What do companies expect of entry-level security hires?Entry postings mention python and AI tool use more often than in 2024.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
Read the full research paperPython, AI tool use and fewer certifications. In this piece, an entry posting is one that accepts 0 to 2 years of experience. In spring 2024, 22.7% of 141 US entry-level security postings mentioned Python. In fall 2026, 46.6% of 431 entry postings at US-headquartered companies did.
The expectation that the hire uses AI tools in their own work went from 0.7% of those entry postings in 2024 to 20.4% in 2026. Mentions of CISSP and Security+ fell over the same period.
Entry postings are also a smaller share of the market. Of US security postings that state years of experience, 18.3% accepted 0 to 2 years in spring 2024, against 13.6% in fall 2026.
These findings compare two sources: a public dataset of US postings from spring 2024, and AKA's read of company job boards in 2026. They apply best to US-headquartered companies on modern job boards, which lean toward technology, and less to government, staffing and managed-security firms.
The answer at a glance
Entry postings (0 to 2 years) mentioning Python went from 22.7% to 46.6%. Those expecting the hire to use AI tools went from 0.7% to 20.4%.
Entry postings mentioning CISSP fell from 22.0% to 12.3%. Those mentioning Security+ fell from 22.7% to 11.1%.
Entry level postings are more likely to require a degree (36.2%) than postings asking three years or more (18.8%).
Entry level postings, accepting 0 to 2 years of experience, fell from 18.3% to 13.6% of security postings that state years.
In 2026, security operations postings are open to 0 to 2 years of experience more often than development or advisory postings.
Whether that degree gap between entry and experienced postings changed since 2024 is too close to call.
The numbers
Shares of entry postings unless stated. Mentions count any mention in the description, not only a requirement.
| Measure | 2024 | 2026 | Range of likely values, points |
|---|---|---|---|
| Mentions Python | 22.7% | 46.6% | +13.4 to +34.4 |
| Expected to use AI tools in own work | 0.7% | 20.4% | +12.8 to +28.3 |
| Mentions CTF, bug bounty, home lab or personal projects | 0.7% | 8.4% | +4.6 to +11.0 |
| Mentions cloud platforms | 25.5% | 29.5% | −6.0 to +14.0 |
| Mentions SIEM | 24.1% | 23.2% | −10.0 to +8.3 |
| Mentions CISSP | 22.0% | 12.3% | −17.9 to −1.6 |
| Mentions Security+ | 22.7% | 11.1% | −20.1 to −3.3 |
| Firmly requires a degree | 32.4% | 36.2% | −8.3 to +15.9 |
| Share of postings stating years that accept 0 to 2 years | 18.3% | 13.6% | −8.5 to −1.0 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | |||
Source: AKA Security analysis of 1,038 US security postings from a public job-postings dataset (listed 5 to 19 April 2024) and 4,587 postings at US-headquartered companies in AKA's job-board data (open on or after 23 September 2026). Entry postings: 141 from 122 companies in 2024, 431 from 200 companies in 2026.
What entry postings ask for now
Python and AI tool use
In US entry-level security postings, the share mentioning Python went from 22.7% in spring 2024 to 46.6% in fall 2026. That is about twice as often. The range of likely values is +13.4 to +34.4 points.
The share of entry postings expecting the hire to use AI tools in their own work went from 0.7% in 2024 to 20.4% in 2026. That is about one entry posting in five. Each of the three AI models alone puts the 2026 share between 18% and 23%. The 2024 figure rests on 141 entry postings.
Among 2026 postings asking three years or more, 21.1% expected AI tool use.
Fewer certification mentions
The share of US entry postings mentioning CISSP fell from 22.0% in spring 2024 to 12.3% in fall 2026, a relative fall of 44%. The share mentioning Security+ fell from 22.7% to 11.1%, a relative fall of 51%. Both ranges clear zero.
Visible work
Entry postings mentioning CTF, bug bounty, home lab or personal projects went from 0.7% in spring 2024 to 8.4% in fall 2026. The range of likely values is +4.6 to +11.0 points. This measure carries no rating.
Mentions of cloud platforms and SIEM in entry postings show no clear change.
Degree requirements
In fall 2026, 36.2% of entry postings at US-headquartered companies firmly required a degree, with no alternative. Among postings asking three years or more, 18.8% did. The range of likely values for that gap is +8 to +27 points, and the gap is clear under each of the three AI models on its own.
Firm degree requirements fell across all US security postings, from 23.0% in 2024 to 15.8% in 2026. Among entry postings, the change, 32.4% to 36.2%, is too close to call.
In 2024 the gap between entry and three-year postings was 32.4% against 25.3%, which is not a clear gap. The change in the gap from 2024 to 2026 is +10.3 points, with a range of −2 to +23. That change is too close to call.
A smaller share of postings accepts two years or less
The share in both years
Of US security postings that state years of experience, 18.3% accepted 0 to 2 years in spring 2024. At US-headquartered companies in fall 2026, 13.6% did. The range of likely values is −8.5 to −1.0 points.
At the other end, postings asking eight years or more rose from 18.6% to 26.7% of those stating years. The range is +4.2 to +11.8 points.
The finding is rated Medium. At the 74 companies with postings in both years, the entry share went from 20.8% to 13.3%, and that range, −16.7 to +1.2 points, includes zero.
Within specialties, a change is too close to call
| Specialty | 2024 | 2026 | Range of likely values, points |
|---|---|---|---|
| General security engineer and analyst | 24.4% | 18.3% | −12.9 to +0.7 |
| Detection and response | 28.6% | 15.6% | −27.3 to +0.5 |
| Application security | 20.7% | 12.7% | −21.2 to +3.3 |
| GRC | 18.3% | 16.1% | −12.6 to +9.6 |
| Infrastructure security | 7.1% | 14.1% | −4.9 to +20.1 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | |||
Source: AKA Security analysis of US security postings that state years of experience: 769 from 522 companies (April 2024) and 3,173 from 676 US-headquartered companies (fall 2026).
Every specialty range includes zero. At 2026's mix of specialties, the 2024 entry share would be 17.0%, against 18.3% actual.
Security operations accepts entry candidates most often
In fall 2026, 24.1% of security operations postings that state years accepted 0 to 2 years. The share was 10.4% for development postings and 10.1% for advisory postings. These groups come from the job board's role-family tag, a different classification from the title specialty above.
Security operations is 14% of all tagged 2026 postings but 26% of tagged entry postings. Its lead over development ranges from 7 to 22 points, and over advisory from 3 to 25 points. Against offensive security, privacy and GRC, the lead is too close to call.
Among 2026 entry postings at US-headquartered companies, 13.7% carry an entry marker in the title, such as junior, associate, new grad, "I" or tier 1.
The question as asked
What expectations do companies have of entry level personnel? Can we uncover anything useful as advice people who want to enter the industry or those still early in their career journey?
Asked by Lenny Zeltser
Where the data comes from
The 2024 postings come from a public job-postings dataset: 1,038 US-located security postings listed 5 to 19 April 2024. The 2026 postings come from AKA's daily read of 2,194 company job boards on 16 applicant tracking systems: 4,587 security postings at 831 US-headquartered companies, any job location, open on or after 23 September 2026. Collection began on 31 July 2026.
Both years use the same security title rules. A local model rules whether each posting is a security role, one posting is kept per company and title, and job aggregators are left out. 2024 is US by job location and 2026 is US by company headquarters, so the comparison mixes change over time with differences in source, location and season. The ranges allow for chance in which postings were collected, not for those differences.
Three AI models each read every posting for minimum years of experience and degree requirement. The answer at least two agree on is used. A posting is entry when at least two put the minimum at 0 to 2 years. Postings where no two agree on the degree are left out of degree shares. Skills and certifications are keyword matches. AI tool use is read by the three models.
Until the evening of 21 September 2026, the collector skipped titles containing analyst, auditor, consultant, CISO, director, head of, specialist and "manager, security". The 2026 side is limited to postings open on or after 23 September 2026.
In 2024, 74.1% of postings stated years of experience, against 69.2% in 2026. Each range of likely values is the 95% range for the change, found by resampling whole companies rather than single postings. Postings state what a company says it wants. They are not headcount, and not proof of hiring.
How this answer was stress-tested
The main result is a fall in the entry share from 18.3% to 13.6%, with a range of −8.5 to −1.0 points.
| Test | What it found |
|---|---|
| Hosted model A on both years. All 5,625 postings. | 19.1% to 13.7%, range −9.2 to −1.8. Same direction, larger by 0.7 points. |
| Hosted model B on both years. | 17.8% to 13.4%, range −8.1 to −0.7. Same direction, smaller by 0.3 points, and likely but borderline. |
| Local model on both years. | 22.0% to 15.2%, range −10.5 to −3.1. Same direction, larger by 2.1 points. |
| Same companies. The 74 companies with postings in both years. | 20.8% to 13.3%, range −16.7 to +1.2. Same direction, but too close to call. |
| Postings of similar length. 3,000 to 6,000 characters in both years. | 22.3% to 15.7%, range −12.0 to −1.3. Same direction, larger by 1.9 points. |
| New postings only. 2026 postings first published in the 30 days before the figures date. | 16.0% in 2026 against 18.3% in 2024. Same direction, smaller by 2.4 points. |
| 2024 at 2026's specialty mix. | 17.0% in 2024 against 13.6% in 2026. Same direction, smaller by 1.3 points. |
| Agreement on experience band. | 0.98 between the two hosted models, and 0.91 between the local model and each hosted model. |
| Degree gap under each model. | The 2026 gap between entry and three-year postings is clear of zero under each of the three models. |
| Local model's recall of firm degree requirements. | It caught 74% of the firm degree requirements both hosted models found. Alone, it puts 2026 entry postings requiring a degree at 25%, against 36% by the three-model answer. |
| Agreement on degree. | 0.97 between the hosted models, and 0.79 and 0.78 between the local model and each hosted model. |
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| Government, managed-security and staffing postings | The segments the company list under-covers | |
| A second 2026 sample collected the way the 2024 one was | Separates the source difference between the two sets from change over time | |
| Postings data spanning more years | Year-by-year entry shares | |
| A later re-read | A direct trend under the 2026 collection method | |
| Hires, not postings | Headcount, which postings do not measure: they state what a company says it wants |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- Rewritten from the 1 October facts with a new title, description and glance rows. No answer reversed.
- The degree shares now leave out postings where the readers split on the degree, as the piece's own rule says. Each share moved by half a point or less.
- What do companies expect of entry-level security hires? Figures as of 1 October 2026, one test 23 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued