How does security hiring differ by company size and industry?Startups firmly require degrees about 60% as often.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
Read the full research paperSecurity postings ask for different things at different company sizes. Each figure comes with a range of likely values, and where that range includes zero we can't tell a gap from no gap. Startups list a degree as a firm requirement about 60% as often as enterprises, a likely but borderline gap. They name the CISSP less often, ask for eight or more years of experience less often and carry a lower share of management titles. They ask the hire to secure AI more often. The overall share of postings with some AI expectation runs from 27% to 35% across sizes and is higher at startups, a likely but borderline gap. Among technology companies, startups and enterprises show no measurable difference on degrees or the CISSP.
Industry draws sharper lines. AI infrastructure and enterprise software have the highest AI shares in the table (45% and 45%), but their lead over the next industry is too small to tell apart from no difference. They split the AI ask: AI infrastructure postings ask hires to secure AI, enterprise software postings ask them to use it. Defense and government postings lead on clearances. Their AI share is 8%, and its gap with the next industry is a clear one. Healthcare has the highest CISSP share in the table (38%), but its lead over staffing and consulting is too small to tell apart from no difference.
The answer at a glance
Startups list a degree as a firm requirement about 60% as often as enterprises, a likely but borderline gap
Startups name the CISSP less often
Startups ask the hire to secure AI more often. Their overall AI share is higher, a likely but borderline gap
Startup postings carry a lower share of management titles
The median asks for five years at every size. Startups ask for eight or more years less often
AI infrastructure and enterprise software have the highest AI shares. Defense leads on clearances. Healthcare has the highest CISSP share
The numbers by company size
Share of security postings, all headquarters countries.
| Enterprise | Mid-market | Startup | |
|---|---|---|---|
| Postings (companies) | 4,468 (578) | 1,068 (336) | 910 (314) |
| Degree a firm requirement | 16% | 12% | 10% |
| Names the CISSP | 27% | 26% | 18% |
| Management titles | 16% | 12% | 9% |
| Any AI expectation | 29% | 27% | 35% |
| Asks the hire to secure AI | 14% | 13% | 22% |
| Asks the hire to use AI tools | 15% | 14% | 12% |
| Asks for Python | 36% | 35% | 37% |
| Median years required | 5 | 5 | 5 |
| Eight or more years required, of postings stating years | 27% | 20% | 18% |
Source: AKA Security analysis of 8,391 security postings at 2,249 companies in AKA's job-board data, 1 October 2026. 6,446 postings carry a size tag.
Startup postings ask for fewer degrees, CISSPs and years
Degrees
10.0% of startup postings list a degree as a firm requirement, against 16.3% at enterprises, about 60% as often. The gap is −6.3 percentage points, with a range of likely values from −11.1 to −0.6, so it is likely but borderline. Counting each company once, the rates are 7.1% and 16.1%. Two further AI models, reading the 3,842 US postings at startups and enterprises, put the gap wider: −7.6 points, likely but borderline, and −8.2 points, a clear gap. On the same US postings the local model that labelled every posting puts the gap at −5.1 points, too small to tell apart from no gap, and marks fewer firm requirements than they do (13.5% against 16.6% and 16.9%).
The gap comes from outside technology companies. In AI infrastructure, enterprise software, cloud and developer tools and cybersecurity vendors, 11.5% of startup postings and 10.9% of enterprise postings list a degree as a firm requirement. In every other industry the rates are 7.2% and 18.3% (−11.1 points, likely range −15.8 to −5.8).
Certifications
The CISSP appears in 18.2% of startup postings and 27.5% of enterprise postings (−9.2 points, likely range −13.9 to −4.5). Within the four technology industries the rates are 17.1% and 16.7%.
Experience
The median posting asks for five years at every size. The upper end differs. Of postings that state a figure, 26.7% at enterprises ask for eight or more years, against 20.2% at mid-market companies and 18.5% at startups (startup minus enterprise −8.3 points, likely range −12.6 to −3.9). The two further models, on US postings, put the startup and enterprise shares at 20.0% and 19.9% against 28.6% and 28.5%. Outside management titles the gap is −6.6 points (likely range −11.0 to −2.2).
Startup postings ask the hire to secure AI more often
22.4% of startup postings ask the hire to secure AI systems, against 13.5% at enterprises (+8.9 points, likely range +4.0 to +14.3). On US postings the two further models agree: +10.1 points (likely range +4.4 to +16.4) and +9.7 points (likely range +4.5 to +15.4), and the local model gives +10.2 points (likely range +4.9 to +16.0). Within the four technology industries the gap is +3.3 points (likely range −2.4 to +9.5), too small to tell apart from no gap. A founding security engineer posting at Withpace lists the work as "application and infrastructure security, enterprise security and GRC, incident response, and an emerging category we care deeply about: designing secure AI and agentic systems."
The overall share of postings with any AI expectation is 35.3% at startups and 29.5% at enterprises, a gap of +5.8 points (likely range −0.0 to +12.0), likely but borderline. On US postings the gap is clear under one of the further models and borderline under the other and under the local model. At mid-market companies the share is 27.4%. Mid-market minus enterprise is −2.0 points (likely range −7.0 to +3.1), no clear gap, and startup minus mid-market is +7.8 points (likely range +1.1 to +14.6), a clear gap. Asks to use AI tools appear in 14.8% of enterprise postings and 12.4% of startup postings.
Startup postings carry a lower share of management titles
Manager and executive titles make up 15.9% of enterprise postings, 11.9% at mid-market companies and 8.9% at startups (startup minus enterprise −7.1 points, likely range −10.2 to −3.9). Counting each company once, the rates are 13.6% and 5.9%. The series' level rule, which reads titles differently, gives 13.5%, 10.1% and 7.7% (−5.8 points, likely range −8.6 to −2.7).
The numbers by industry
Industries with at least 100 postings, ranked by share with any AI expectation.
| Industry | Postings (companies) | Any AI | Secure AI | Use AI tools | Degree required | CISSP | Python | Clearance |
|---|---|---|---|---|---|---|---|---|
| AI infrastructure and ML | 386 (71) | 45% | 26% | 17% | 8% | 12% | 44% | 5% |
| Enterprise software | 541 (157) | 45% | 21% | 26% | 8% | 23% | 45% | 8% |
| Media and entertainment | 162 (42) | 36% | 15% | 22% | 10% | 28% | 48% | 1% |
| Cloud infrastructure and developer tools | 260 (31) | 35% | 16% | 15% | 8% | 14% | 43% | 5% |
| Consumer | 142 (30) | 35% | 15% | 21% | 4% | 27% | 34% | 0% |
| Fintech | 1,258 (185) | 32% | 14% | 17% | 15% | 29% | 37% | 1% |
| Cybersecurity vendors | 1,182 (235) | 31% | 14% | 16% | 14% | 18% | 39% | 11% |
| Retail and e-commerce | 263 (44) | 30% | 16% | 14% | 11% | 31% | 43% | 0% |
| Healthcare | 366 (89) | 23% | 13% | 9% | 21% | 38% | 27% | 2% |
| Industrial and manufacturing | 464 (63) | 20% | 10% | 8% | 26% | 26% | 30% | 7% |
| Staffing and consulting | 462 (98) | 18% | 11% | 8% | 17% | 35% | 21% | 31% |
| Defense and government | 416 (37) | 8% | 5% | 2% | 22% | 32% | 22% | 61% |
Source: AKA Security analysis of security postings in AKA's job-board data, 1 October 2026. These twelve industries cover 5,902 postings.
Three industry signatures
AI infrastructure and enterprise software carry the highest AI shares
AI infrastructure and ML companies carry an AI expectation in 45% of security postings, level with enterprise software at the top of the table. The gap between them (+0.1 points) is too small to tell apart from no gap. They ask the hire to secure AI in 26% (likely range 20% to 33% across 71 companies). Enterprise software companies are at 45%, with a different mix: 26% ask the hire to use AI tools, the highest share in the table, and 21% ask them to secure AI. Against media and entertainment, next at 36%, the two lead by 9.4 points, and enterprise software's AI-tools share leads the next industry by 4.1 points. Neither lead is clear. The two industries list a degree as a firm requirement in 8% and 8% of postings.
Defense postings lead on clearances
61% of defense and government security postings require a clearance (likely range 38% to 85% across 37 companies). A General Dynamics Information Technology posting for a Cyber Security Analyst states it plainly: "Security Clearance Level: Active TS/SCI required." AI appears in 8% of defense postings, against 18% at the next industry up, staffing and consulting. That gap (10.5 points) is a clear one. Staffing and consulting firms are second on clearances at 31%, and defense's 30.3-point lead over them is also clear.
Healthcare has the highest CISSP share
38% of healthcare security postings name the CISSP (likely range 31% to 45% across 89 companies), the highest share in the table, against 35% in staffing and consulting, a 3.3-point gap too small to tell apart from no gap, and 12% in AI infrastructure. Industrial and manufacturing companies list a degree as a firm requirement in 26% of postings, the highest share in the table, against 22% in defense and government, a 4.2-point gap that is also too small to call.
The question as asked
How do hiring demands and role expectations differ across company size and industry segments?
Asked by Lenny Zeltser
Where the data comes from
The postings come from AKA's daily read of company job boards: 8,391 security postings at 2,249 companies, collected since 31 July 2026 and read on 1 October, limited to postings open on or after 23 September 2026. Job aggregators, which repost other employers' jobs, are left out. Each posting is counted once, using the series' rule for which job titles count as security. The method page gives a larger total, 15,163, because it counts every version of a posting and uses a wider definition. Unlike the specialties piece in this series, this is a snapshot of one period with no earlier year to compare against, and it covers every headquarters country.
Company size and industry are AKA's own tags, assigned per company by a model and not drawn from an outside database of company data. 77% of postings carry a size tag. The untagged postings sit near the average on degree requirements (15% against 15%) and the CISSP, and lower on AI expectations (24% against 29%) and Python.
A local model read every posting for degree requirements and AI expectations. Two hosted models, from different companies, read the 4,587 US postings in the same set. The three models agree well beyond chance: on a standard agreement score (Cohen's kappa, where a score near one means near-perfect agreement) they reach 0.76 to 0.97 on degree requirements and 0.71 to 0.85 on securing AI. The CISSP, clearances and Python are counted by keyword search. Management share comes from a rule that reads job titles. Each likely range (95%) is found by resampling whole companies so that a company with many postings does not count as many separate data points.
How this answer was stress-tested
Tests marked earlier run ran on an earlier day's data, dated in the changelog. The rest ran on the figures in this piece.
| Test | What it found |
|---|---|
| Two hosted models. Two hosted models read the 4,587 US postings for degree requirements and AI expectations. | They agree with each other at kappa 0.97 on degree requirements, 0.85 on securing AI and 0.86 on using AI tools. The startup degree gap is larger under both (−7.6 and −8.2 points). The securing-AI gap holds (+10.1 and +9.7). The overall AI gap is clear under one and likely but borderline under the other. Under the local model it is likely but borderline too. |
| Each company weighted once. | Degree 7.1% vs 16.1%, securing AI 27.5% vs 19.7%, CISSP 18.5% vs 29.5%, management 5.9% vs 13.6%. Every gap keeps its direction. The degree, CISSP and management gaps grow. |
| Repeat postings removed. One posting per company and base title. | Gaps of −6.1 (degree), +7.0 (securing AI), −8.6 (CISSP) and −7.2 (management) points, all of them clear, the degree gap only just. |
| Dropping the largest employer in each group. | The largest startup employer has 24 postings. Without it and the largest enterprise employer, the degree gap is −6.2 (likely range −11.1 to −0.4), likely but borderline, the CISSP gap narrows to −8.9 (likely range −13.5 to −4.1) and the securing-AI gap widens to +9.5. |
| Technology and other industries. Size gaps split by whether the company sits in AI infrastructure, enterprise software, cloud and developer tools or cybersecurity vendors. | These four industries hold 65% of startup postings and 28% of enterprise postings. Within them the startup gaps are +0.6 (degree), +0.3 (CISSP) and +3.3 (securing AI) points, none of them clear, and −6.0 (management), which is clear. In the other industries they are −11.1 (degree), −11.2 (CISSP), −7.1 (management) and +12.7 (securing AI). All are clear, the management gap only just. |
| Small industries. Likely ranges, resampling whole companies, for each industry's standout measure. | Defense clearance 61% rests on 37 companies (likely range 38% to 85%). AI infrastructure securing AI 26% (20% to 33%, 71 companies). Healthcare CISSP 38% (31% to 45%, 89 companies). Against the next industry, defense's clearance lead and its AI gap with staffing are clear, and the AI, AI-tools, CISSP and degree leads are too small to tell apart from no difference. The exact levels for small industries are imprecise. |
| Seniority rule correction. The pipeline counted any title containing "Management" as a manager, including engineers in vulnerability and identity management. (earlier run) | Fixed with a test and backfilled. Management share by size fell from 14.0 / 8.4 / 5.9% to 9.8 / 6.4 / 4.6% on the earlier run's data. The same rule gives 15.9 / 11.9 / 8.9% in this piece. The gap between sizes held. |
| A fresh run on 28 September. Rebuilt from that day's data. | 309 more postings than on 25 September. Size figures moved by 1.3 points at most, and the industry ranking order held. |
| An independent instrument. One AI model read one posting per company for the reason it gives for the seat, 128 AI-first companies against 128 others, scored against another model at kappa 0.76. (earlier run) | 34% of the AI-first companies name shipping an AI product or agent as the reason, against 11% (+23 points, ±10). They name regulation (−13 ±8) and government work (−11 ±7) less often. The AI-first cohort (128 companies) and the AI infrastructure and ML industry are differently defined groups, so this is a separate comparison of AI-first companies with others, not corroboration of the industry table or of the size gaps. |
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| Second models on non-US postings | Whether the size gaps hold outside the US under the two further models | Possible now at API cost, about 3,800 postings. |
| Size and industry from an outside source | Replaces AKA's own tags with outside company data | Paid data. |
| Deeper government, utilities and education coverage | Whether the defense signature holds beyond 37 companies | Needs new sources, including USAJobs, and weeks of collection. |
| A 2024 baseline by size | Whether startups moved away from credentials or always differed | The 2024 public dataset carries no size or industry tags. Tagging its 679 companies is possible. |
| Excluding job aggregators at collection | Catches aggregators beyond the named list this piece leaves out | A collection rule change. |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- Startups firmly require a degree about 60% as often as enterprises, a likely but borderline gap. The early-access draft and its title said half as often.
- How do expectations differ by company size and industry? Figures as of 1 October 2026, some tests 23 and 24 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued