How do expectations differ by company size and industry?Startup postings ask for eight or more years less often than enterprise postings.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
Read the full research paperSecurity job postings at startups, mid-market companies and enterprises all ask for a median of five years of experience. They differ at the top end. In security postings open in fall 2026, 18.5% of startup postings stating years asked for eight or more, against 26.7% of enterprise postings.
Startup security postings also carry fewer management titles, and ask for degrees and the CISSP less often. They ask the hire to secure AI more often. By industry, defense and government postings ask for a clearance most often, in 61% of cases.
This is a snapshot of 8,391 security postings at 2,249 companies in every headquarters country, read on 1 October 2026. There is no earlier year to compare.
These findings come from one snapshot of postings at companies in every country, on modern job boards, leaning toward technology. Company size and industry come from tags assigned by a model. Government, utilities and education are thinly covered.
The answer at a glance
At every company size, the typical security posting asks for five years of experience. Startups ask for eight or more years less often: 18.5% against 26.7% at enterprises.
Startup security postings have manager or executive titles less often than enterprise postings: 8.9% against 15.9%.
Startup security postings require a degree 10.0% of the time, while enterprises require a degree 16.3% of their security postings.
Startup security postings name the CISSP less often than enterprise postings: 18.2% against 27.5%.
Startup security postings ask the hire to secure AI more often than enterprise postings: 22.4% against 13.5%.
Startups may ask about AI more often than enterprises, 35.3% against 29.5%, but the gap is too close to call.
Defense and government security postings ask for a clearance most often: 61%, against 31% in the next industry.
AI infrastructure and enterprise software postings expect AI most often, at 45%, but their lead over the next industry is too close to call.
Healthcare security postings name the CISSP most often, at 38%, but the lead over the next industry is too close to call.
The numbers by company size
| Measure | Enterprise | Mid-market | Startup |
|---|---|---|---|
| Postings (companies) | 4,468 (578) | 1,068 (336) | 910 (314) |
| Median years required | 5 | 5 | 5 |
| Eight or more years required, of postings stating years | 26.7% | 20.2% | 18.5% |
| Management titles (title rule) | 15.9% | 11.9% | 8.9% |
| Degree a firm requirement | 16.3% | 12.0% | 10.0% |
| Names the CISSP | 27.5% | 25.6% | 18.2% |
| Asks the hire to secure AI | 13.5% | 13.5% | 22.4% |
| Any AI expectation | 29.5% | 27.4% | 35.3% |
| Asks the hire to use AI tools | 14.8% | 14.1% | 12.4% |
| Asks for Python | 36.1% | 34.7% | 36.6% |
Source: AKA Security analysis of 6,446 security postings with a company-size tag, from 8,391 security postings at 2,249 companies in AKA's job-board data (open on or after 23 September 2026, read 1 October 2026).
Startup postings ask for fewer years and fewer management titles
Experience
In security postings open in fall 2026, the median asked for five years of experience at enterprises, mid-market companies and startups alike. Among postings stating years, 26.7% of enterprise postings asked for eight or more, against 18.5% of startup postings. The range of likely values for the gap is −12.6 to −3.9 points.
Each of the three AI methods finds the same gap on US postings, and the methods differ by 0.4 points at most. With management-titled postings removed, the gap is 6.6 points. With each company counted once, it is 6.0 points.
Management titles
In the same postings, 15.9% of enterprise security postings carried a manager or executive title, against 11.9% at mid-market companies and 8.9% at startups. The startup gap, −7.1 points, has a range of −10.2 to −3.9 points.
A second title rule gives 13.5% for enterprises and 7.7% for startups, a gap of −5.8 points. The gap also holds within the four technology industries, at −6.0 points.
Startup postings ask for fewer degrees and CISSPs
Degrees
In security postings open in fall 2026, 10.0% of startup postings firmly required a degree, against 16.3% of enterprise postings. That is about 60% as often. The range for the gap, −11.1 to −0.6 points, is likely but borderline.
The gap holds outside technology industries only. Four technology industries, AI infrastructure, enterprise software, cloud and developer tools, and cybersecurity vendors, hold 65% of startup postings and 28% of enterprise postings. Within them, a gap is too close to call: 11.5% of startup postings against 10.9% of enterprise postings. Outside them, 7.2% of startup postings require a degree, against 18.3% of enterprise postings.
The CISSP
In the same postings, 18.2% of startup security postings named the CISSP, against 27.5% of enterprise postings. The range for the gap is −13.9 to −4.5 points. The CISSP is counted by keyword search, with no AI model as a second check.
The pattern matches degrees. Within the four technology industries, the CISSP appears in 17.1% of startup and 16.7% of enterprise postings. Outside them, it appears in 20.4% of startup and 31.6% of enterprise postings.
Startup postings ask the hire to secure AI more often
In security postings open in fall 2026, 22.4% of startup postings asked the hire to secure AI systems, against 13.5% of enterprise postings. The range for the gap is +4.0 to +14.3 points. Each of the three AI models finds the gap on US postings.
Within the four technology industries, the gap is 21.3% against 18.0%, and the range includes zero. Outside them, it is 24.5% against 11.9%.
Any AI expectation appears in 35.3% of startup postings and 29.5% of enterprise postings. The range for that gap reaches zero at its lower end, so it is too close to call, but only just. Startup postings carry any AI expectation more often than mid-market postings, at 27.4%, a range of +1.1 to +14.6 points.
The numbers by industry
Industries with at least 100 postings, ranked by any AI expectation.
| Industry | Postings (companies) | Any AI | Secure AI | Use AI tools | Degree required | CISSP | Python | Clearance |
|---|---|---|---|---|---|---|---|---|
| AI infrastructure and ML | 386 (71) | 45% | 26% | 17% | 8% | 12% | 44% | 5% |
| Enterprise software | 541 (157) | 45% | 21% | 26% | 8% | 23% | 45% | 8% |
| Media and entertainment | 162 (42) | 36% | 15% | 22% | 10% | 28% | 48% | 1% |
| Cloud infrastructure and developer tools | 260 (31) | 35% | 16% | 15% | 8% | 14% | 43% | 5% |
| Consumer | 142 (30) | 35% | 15% | 21% | 4% | 27% | 34% | 0% |
| Fintech | 1,258 (185) | 32% | 14% | 17% | 15% | 29% | 37% | 1% |
| Cybersecurity vendors | 1,182 (235) | 31% | 14% | 16% | 14% | 18% | 39% | 11% |
| Retail and e-commerce | 263 (44) | 30% | 16% | 14% | 11% | 31% | 43% | 0% |
| Healthcare | 366 (89) | 23% | 13% | 9% | 21% | 38% | 27% | 2% |
| Industrial and manufacturing | 464 (63) | 20% | 10% | 8% | 26% | 26% | 30% | 7% |
| Staffing and consulting | 462 (98) | 18% | 11% | 8% | 17% | 35% | 21% | 31% |
| Defense and government | 416 (37) | 8% | 5% | 2% | 22% | 32% | 22% | 61% |
Source: AKA Security analysis of 5,902 security postings in 12 industries, from AKA's job-board data (open on or after 23 September 2026, read 1 October 2026). Industry tags assigned per company by a local model.
Three industry patterns
Defense postings lead on clearances
In security postings open in fall 2026, 61% of defense and government postings asked for a security clearance. Staffing and consulting came next, at 31%. The lead, +30.3 points, has a range of +4.0 to +57.4 points.
The exact level is less certain. The range for the 61% runs from 38% to 85%, across 416 postings from 37 companies. Defense and government postings also carry AI expectations less often than staffing and consulting postings: 8% against 18%.
The AI lead is too close to call
AI infrastructure and ML postings and enterprise software postings both carry any AI expectation in 45% of cases. Their lead over media and entertainment, at 36%, has a range of −6.5 to +22.5 points, so it is too close to call.
AI infrastructure and ML postings ask the hire to secure AI in 26% of cases, the highest in the table. Enterprise software postings ask the hire to use AI tools in 26% of cases, against 22% for media and entertainment, a lead that is too close to call.
Healthcare has the highest CISSP share
Healthcare security postings name the CISSP in 38% of cases, the highest in the table. Staffing and consulting comes next at 35%, and the lead, −5.6 to +12.4 points, is too close to call. Industrial and manufacturing postings firmly require a degree most often, at 26%, a lead that is also too close to call.
No test compares neighbouring industries in the middle of the ranking, so the order there carries a Low rating.
The question as asked
How do hiring demands and role expectations differ across company size and industry segments?
Asked by Lenny Zeltser
Where the data comes from
The data is a snapshot of AKA's daily read of company job boards: 8,391 security postings at 2,249 companies, each posting counted once. Collection began on 31 July 2026. The postings were open on or after 23 September 2026 and read on 1 October 2026. Every headquarters country is included, and job aggregators are left out. Of the 8,391 postings, 4,587 are at US-headquartered companies and 3,804 elsewhere.
The series' corpus of 15,163 security postings counts every version of a posting and uses a wider definition of security, so it is larger than the 8,391 here.
A local model assigned size and industry tags per company. They are not taken from an outside company database. Of the 8,391 postings, 6,446 carry a size tag. Untagged postings look like the rest on degree requirements, both at 15%, and on the CISSP, 27% against 26%. They carry fewer AI expectations, 24% against 29%, and fewer Python asks, 28% against 34%.
A local model read every posting for degree requirements and AI expectations. Two hosted models, from different companies, read the 4,587 US postings as second and third readers. Agreement across the three pairs runs 0.76 to 0.97 on degrees, 0.71 to 0.85 on securing AI and 0.70 to 0.86 on using AI tools. The CISSP, clearances and Python are counted by keyword search.
Each range of likely values (95%) is found by redrawing whole companies, so a company with many postings does not count as many data points. A range that includes zero means the gap cannot be told from no gap.
How this answer was stress-tested
Main results, startup minus enterprise, in points: degree −6.3, CISSP −9.2, securing AI +8.9, any AI +5.8, management −7.1, eight or more years −8.3.
| Test | What it found |
|---|---|
| Each AI model on US postings. 3,842 US postings with a size tag. | Degree: −7.6 and −8.2 for the hosted models, −5.1 for the local model, whose range includes zero. Securing AI: +10.1, +9.7 and +10.2, each clear. Eight or more years: −8.7, −8.6 and −9.0, each clear. Any AI: +8.6 clear, +7.2 only just not clear, and +7.2 borderline. |
| Each company counted once. | Every gap keeps its direction: degree −9.0, CISSP −11.0, securing AI +7.8, any AI +6.5, management −7.7, eight or more years −6.0. |
| Repeat postings removed. One per company and base title. | Degree −6.1, CISSP −8.6, securing AI +7.0, management −7.2. Same direction in each. |
| Largest employer dropped in each group. | Degree −6.2, CISSP −8.9, securing AI +9.5, management −6.1. Same direction in each. The largest startup employer has 24 postings. |
| Within four technology industries. | No clear gap for degrees (+0.6), the CISSP (+0.3) or securing AI (+3.3). Management holds at −6.0. |
| Outside four technology industries. | Larger gaps: degree −11.1, CISSP −11.2, securing AI +12.7. Management −7.1, likely but borderline. |
| Second title rule for management. | −5.8, range −8.6 to −2.7. Same direction, smaller by 1.3 points. |
| Management titles removed from the years test. | −6.6, range −11.0 to −2.2. Same direction, smaller by 1.7 points. |
| Small industries. Range around each standout level. | Defense clearance 61% (38% to 85%, 37 companies). AI infrastructure securing AI 26% (20% to 33%, 71 companies). Healthcare CISSP 38% (31% to 45%, 89 companies). |
| Next-industry comparisons. | Clear for the defense clearance lead (+30.3) and the defense AI gap (+10.5). Too close to call for the AI lead (+9.4), tool use (+4.1), CISSP (+3.3) and degree (+4.2) leads. |
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| Second hosted models on the 3,804 non-US postings | Whether the size gaps appear outside the US | |
| Size and industry from an outside company source | Replaces the local-model tags | |
| Deeper government, utilities and education coverage | Whether the defense pattern appears beyond 37 companies | |
| A 2024 baseline by size | A change over time by size. The 2024 public job-postings dataset carries no size or industry tags | |
| Excluding job aggregators at collection | Catches aggregators beyond the named list left out here |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- The range for overall AI asks only just reaches zero and is now worded "not measurable, only just" in place of "likely but borderline". Figures and rating are unchanged.
- Startups firmly require a degree about 60% as often as enterprises, a likely but borderline gap. The early-access draft and its title said half as often.
- How do expectations differ by company size and industry? Figures as of 1 October 2026, some tests 23 and 24 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued