Which Security Roles' Posted Pay Ranges Rose Most Since 2024? Posted Pay Rose Across Security Postings, After Inflation Too
Abstract
Posted security pay midpoints are 27.4% above spring 2024, 19.3% after inflation. GRC, engineering and detection roles all rose, and none measurably led.
*Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026. Pay from Ashby and Lever job boards as of 30 September 2026.
1Introduction
Across security postings that show pay, US postings in spring 2024 against postings at US-headquartered companies in 2026, the midpoint of the posted range is 27.4% higher, $142k against $181k, or 19.3% after inflation. GRC, privacy and program roles (+29.3%), engineering (+28.1%) and detection, response and offensive roles (+29.5%) each rose, and the gaps between them are not measurable. Each figure comes with a range of likely values, and where that range includes zero we can't tell the change from no change. Architecture is not measurable. Leadership (+21.0%) and managers (+15.4%) show a likely but borderline rise.
The 2026 postings lean more senior than the 2024 ones: senior individual contributors are 50% of 2026 postings with pay against 34% in 2024. With 2024's mix of seniority levels, the rise is smaller: the 2026 median is $175k, +23.3% on 2024. Within each level, entry individual contributors rose +18.7% (likely range +11 to +34) and senior individual contributors +28.7% (+18 to +38).
Inside the 37 companies that posted pay for security roles in both years, the change is not measurable: +12.9%, with a likely range from −1 to +38. The two years were collected in different ways, and only 37 companies posted pay in both. The rise across all postings describes the postings, not what any one employer changed. For paid wages rather than posted ranges, the Bureau of Labor Statistics median for information security analysts rose 3.4% from May 2024 to May 2025.
2The answer at a glance
| Finding | Confidence | Representativeness |
|---|---|---|
| Across all security postings with pay, posted midpoints are 27.4% higher than in spring 2024, 19.3% after inflation | Medium. A clear rise, and every check shows one except the same companies. With 2024's mix of seniority levels, the rise is +23.3%. | Medium. 395 postings in 2024 and 2,194 in 2026, from two collection methods. |
| Within the 37 companies that posted pay in both years, the change in posted midpoints is not measurable: +12.9% (−1 to +38) | Low. The likely range runs from −1 to +38, which includes no change. | Low. 61 postings in 2024 and 382 in 2026. |
| GRC, privacy and program roles rose +29.3% | Medium. A clear rise. The same-companies check shows no clear change. | Low. 86 postings in 2024. |
| Engineering rose +28.1% and detection, response and offensive roles +29.5% | Medium. Both are clear rises. The same-companies check shows no clear change for either, and engineering's company-site check shows none for engineering. | Medium. 183 and 83 postings in 2024. |
| No family measurably rose more than another | Low. No gap between families is clear: GRC against engineering +1.2 points (−18 to +20). | Low. Three families. |
| Architecture is not measurable. Leadership and managers show a likely but borderline rise | Low for architecture (−7 to +24). Medium for leadership (+2 to +47) and managers (+3 to +42), each a likely but borderline rise. | Low. 19 architecture and 24 leadership postings in 2024. |
| Individual contributors rose +29.9% | High. A clear rise, and every check shows a clear or borderline rise. | Medium. 336 and 1,913 postings. |
3The numbers
Midpoint means the middle of the posted base-pay range, annualised. Hourly pay counts 2,080 hours a year.
| Role family | Postings, 2024 → 2026 | Median midpoint, 2024 | Median midpoint, 2026 | Change | Likely range (95%) | After inflation |
|---|---|---|---|---|---|---|
| All security | 395 → 2,194 | $142k | $181k | +27.4% | +19 to +36 | +19.3% |
| GRC, privacy and programs | 86 → 281 | $135k | $175k | +29.3% | +16 to +47 | +21.0% |
| Engineering | 183 → 1,329 | $146k | $187k | +28.1% | +19 to +41 | +19.9% |
| Detection, response and offensive | 83 → 410 | $128k | $165k | +29.5% | +17 to +45 | +21.2% |
| Architecture | 19 → 105 | $182k | $182k | −0.1% | −7 to +24 | −6.5% |
| Leadership | 24 → 69 | $183k | $222k | +21.0% | +2 to +47 | +13.3% |
| Individual contributors | 336 → 1,913 | $137k | $177k | +29.9% | +22 to +39 | +21.6% |
| Managers | 36 → 159 | $170k | $196k | +15.4% | +3 to +42 | +8.0% |
| Executives | 23 → 122 | $193k | $233k | +21.0% | +2 to +47 | +13.3% |
Source: AKA Security analysis. 2024: US postings from a public LinkedIn dataset (5 to 19 April 2024). 2026: postings at US-headquartered companies in AKA's job-board data. Staffing firms removed in both years. Likely ranges (95%) are found by redrawing the set of companies many times and recomputing each figure. Inflation uses the Consumer Price Index for All Urban Consumers (CPI-U), April 2024 (313.548) to August 2026 (334.980). A change in bold is a clear rise. Leadership, managers and executives show a likely but borderline rise, and architecture is not measurable.
Bars show each range of likely values against zero (dashed). Solid: the whole range is above or below zero. Grey: it ends at zero. Hollow: it includes zero.
| Title level, postings with pay | 2024 | 2026 |
|---|---|---|
| Entry individual contributor | 51% | 37% |
| Senior individual contributor | 34% | 50% |
| Manager | 9% | 7% |
| Executive | 6% | 6% |
Source: AKA Security analysis, same postings. With 2024's mix of seniority levels, the 2026 median midpoint is $175k, +23.3% on 2024 rather than +27.4%. Entry individual contributors rose +18.7% (+11 to +34) and senior individual contributors +28.7% (+18 to +38).
The posted range also widened. The median gap between the top and bottom of a range was $40k in 2024 and $68k in 2026, +68.8% (+35 to +105).
4No family measurably led
On the central figures, GRC, privacy and programs rose more than engineering, and detection, response and offensive rose most of all. None of the gaps between families is clear: each is too small to tell apart from no difference.
| Family against family | Gap in change, points | Likely range (95%) |
|---|---|---|
| GRC, privacy and programs against engineering | +1.2 | −18 to +20 |
| GRC, privacy and programs against detection, response and offensive | −0.2 | −20 to +20 |
| Engineering against detection, response and offensive | −1.4 | −19 to +16 |
Source: AKA Security analysis. Likely ranges (95%) are found by redrawing each family's companies many times.
Bars show each range of likely values against zero (dashed). Solid: the whole range is above or below zero. Grey: it ends at zero. Hollow: it includes zero.
The families pool these specialties. Engineering: general security engineer, AppSec / product, infra / network, cloud security, IAM and AI security. Detection, response and offensive: detection & response, threat intel, vuln management, offensive and general security analyst. GRC, privacy and programs: GRC, privacy and program / project. Architecture and leadership stand alone.
5By specialty
| Specialty | Postings, 2024 → 2026 | Change | Likely range (95%) | Thin in 2024 |
|---|---|---|---|---|
| Privacy | 6 → 58 | +42.6% | +20 to +72 | Yes |
| IAM | 18 → 73 | +36.6% | +16 to +65 | Yes |
| GRC | 69 → 169 | +26.1% | +13 to +44 | |
| General security engineer | 93 → 398 | +23.8% | +11 to +38 | |
| Offensive | 10 → 70 | +19.2% | −9 to +58 | Yes |
| Infra / network | 23 → 214 | +34.9% | +18 to +48 | Yes |
| Program / project | 11 → 54 | +24.5% | +10 to +72 | Yes |
| Cloud security | 8 → 72 | +15.6% | +6 to +93 | Yes |
| Detection & response | 28 → 222 | +23.8% | +15 to +43 | Yes |
| General security analyst | 30 → 60 | +28.2% | +0 to +58 | |
| AppSec / product | 39 → 411 | +15.3% | +2 to +40 | |
| Vuln management | 9 → 30 | +1.2% | −14 to +53 | Yes |
| Architecture | 19 → 105 | −0.1% | −7 to +24 | Yes |
| Threat intel | 6 → 28 | +10.6% | −17 to +39 | Yes |
| AI security | 2 → 161 | Not answerable | Yes | |
| General security leadership | 24 → 69 | +21.0% | +2 to +47 | Yes |
Source: AKA Security analysis, same populations as above. Thin means fewer than 30 postings or 10 companies with pay in that year. A change whose likely range includes zero is not measurable. General security analyst (+0 to +58) is a likely but borderline rise.
Bars show each range of likely values against zero (dashed). Solid: the whole range is above or below zero. Grey: it ends at zero. Hollow: it includes zero.
6Inside the same companies
74 companies had security postings in both years. 37 of them posted pay in both. Their 61 postings in 2024 and 382 in 2026 moved +12.9%, with a likely range from −1 to +38. No family shows a clear change there: engineering +11.3% (−2 to +44), detection, response and offensive +31.8% (−7 to +57), GRC, privacy and programs +13.5% (−4 to +57).
Two explanations fit that range. Posted ranges at these companies may have moved little while the rise came from which companies post pay. Or the 37 companies are too few to show a rise of the size seen across all postings. The data cannot separate the two.
7Paid wages for comparison
The Bureau of Labor Statistics survey of employers (Occupational Employment and Wage Statistics) reports what information security analysts are paid, not what postings offer.
| Information security analysts, US | May 2024 | May 2025 | Change |
|---|---|---|---|
| Median annual wage | $124,910 | $129,180 | +3.4% |
| Mean annual wage | $127,730 | $132,510 | +3.7% |
Source: Bureau of Labor Statistics, Occupational Employment and Wage Statistics, national estimates for occupation 15-1212. May 2025 is the latest release. No 2026 figure exists yet.
The survey covers one year of the two and a half between the posting samples, and one occupation code that includes many analyst roles and few engineers or leaders.
8Where the data comes from
The 2024 postings come from the LinkedIn Job Postings dataset (Hugging Face datastax/linkedin_job_listings [2]): postings located in the US and listed between 5 and 19 April 2024. 1,038 postings are in scope and 872 remain after removing staffing firms. 305 carry pay in LinkedIn's structured fields. 90 more state a range only in the description, and a parser (a program that pulls the pay range out of the posting text) read those.
The 2026 postings come from AKA's daily read of company job boards: 4,587 security postings at US-headquartered companies, 4,442 after removing staffing firms. Both years go through one set of rules: the series' security title rules, a local model's read of whether each posting is a security role, and one posting per company and title. Job aggregators, which repost other employers' openings, are left out in both years, and the 2026 postings are those still open on or after 23 September 2026.
The same parser read the pay range from each description. For Ashby and Lever boards, which publish pay in a separate field, AKA read the field from each board on 30 September for postings still open. That added pay for 246 postings that state none in their text. Where a posting lists several ranges by location, the highest counts. Counting the lowest instead gives +25.6%.
The two years read pay differently. In 2024, 305 of the 395 ranges come from structured posting fields. In 2026, pay comes from posting text for 1,948 postings and from the board field for 246. Within the 37 companies that posted pay in both years, the change is +12.9% (−1 to +38).
An AI model read 300 of the 2026 postings blind and extracted the pay itself. The parser agreed on whether pay was posted with 99.0% precision and 97.5% recall, and on the range within 2% for 194 of 198 postings. Of the postings it said showed pay, 99.0% did, and it found 97.5% of those that showed pay.
The share of eligible postings showing pay was 46% in 2024 and 50% in 2026 (likely range −2.1 to +10.0 percentage points, too small to tell apart from no change). Without the Ashby and Lever field, the 2026 share is 44%.
No causal claim follows. A posted range is what a company advertises for an opening, not what a hire is paid.
9How this answer was stress-tested
| Test | What it found |
|---|---|
| Same companies. The 37 companies with pay in both years. | +12.9% (−1 to +38). No clear change. A finding of a rise whose same-companies check shows no clear change is kept at Medium. |
| Outside technology companies. | +18.8% (+12 to +26). |
| Postings of similar length. | +29.2% (+17 to +46). |
| Each company weighted once. | +31.8% (+26 to +40). |
| Largest contributing company removed. | +28.7% (+20 to +37). |
| 2024 structured pay only, without the parsed descriptions. | +28.9% (+20 to +37). |
| Lowest range for 2026 postings that list several. | +25.6% (+17 to +33). |
| Without the Ashby and Lever pay field. | +25.1% (+17 to +34). |
| 2024 postings where people applied through the company's own site. | +18.1% (+6 to +36). |
| 2026 reweighted to 2024's mix of seniority levels. | +23.3%. |
| Parser against a blind AI model read, 300 postings. | 99.0% precision, 97.5% recall, 194 of 198 ranges within 2%. |
The same checks by family:
| Check | GRC, privacy and programs | Engineering | Detection, response and offensive | Individual contributors |
|---|---|---|---|---|
| Headline | +29.3% (+16 to +47) | +28.1% (+19 to +41) | +29.5% (+17 to +45) | +29.9% (+22 to +39) |
| Same companies | +13.5% (−4 to +57) | +11.3% (−2 to +44) | +31.8% (−7 to +57) | +18.1% (−0 to +38) |
| Outside technology companies | +20.1% (+9 to +37) | +16.8% (+10 to +29) | +26.5% (+12 to +41) | +20.9% (+14 to +28) |
| Postings of similar length | +25.9% (+9 to +72) | +33.8% (+16 to +48) | +35.6% (+18 to +69) | +34.1% (+20 to +49) |
| Each company weighted once | +30.8% (+17 to +48) | +33.5% (+22 to +42) | +33.3% (+20 to +52) | +33.7% (+28 to +44) |
| Largest contributing company removed | +27.2% (+15 to +44) | +27.4% (+19 to +40) | +29.4% (+16 to +44) | +30.0% (+22 to +39) |
| 2024 structured pay only | +29.4% (+17 to +53) | +29.5% (+18 to +42) | +32.1% (+20 to +50) | +31.1% (+23 to +40) |
| Lowest range, 2026 | +26.9% (+15 to +43) | +25.5% (+17 to +38) | +29.4% (+16 to +44) | +28.3% (+20 to +37) |
| Without the Ashby and Lever pay field | +29.3% (+16 to +45) | +25.7% (+17 to +38) | +29.4% (+17 to +44) | +28.2% (+20 to +36) |
| 2024 postings through the company site | +14.3% (−1 to +40) | +10.5% (−2 to +38) | +39.3% (+10 to +76) | +20.2% (+7 to +41) |
Source: AKA Security analysis, likely ranges (95%) from redrawing companies. Individual contributors at the same companies (−0 to +38) show a likely but borderline rise. Engineering and GRC, privacy and programs through the company site, and the three families at the same companies, show no clear change.
10What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| More companies with pay in both years | Whether the rise holds within the same employers | 37 companies is what the two samples share. The number grows as more 2026 boards publish pay. |
| H-1B wage filings, fiscal 2024 to 2026 | A single-source series by title and employer across all three years | A different measure (wages filed for sponsored hires), and a separate analysis. Planned for the next release. |
| A 2026 LinkedIn sample | Removes the difference in collection method | No public 2026 LinkedIn dataset exists. |
| Pay from every board, for every posting | Pay for Ashby and Lever postings that closed before 30 September | Collection now keeps the field. The August and September postings that closed cannot be read again. |
| Paid wages for 2026 | Whether paid wages for information security analysts rose over the same period as posted ranges | The next Bureau of Labor Statistics release covers May 2026 and is due in spring 2027. |
Acknowledgements
Question asked by Ross Young.
References
- [1]AKA Security Research Factory. Security Hiring Research: What Job Postings Say About Security Work. AKA Security, 2026. akasecurity.io/research/security-hiring-research
- [2]DataStax. LinkedIn Job Postings (datastax/linkedin_job_listings). Hugging Face dataset, 2024. huggingface.co/datasets/datastax/linkedin_job_listings
Cite as
@techreport{aka-rz-2026-08,
title = {Which Security Roles' Posted Pay Ranges Rose Most Since 2024? Posted Pay Rose Across Security Postings, After Inflation Too},
author = {{AKA Security Research Factory}},
institution = {AKA Security},
type = {Research report},
number = {AKA-RZ:2610.08v1},
version = {1.0.0},
year = {2026},
month = oct,
url = {https://akasecurity.io/research/security-pay-ranges}
}