Blue team jobs report: November 2026
220 new blue team jobs from 67 employers in November 2026 (−55% on the month before). SOC analysts led with 16.
November 2026 isn't over yet, so these numbers grow every day. The full month is ready on the 1st.
November 2026 at a glance
- New jobs
- 220
- −55% vs October 2026
- Employers
- 67
- Remote
- 27.7%
- Entry level
- 1.8%
- Published pay
- 48.6%
SOC analysts
16 new jobs (−81% on October 2026). 25% remote, 12.5% entry level. Median published pay $87,000, with the middle half between $87,000 and $90,000 (4 postings with pay).
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| Security+ | 6 | 37.5% | |
| CISM | 5 | 31.3% | |
| GCIH | 3 | 18.8% | |
| GSEC | 3 | 18.8% | |
| CEH | 2 | 12.5% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| Python | 5 | 31.3% | |
| AWS | 4 | 25% | |
| Elastic Security | 4 | 25% | |
| SIEM | 4 | 25% | |
| Azure | 3 | 18.8% |
Browse open roles: SOC Analyst jobs. Pay detail: SOC Analyst salaries.
DFIR and incident response
10 new jobs (−86% on October 2026). 50% remote, 0% entry level. Median published pay $113,000, with the middle half between $101,000 and $114,000 (3 postings with pay).
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| EDR | 6 | 60% | |
| SIEM | 6 | 60% | |
| AWS | 3 | 30% | |
| Azure | 3 | 30% | |
| Python | 3 | 30% |
Browse open roles: Digital Forensics (DFIR) jobs, Incident Responder jobs. Pay detail: Digital Forensics (DFIR) salaries.
Detection engineering and threat hunting
4 new jobs (−88% on October 2026). 75% remote, 0% entry level. Too few postings published pay to give a figure.
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| EDR | 2 | 50% | |
| MITRE ATT&CK | 2 | 50% | |
| SIEM | 2 | 50% | |
| AWS | 1 | 25% | |
| Azure | 1 | 25% |
Browse open roles: Detection Engineer jobs, Threat Hunter jobs. Pay detail: Detection Engineer salaries.
Threat intelligence (CTI)
6 new jobs (−79% on October 2026). 0% remote, 0% entry level. Too few postings published pay to give a figure.
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| Security+ | 3 | 50% | |
| CISM | 1 | 16.7% | |
| CISSP | 1 | 16.7% | |
| CySA+ | 1 | 16.7% | |
| GCIA | 1 | 16.7% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| MITRE ATT&CK | 4 | 66.7% | |
| EDR | 2 | 33.3% | |
| SIEM | 2 | 33.3% | |
| AWS | 1 | 16.7% | |
| Azure | 1 | 16.7% |
Browse open roles: Threat Intelligence (CTI) Analyst jobs. Pay detail: Threat Intelligence (CTI) Analyst salaries.
Every role
| Role | Jobs | Share | vs October 2026 | Bar |
|---|---|---|---|---|
| Governance, Risk and Compliance (GRC) | 111 | 50.5% | +5450% | |
| Identity and Access Management (IAM) | 38 | 17.3% | +3700% | |
| Security Engineer | 17 | 7.7% | −92% | |
| SOC Analyst | 16 | 7.3% | −81% | |
| Vulnerability Management | 7 | 3.2% | −56% | |
| Cloud Security Engineer | 6 | 2.7% | −73% | |
| Incident Responder | 6 | 2.7% | −88% | |
| Threat Intelligence (CTI) Analyst | 6 | 2.7% | −79% | |
| Security Operations Leadership | 5 | 2.3% | −77% | |
| Digital Forensics (DFIR) | 4 | 1.8% | −79% | |
| Threat Hunter | 3 | 1.4% | −77% | |
| Detection Engineer | 1 | 0.5% | −95% |
Using these numbers
You're welcome to quote or chart this report in a newsletter, article or talk. Please link back to this page. The counts come from jobs first listed on BlueTeamJobs in the month, from employers' own applicant tracking systems and direct posts. Offensive roles such as pentesting aren't included. Pay figures use US postings that published a salary, at the midpoint of each range.
More: all monthly reports, quarterly hiring reports and salary data.