
| Public Trust | 22 | 3.1% |
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| CISSP | 180 | 25.4% | |
| Security+ | 120 | 16.9% | |
| CISM | 93 | 13.1% | |
| GCIH | 78 | 11% | |
| CySA+ | 50 | 7% | |
| GCFA | 49 | 6.9% | |
| CCSP | 47 | 6.6% | |
| SecurityX (CASP+) | 41 | 5.8% | |
| CEH | 40 | 5.6% | |
| GSEC | 36 | 5.1% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| AWS | 251 | 35.4% | |
| Python | 248 | 34.9% | |
| SIEM | 231 | 32.5% | |
| Azure | 188 | 26.5% | |
| GCP | 133 | 18.7% | |
| EDR | 117 | 16.5% | |
| PowerShell | 108 | 15.2% | |
| MITRE ATT&CK | 102 | 14.4% | |
| Splunk | 96 | 13.5% | |
| SOAR | 85 | 12% |
| State | Jobs | Share | Bar |
|---|---|---|---|
| Virginia | 102 | 14.4% | |
| California | 70 | 9.9% | |
| District of Columbia | 33 | 4.6% | |
| Maryland | 32 | 4.5% | |
| New York | 30 | 4.2% | |
| Texas | 24 | 3.4% | |
| Ohio | 17 | 2.4% | |
| Washington | 13 | 1.8% | |
| Colorado | 10 | 1.4% | |
| Florida | 9 | 1.3% |
| Employer | Jobs | Share | Bar |
|---|---|---|---|
| Accenture Federal Services | 53 | 7.5% | |
| GuidePoint Security | 33 | 4.6% | |
| Agile Defense | 32 | 4.5% | |
| Anthropic | 22 | 3.1% | |
| Palantir Technologies | 17 | 2.4% | |
| Cyderes | 16 | 2.3% | |
| UltraViolet Cyber | 16 | 2.3% | |
| xAI | 16 | 2.3% | |
| Dark Wolf Solutions | 15 | 2.1% | |
| Electrosoft | 15 | 2.1% |
| Level | Median | Middle half | Jobs | Range |
|---|---|---|---|---|
| Entry level | $73,000 | $47,000 – $93,000 | 14 | |
| Mid level | $145,000 | $125,000 – $173,000 | 142 | |
| Senior | $172,000 | $148,000 – $204,000 | 117 | |
| Lead / manager | $206,000 | $172,000 – $271,000 | 51 |
Method
Every defensive security job BlueTeamJobs first listed during the quarter, from employers' applicant tracking systems and from moderated employer posts. Reposts of the same job count once; offensive and non-security roles are never listed. Pay uses the midpoint of each published US dollar range, converted to a full-time year. Certification and skill shares count jobs that mention them.