How Does Security Hiring Differ by Company Size and Industry? Startups Firmly Require Degrees About 60% as Often
Abstract
Startup postings firmly require degrees about 60% as often as enterprise postings, a likely but borderline gap, and ask more often for securing AI. Defense postings lead on clearances.
*Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
1Introduction
Security postings ask for different things at different company sizes. Each figure comes with a range of likely values, and where that range includes zero we can't tell a gap from no gap. Startups list a degree as a firm requirement about 60% as often as enterprises, a likely but borderline gap. They name the CISSP less often, ask for eight or more years of experience less often and carry a lower share of management titles. They ask the hire to secure AI more often. The overall share of postings with some AI expectation runs from 27% to 35% across sizes and is higher at startups, a likely but borderline gap. Among technology companies, startups and enterprises show no measurable difference on degrees or the CISSP.
Industry draws sharper lines. AI infrastructure and enterprise software have the highest AI shares in the table (45% and 45%), but their lead over the next industry is too small to tell apart from no difference. They split the AI ask: AI infrastructure postings ask hires to secure AI, enterprise software postings ask them to use it. Defense and government postings lead on clearances. Their AI share is 8%, and its gap with the next industry is a clear one. Healthcare has the highest CISSP share in the table (38%), but its lead over staffing and consulting is too small to tell apart from no difference.
2The answer at a glance
| Finding | Confidence | Representativeness |
|---|---|---|
| Startups list a degree as a firm requirement about 60% as often as enterprises, a likely but borderline gap | Medium. The gap is likely but borderline (likely range −11.1 to −0.6 points). It holds when each company counts once, when repeat postings are removed and when the largest employer is dropped, and under two further AI models that read the US postings, where it is larger. On US postings the local model alone shows no clear gap, and neither do technology companies on their own. | Medium. Size comes from AKA's own company tags. The gap comes from companies outside the four technology industries, which hold 65% of startup postings and 28% of enterprise postings. |
| Startups name the CISSP less often | Medium. Holds when each company counts once, when repeat postings are removed and when the largest employer is dropped. It is counted by keyword search with no AI model as a second check, and within technology companies there is no clear gap. | Medium. Same split by industry as degrees. |
| Startups ask the hire to secure AI more often. Their overall AI share is higher, a likely but borderline gap | Medium for the securing-AI gap, which is clear under every model but not within technology companies. Medium for the overall gap, which is likely but borderline (likely range −0.0 to +12.0 points), borderline too under one of the further models and the local model on US postings, and clear under the other. | Medium. Within technology companies the securing-AI gap is +3.3 points, too small to tell apart from no gap. |
| Startup postings carry a lower share of management titles | High. The gap is clear under both ways of reading seniority from titles: the pipeline's title rule, corrected before this run, and the series' level rule. | Medium. |
| The median asks for five years at every size. Startups ask for eight or more years less often | High. The upper-end gap holds under both further models and outside management titles. | Medium. |
| AI infrastructure and enterprise software have the highest AI shares. Defense leads on clearances. Healthcare has the highest CISSP share | High for defense's lead on clearances, a clear lead over the next industry. Low for the AI and CISSP shares, whose leads over the next industry are too small to tell apart from no difference. Medium for defense's exact level, which rests on 37 companies. Low for the middle of the ranking, which no test comparing neighbouring industries supports. | Low. Industry coverage is dense in fintech, software, security vendors and AI, and thin in government, utilities and education. |
3The numbers by company size
Share of security postings, all headquarters countries.
| Enterprise | Mid-market | Startup | |
|---|---|---|---|
| Postings (companies) | 4,468 (578) | 1,068 (336) | 910 (314) |
| Degree a firm requirement | 16% | 12% | 10% |
| Names the CISSP | 27% | 26% | 18% |
| Management titles | 16% | 12% | 9% |
| Any AI expectation | 29% | 27% | 35% |
| Asks the hire to secure AI | 14% | 13% | 22% |
| Asks the hire to use AI tools | 15% | 14% | 12% |
| Asks for Python | 36% | 35% | 37% |
| Median years required | 5 | 5 | 5 |
| Eight or more years required, of postings stating years | 27% | 20% | 18% |
Source: AKA Security analysis of 8,391 security postings at 2,249 companies in AKA's job-board data, 1 October 2026. 6,446 postings carry a size tag.
4Startup postings ask for fewer degrees, CISSPs and years
4.1Degrees
10.0% of startup postings list a degree as a firm requirement, against 16.3% at enterprises, about 60% as often. The gap is −6.3 percentage points, with a range of likely values from −11.1 to −0.6, so it is likely but borderline. Counting each company once, the rates are 7.1% and 16.1%. Two further AI models, reading the 3,842 US postings at startups and enterprises, put the gap wider: −7.6 points, likely but borderline, and −8.2 points, a clear gap. On the same US postings the local model that labelled every posting puts the gap at −5.1 points, too small to tell apart from no gap, and marks fewer firm requirements than they do (13.5% against 16.6% and 16.9%).
The gap comes from outside technology companies. In AI infrastructure, enterprise software, cloud and developer tools and cybersecurity vendors, 11.5% of startup postings and 10.9% of enterprise postings list a degree as a firm requirement. In every other industry the rates are 7.2% and 18.3% (−11.1 points, likely range −15.8 to −5.8).
4.2Certifications
The CISSP appears in 18.2% of startup postings and 27.5% of enterprise postings (−9.2 points, likely range −13.9 to −4.5). Within the four technology industries the rates are 17.1% and 16.7%.
4.3Experience
The median posting asks for five years at every size. The upper end differs. Of postings that state a figure, 26.7% at enterprises ask for eight or more years, against 20.2% at mid-market companies and 18.5% at startups (startup minus enterprise −8.3 points, likely range −12.6 to −3.9). The two further models, on US postings, put the startup and enterprise shares at 20.0% and 19.9% against 28.6% and 28.5%. Outside management titles the gap is −6.6 points (likely range −11.0 to −2.2).
5Startup postings ask the hire to secure AI more often
22.4% of startup postings ask the hire to secure AI systems, against 13.5% at enterprises (+8.9 points, likely range +4.0 to +14.3). On US postings the two further models agree: +10.1 points (likely range +4.4 to +16.4) and +9.7 points (likely range +4.5 to +15.4), and the local model gives +10.2 points (likely range +4.9 to +16.0). Within the four technology industries the gap is +3.3 points (likely range −2.4 to +9.5), too small to tell apart from no gap. A founding security engineer posting at Withpace [2] lists the work as "application and infrastructure security, enterprise security and GRC, incident response, and an emerging category we care deeply about: designing secure AI and agentic systems."
The overall share of postings with any AI expectation is 35.3% at startups and 29.5% at enterprises, a gap of +5.8 points (likely range −0.0 to +12.0), likely but borderline. On US postings the gap is clear under one of the further models and borderline under the other and under the local model. At mid-market companies the share is 27.4%. Mid-market minus enterprise is −2.0 points (likely range −7.0 to +3.1), no clear gap, and startup minus mid-market is +7.8 points (likely range +1.1 to +14.6), a clear gap. Asks to use AI tools appear in 14.8% of enterprise postings and 12.4% of startup postings.
6Startup postings carry a lower share of management titles
Manager and executive titles make up 15.9% of enterprise postings, 11.9% at mid-market companies and 8.9% at startups (startup minus enterprise −7.1 points, likely range −10.2 to −3.9). Counting each company once, the rates are 13.6% and 5.9%. The series' level rule, which reads titles differently, gives 13.5%, 10.1% and 7.7% (−5.8 points, likely range −8.6 to −2.7).
7The numbers by industry
Industries with at least 100 postings, ranked by share with any AI expectation.
| Industry | Postings (companies) | Any AI | Secure AI | Use AI tools | Degree required | CISSP | Python | Clearance |
|---|---|---|---|---|---|---|---|---|
| AI infrastructure and ML | 386 (71) | 45% | 26% | 17% | 8% | 12% | 44% | 5% |
| Enterprise software | 541 (157) | 45% | 21% | 26% | 8% | 23% | 45% | 8% |
| Media and entertainment | 162 (42) | 36% | 15% | 22% | 10% | 28% | 48% | 1% |
| Cloud infrastructure and developer tools | 260 (31) | 35% | 16% | 15% | 8% | 14% | 43% | 5% |
| Consumer | 142 (30) | 35% | 15% | 21% | 4% | 27% | 34% | 0% |
| Fintech | 1,258 (185) | 32% | 14% | 17% | 15% | 29% | 37% | 1% |
| Cybersecurity vendors | 1,182 (235) | 31% | 14% | 16% | 14% | 18% | 39% | 11% |
| Retail and e-commerce | 263 (44) | 30% | 16% | 14% | 11% | 31% | 43% | 0% |
| Healthcare | 366 (89) | 23% | 13% | 9% | 21% | 38% | 27% | 2% |
| Industrial and manufacturing | 464 (63) | 20% | 10% | 8% | 26% | 26% | 30% | 7% |
| Staffing and consulting | 462 (98) | 18% | 11% | 8% | 17% | 35% | 21% | 31% |
| Defense and government | 416 (37) | 8% | 5% | 2% | 22% | 32% | 22% | 61% |
Source: AKA Security analysis of security postings in AKA's job-board data, 1 October 2026. These twelve industries cover 5,902 postings.
8Three industry signatures
8.1AI infrastructure and enterprise software carry the highest AI shares
AI infrastructure and ML companies carry an AI expectation in 45% of security postings, level with enterprise software at the top of the table. The gap between them (+0.1 points) is too small to tell apart from no gap. They ask the hire to secure AI in 26% (likely range 20% to 33% across 71 companies). Enterprise software companies are at 45%, with a different mix: 26% ask the hire to use AI tools, the highest share in the table, and 21% ask them to secure AI. Against media and entertainment, next at 36%, the two lead by 9.4 points, and enterprise software's AI-tools share leads the next industry by 4.1 points. Neither lead is clear. The two industries list a degree as a firm requirement in 8% and 8% of postings.
8.2Defense postings lead on clearances
61% of defense and government security postings require a clearance (likely range 38% to 85% across 37 companies). A General Dynamics Information Technology posting for a Cyber Security Analyst [3] states it plainly: "Security Clearance Level: Active TS/SCI required." AI appears in 8% of defense postings, against 18% at the next industry up, staffing and consulting. That gap (10.5 points) is a clear one. Staffing and consulting firms are second on clearances at 31%, and defense's 30.3-point lead over them is also clear.
8.3Healthcare has the highest CISSP share
38% of healthcare security postings name the CISSP (likely range 31% to 45% across 89 companies), the highest share in the table, against 35% in staffing and consulting, a 3.3-point gap too small to tell apart from no gap, and 12% in AI infrastructure. Industrial and manufacturing companies list a degree as a firm requirement in 26% of postings, the highest share in the table, against 22% in defense and government, a 4.2-point gap that is also too small to call.
9Where the data comes from
The postings come from AKA's daily read of company job boards: 8,391 security postings at 2,249 companies, collected since 31 July 2026 and read on 1 October, limited to postings open on or after 23 September 2026. Job aggregators, which repost other employers' jobs, are left out. Each posting is counted once, using the series' rule for which job titles count as security. The method page gives a larger total, 15,163, because it counts every version of a posting and uses a wider definition. Unlike the specialties piece in this series, this is a snapshot of one period with no earlier year to compare against, and it covers every headquarters country.
Company size and industry are AKA's own tags, assigned per company by a model and not drawn from an outside database of company data. 77% of postings carry a size tag. The untagged postings sit near the average on degree requirements (15% against 15%) and the CISSP, and lower on AI expectations (24% against 29%) and Python.
A local model read every posting for degree requirements and AI expectations. Two hosted models, from different companies, read the 4,587 US postings in the same set. The three models agree well beyond chance: on a standard agreement score (Cohen's kappa, where a score near one means near-perfect agreement) they reach 0.76 to 0.97 on degree requirements and 0.71 to 0.85 on securing AI. The CISSP, clearances and Python are counted by keyword search. Management share comes from a rule that reads job titles. Each likely range (95%) is found by resampling whole companies so that a company with many postings does not count as many separate data points.
10How this answer was stress-tested
Tests marked earlier run ran on an earlier day's data, dated in the changelog. The rest ran on the figures in this piece.
| Test | What it found |
|---|---|
| Two hosted models. Two hosted models read the 4,587 US postings for degree requirements and AI expectations. | They agree with each other at kappa 0.97 on degree requirements, 0.85 on securing AI and 0.86 on using AI tools. The startup degree gap is larger under both (−7.6 and −8.2 points). The securing-AI gap holds (+10.1 and +9.7). The overall AI gap is clear under one and likely but borderline under the other. Under the local model it is likely but borderline too. |
| Each company weighted once. | Degree 7.1% vs 16.1%, securing AI 27.5% vs 19.7%, CISSP 18.5% vs 29.5%, management 5.9% vs 13.6%. Every gap keeps its direction. The degree, CISSP and management gaps grow. |
| Repeat postings removed. One posting per company and base title. | Gaps of −6.1 (degree), +7.0 (securing AI), −8.6 (CISSP) and −7.2 (management) points, all of them clear, the degree gap only just. |
| Dropping the largest employer in each group. | The largest startup employer has 24 postings. Without it and the largest enterprise employer, the degree gap is −6.2 (likely range −11.1 to −0.4), likely but borderline, the CISSP gap narrows to −8.9 (likely range −13.5 to −4.1) and the securing-AI gap widens to +9.5. |
| Technology and other industries. Size gaps split by whether the company sits in AI infrastructure, enterprise software, cloud and developer tools or cybersecurity vendors. | These four industries hold 65% of startup postings and 28% of enterprise postings. Within them the startup gaps are +0.6 (degree), +0.3 (CISSP) and +3.3 (securing AI) points, none of them clear, and −6.0 (management), which is clear. In the other industries they are −11.1 (degree), −11.2 (CISSP), −7.1 (management) and +12.7 (securing AI). All are clear, the management gap only just. |
| Small industries. Likely ranges, resampling whole companies, for each industry's standout measure. | Defense clearance 61% rests on 37 companies (likely range 38% to 85%). AI infrastructure securing AI 26% (20% to 33%, 71 companies). Healthcare CISSP 38% (31% to 45%, 89 companies). Against the next industry, defense's clearance lead and its AI gap with staffing are clear, and the AI, AI-tools, CISSP and degree leads are too small to tell apart from no difference. The exact levels for small industries are imprecise. |
| Seniority rule correction. The pipeline counted any title containing "Management" as a manager, including engineers in vulnerability and identity management. (earlier run) | Fixed with a test and backfilled. Management share by size fell from 14.0 / 8.4 / 5.9% to 9.8 / 6.4 / 4.6% on the earlier run's data. The same rule gives 15.9 / 11.9 / 8.9% in this piece. The gap between sizes held. |
| A fresh run on 28 September. Rebuilt from that day's data. | 309 more postings than on 25 September. Size figures moved by 1.3 points at most, and the industry ranking order held. |
| An independent instrument. One AI model read one posting per company for the reason it gives for the seat, 128 AI-first companies against 128 others, scored against another model at kappa 0.76. (earlier run) | 34% of the AI-first companies name shipping an AI product or agent as the reason, against 11% (+23 points, ±10). They name regulation (−13 ±8) and government work (−11 ±7) less often. The AI-first cohort (128 companies) and the AI infrastructure and ML industry are differently defined groups, so this is a separate comparison of AI-first companies with others, not corroboration of the industry table or of the size gaps. |
11What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| Second models on non-US postings | Whether the size gaps hold outside the US under the two further models | Possible now at API cost, about 3,800 postings. |
| Size and industry from an outside source | Replaces AKA's own tags with outside company data | Paid data. |
| Deeper government, utilities and education coverage | Whether the defense signature holds beyond 37 companies | Needs new sources, including USAJobs, and weeks of collection. |
| A 2024 baseline by size | Whether startups moved away from credentials or always differed | The 2024 public dataset carries no size or industry tags. Tagging its 679 companies is possible. |
| Excluding job aggregators at collection | Catches aggregators beyond the named list this piece leaves out | A collection rule change. |
Acknowledgements
Question asked by Lenny Zeltser.
References
- [1]AKA Security Research Factory. Security Hiring Research: What Job Postings Say About Security Work. AKA Security, 2026. akasecurity.io/research/security-hiring-research
- [2]founding security engineer posting at Withpace. jobs.ashbyhq.com/withpace/2be9aae7-be7a-4f91-a57b-2519188cf0c5
- [3]General Dynamics Information Technology posting for a Cyber Security Analyst. gdit.wd5.myworkdayjobs.com/External_Career_Site/job/USA-VA-Quantico/NCIS-Cyber-Security-Analyst---Active-TS-SCI-clearance_RQ224019-2
Cite as
@techreport{aka-rz-2026-05,
title = {How Does Security Hiring Differ by Company Size and Industry? Startups Firmly Require Degrees About 60% as Often},
author = {{AKA Security Research Factory}},
institution = {AKA Security},
type = {Research report},
number = {AKA-RZ:2610.05v1},
version = {1.0.0},
year = {2026},
month = oct,
url = {https://akasecurity.io/research/security-hiring-by-company-size-and-industry}
}