Which security roles had the largest rise in posted pay ranges, spring 2024 to 2026?The median posted pay rose across security postings, after inflation too.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
Read the full research paperAmong the three large role families, which led is too close to call. Posted pay rose across security postings, by similar amounts in each of the three large role families. In 395 US security postings with pay in spring 2024, the median midpoint of the posted range was $142k. In 2,194 postings with pay at US-headquartered companies in fall 2026, it was $181k.
That is a rise of 27.4% before inflation and 19.3% after it. GRC, privacy and programs rose 29.3%, engineering 28.1%, and detection, response and offensive 29.5%. The gaps between those three changes are too close to call.
At the 37 companies that posted pay in both years, the median rose 12.9%, and that rise is too close to call.
These findings compare two sources: a public dataset of US postings from spring 2024, and AKA's read of company job boards in 2026. They apply best to US-headquartered companies on modern job boards, which lean toward technology, and less to government, staffing and managed-security firms.
The answer at a glance
Posted pay for security roles rose from $142k to $181k, the median midpoint of each posted range: 27.4%, or 19.3% after inflation.
Posted pay for individual contributor roles, those that don't manage people, rose from $137k to $177k, 29.9%.
Posted pay rose 28.1% in engineering postings and 29.5% in detection, response and offensive postings.
Posted pay in governance, risk and compliance (GRC), privacy and program postings rose from $135k to $175k, 29.3%.
Among engineering; detection, response and offensive; and GRC, privacy and programs, no family measurably rose more than another.
At the 37 companies that posted pay in both years, pay rose 12.9%, but the rise is too close to call.
Leadership postings rose 21.0% and manager postings 15.4%, both likely but borderline. Architecture shows no clear change.
Whether AI security pay rose.
The numbers
Median midpoint of the posted pay range, annualised, for security postings that show pay.
| Role family | Postings, 2024 → 2026 | Median midpoint, 2024 | Median midpoint, 2026 | Change | Likely range (95%), percent | After inflation |
|---|---|---|---|---|---|---|
| All security | 395 → 2,194 | $142k | $181k | +27.4% | +19 to +36 | +19.3% |
| GRC, privacy and programs | 86 → 281 | $135k | $175k | +29.3% | +16 to +47 | +21.0% |
| Engineering | 183 → 1,329 | $146k | $187k | +28.1% | +19 to +41 | +19.9% |
| Detection, response and offensive | 83 → 410 | $128k | $165k | +29.5% | +17 to +45 | +21.2% |
| Architecture | 19 → 105 | $182k | $182k | −0.1% | −7 to +24 | −6.5% |
| Leadership | 24 → 69 | $183k | $222k | +21.0% | +2 to +47 | +13.3% |
| Individual contributors | 336 → 1,913 | $137k | $177k | +29.9% | +22 to +39 | +21.6% |
| Managers | 36 → 159 | $170k | $196k | +15.4% | +3 to +42 | +8.0% |
| Executives | 23 → 122 | $193k | $233k | +21.0% | +2 to +47 | +13.3% |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | ||||||
Source: AKA Security analysis of US security postings with pay from a public job-postings dataset (spring 2024) and postings at US-headquartered companies in AKA's job-board data (open on or after 23 September 2026, pay read 30 September 2026). Staffing firms removed in both years. Inflation from the Consumer Price Index for All Urban Consumers, +6.8%.
Leadership and executives are separate groups with different medians, postings and companies. The data gives them the same change, range and change after inflation.
| Title level, postings with pay | 2024 | 2026 |
|---|---|---|
| Entry individual contributor | 51% | 37% |
| Senior individual contributor | 34% | 50% |
| Manager | 9% | 7% |
| Executive | 6% | 6% |
Source: AKA Security analysis of 395 US security postings with pay (spring 2024) and 2,194 at US-headquartered companies (fall 2026).
The 2026 postings with pay lean more senior. Reweighted to the 2024 mix of levels, the 2026 median is $175k, a rise of 23.3% on 2024. Within each level, entry individual contributor postings rose 18.7% and senior individual contributor postings 28.7%.
Which family led is too close to call
| Family against family | Gap in change, points | Likely range (95%) |
|---|---|---|
| GRC, privacy and programs against engineering | +1.2 | −18 to +20 |
| GRC, privacy and programs against detection, response and offensive | −0.2 | −20 to +20 |
| Engineering against detection, response and offensive | −1.4 | −19 to +16 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | ||
Source: AKA Security analysis of 86 GRC, privacy and programs, 183 engineering and 83 detection, response and offensive US security postings with pay (spring 2024), and their 2026 counterparts at US-headquartered companies.
In US security postings with pay, detection, response and offensive rose 29.5% from spring 2024 to fall 2026, GRC, privacy and programs 29.3%, and engineering 28.1%. Each gap between them has a range that includes zero, so no family's rise can be told apart from another's.
Engineering covers general security engineer, AppSec and product, infrastructure and network, cloud security, IAM and AI security. Detection, response and offensive covers detection and response, threat intelligence, vulnerability management, offensive and general security analyst. GRC, privacy and programs covers GRC, privacy, and program and project roles. Architecture and leadership stand alone.
By specialty
| Specialty | Postings, 2024 → 2026 | Median midpoint, 2024 → 2026 | Change | Likely range (95%), percent | Thin in 2024 |
|---|---|---|---|---|---|
| General security engineer | 93 → 398 | $140k → $173k | +23.8% | +11 to +38 | No |
| AppSec and product | 39 → 411 | $170k → $196k | +15.3% | +2 to +40 | No |
| Infrastructure and network | 23 → 214 | $138k → $186k | +34.9% | +18 to +48 | Yes |
| Cloud security | 8 → 72 | $151k → $175k | +15.6% | +6 to +93 | Yes |
| IAM | 18 → 73 | $124k → $170k | +36.6% | +16 to +65 | Yes |
| AI security | 2 → 161 | $210k → $190k | −9.6% | −27 to +16 | Yes |
| Detection and response | 28 → 222 | $138k → $170k | +23.8% | +15 to +43 | Yes |
| General security analyst | 30 → 60 | $95k → $122k | +28.2% | +0 to +58 | No |
| Offensive | 10 → 70 | $149k → $178k | +19.2% | −9 to +58 | Yes |
| Threat intelligence | 6 → 28 | $158k → $175k | +10.6% | −17 to +39 | Yes |
| Vulnerability management | 9 → 30 | $151k → $153k | +1.2% | −14 to +53 | Yes |
| GRC | 69 → 169 | $130k → $164k | +26.1% | +13 to +44 | No |
| Privacy | 6 → 58 | $154k → $220k | +42.6% | +20 to +72 | Yes |
| Program and project | 11 → 54 | $150k → $186k | +24.5% | +10 to +72 | Yes |
| Architecture | 19 → 105 | $182k → $182k | −0.1% | −7 to +24 | Yes |
| General security leadership | 24 → 69 | $183k → $222k | +21.0% | +2 to +47 | Yes |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | |||||
Source: AKA Security analysis of US security postings with pay from a public job-postings dataset (spring 2024) and postings at US-headquartered companies in AKA's job-board data (fall 2026). Thin means fewer than 30 postings or fewer than 10 companies with pay in that year.
Most specialties are thin in 2024, so their changes carry wide ranges. AI security cannot be answered: its 2024 figure rests on 2 postings at 2 companies.
Inside the same companies
At the 37 companies that posted pay for security roles in both years, the median midpoint went from $158k in spring 2024 to $178k in fall 2026. That is a rise of 12.9%, with a range of −1% to +38%, so it is too close to call. It rests on 61 postings in 2024 and 382 in 2026.
By family at those companies, engineering rose 11.3%, detection, response and offensive 31.8%, and GRC, privacy and programs 13.5%. All of those changes are too close to call.
Pay ranges got wider
The width of a posted range is its top minus its bottom. In US security postings, the median width was $40k in spring 2024, across 372 postings. At US-headquartered companies in fall 2026, it was $68k, across 2,133 postings. That is a rise of 68.8%, with a range of +35% to +105%.
Paid wages for comparison
| Information security analysts, US | May 2024 | May 2025 | Change |
|---|---|---|---|
| Median annual wage | $124,910 | $129,180 | +3.4% |
| Mean annual wage | $127,730 | $132,510 | +3.7% |
Source: US Bureau of Labor Statistics, Occupational Employment and Wage Statistics, information security analysts.
These are paid wages for one occupation, not posted ranges, and they cover a different period.
The question as asked
Which cybersecurity roles are seeing the largest increases in salary ranges
Asked by Ross Young
Where the data comes from
The 2024 postings come from a public job-postings dataset: 1,038 US security postings in spring 2024, 872 after removing 166 at staffing firms. Of those, 395 at 273 companies carry usable pay: 305 from structured pay fields and 90 read from the description by a parser.
The 2026 postings come from AKA's daily read of 2,194 job boards across 16 applicant tracking system families: 4,587 security postings at US-headquartered companies, 4,442 after removing 145 at staffing firms. Only postings open on or after 23 September 2026 count. Of those, 2,194 at 492 companies carry usable pay: 1,948 read from the posting text by the parser and 246 from the board pay field, read on 30 September for postings still open.
Both years use the same rules: the security title rules, a local model's read of whether a posting is a security role, and one posting per company and title. Staffing firms and job aggregators are removed. Pay collection differs by year: 2024 is mostly structured fields, and 2026 is mostly posting text plus the board pay field.
The measure is the median midpoint of the posted range, annualised. Hourly pay counts 2,080 hours a year, weekly pay 52 weeks and monthly pay 12 months. A posting that lists several ranges by location counts its highest. Ranges below $20k or above $1.5 million a year are dropped, as are parsed ranges whose top is more than 3 times the bottom: 4 in 2024 and 14 in 2026. Each range of likely values (95%) is found by redrawing the set of companies many times.
The share of eligible postings showing any pay went from 46% in 2024 to 50% in 2026, a change too close to call. Among leadership postings, it fell from 60% to 40%, the only group with a clear change.
How this answer was stress-tested
| Test | What it found |
|---|---|
| Same companies. Both years limited to the 37 companies with pay in both. | All security +12.9%, range −1% to +38%. Too close to call. Engineering and GRC, privacy and programs are also too close to call here. |
| Outside technology companies. 2026 postings outside technology, against all 2024 postings. | All security +18.8%, range +12% to +26%. Same direction, smaller by 8.6 points. |
| Postings of similar length. 3,000 to 6,000 characters in both years. | All security +29.2%. Same direction, larger by 1.8 points. |
| Each company weighted once. | All security +31.8%. Same direction, larger by 4.4 points. |
| Largest contributing company removed. | All security +28.7%. Same direction, larger by 1.3 points. |
| 2024 structured pay only. Without the parsed 2024 descriptions. | All security +28.9%. Same direction, larger by 1.5 points. |
| Lowest range for 2026. Postings listing several ranges use the lowest. | All security +25.6%. Same direction, smaller by 1.8 points. |
| Without the board pay field. The 246 postings with pay from that field removed. | All security +25.1%. Same direction, smaller by 2.3 points. |
| 2024 postings through the applicant tracking system link. 71 postings at 57 companies, against all 2026 postings. | All security +18.1%. Same direction, smaller by 9.3 points. Engineering and GRC, privacy and programs are too close to call here. |
| 2026 reweighted to 2024's mix of levels. | +23.3%, smaller by 4.1 points. |
| Pay parser against a blind read. A hosted AI model read 300 postings from 2026. | Precision 99.0% and recall 97.5%. The range was within 2% for 194 of 198 postings. |
| Check | GRC, privacy and programs | Engineering | Detection, response and offensive | Individual contributors |
|---|---|---|---|---|
| Main result | +29.3% | +28.1% | +29.5% | +29.9% |
| Same companies | +13.5% | +11.3% | +31.8% | +18.1% |
| Outside technology companies | +20.1% | +16.8% | +26.5% | +20.9% |
| Postings of similar length | +25.9% | +33.8% | +35.6% | +34.1% |
| Each company weighted once | +30.8% | +33.5% | +33.3% | +33.7% |
| Largest contributing company removed | +27.2% | +27.4% | +29.4% | +30.0% |
| 2024 structured pay only | +29.4% | +29.5% | +32.1% | +31.1% |
| Lowest range for 2026 | +26.9% | +25.5% | +29.4% | +28.3% |
| Without the board pay field | +29.3% | +25.7% | +29.4% | +28.2% |
| 2024 through the applicant tracking system link | +14.3% | +10.5% | +39.3% | +20.2% |
Source: AKA Security analysis of US security postings with pay (spring 2024) and postings at US-headquartered companies (fall 2026). Each cell is the change in the median midpoint under that check.
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| More companies with pay in both years | Whether the rise holds inside the same companies, where it is too close to call today across 37 companies | |
| A 2026 sample from the same source as 2024 | The difference in collection method | |
| Pay from every board for every posting | Pay for postings that closed before 30 September | |
| Paid wages for 2026 | Whether paid wages for information security analysts rose over the same period |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- Whether AI security pay rose is rated Not answerable.
- Posted pay midpoints rose 27.4%, or 19.3% after inflation. The early-access draft said 21.7% and 13.9%.
- The industries counted as outside technology were listed differently across pieces. They now match everywhere, and telecommunications counts as technology. Only test results moved. No answer or rating changed.
- Which security roles had the largest rise in posted pay ranges, spring 2024 to 2026? Figures as of 1 October 2026, with pay from Ashby and Lever job boards as of 30 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued