Security Engineer job market report

Which skills postings mention

Share of the 811 Security Engineer postings we have read that name each skill. Ranked by how often it appears, not by how important anyone thinks it is.

These are mentions, not requirements. Our extraction returns one list per posting and does not separate “5+ years required” from “a plus”, so both are counted here. Read a percentage as how often a skill comes up, never as how often it is mandatory.

From 825 postings (56.2% of this role) whose full description we have read. That subset was selected by our job-matching system rather than at random, so treat this as describing the subset rather than the whole market. Why.

1. 1incident response30.5%
2. 2python29.2%
3. 3aws27.1%
4. 4cloud security25.6%
5. 5threat modeling25.4%
6. 6automation19.6%
7. 7vulnerability management19%
8. 8azure16.2%
9. 9gcp16.2%
10. 10ci/cd15.9%
11. 11siem15.8%
12. 12go15.4%
13. 13network security14.2%
14. 14application security14.1%
15. 15iam12.3%
16. 16terraform12.2%
17. 17kubernetes11.6%
18. 18penetration testing11.5%
19. 19security architecture9.5%
20. 20linux9.4%
21. 21edr8.9%
22. 22security engineering8.9%
23. 23sast8.8%
24. 24compliance8.4%
25. 25endpoint security8%

incident response leads at 30.5%, then python at 29.2% and aws at 27.1%. A skill appearing in a third of postings is worth learning; one appearing in 5% is worth knowing exists.

How much experience is expected

The seniority mix below covers all 1,468 postings. Among the ones we have read, half of those stating a number ask for 5+ years, and the middle 50% sit between 4 and 7.

1. 1No level in title48%
2. 2Senior29.7%
3. 3Staff9.9%
4. 4Principal3.7%
5. 5Lead3.4%
6. 6Entry level / junior2.2%
7. 7Manager2%
8. 8Director+0.7%
9. 9Internship0.3%

What it pays

Annual base ranges as stated by employers. Read the caveats at the bottom before quoting any of these — the disclosing minority is not a random sample.

From 825 postings (56.2% of this role) whose full description we have read. That subset was selected by our job-matching system rather than at random, so treat this as describing the subset rather than the whole market. Why.

Where the jobs are

Share of postings by metro. Postings we could not place to a metro are not counted here, so these shares describe the located subset.

1. 1Remote17.7%
2. 2San Francisco, CA7.4%
3. 3New York, NY6.7%
4. 4Other — CA5.8%
5. 5Other — VA5.4%
6. 6Washington, DC5%
7. 7Silicon Valley, CA4.4%
8. 8Other — MD3.2%
9. 9Seattle, WA2.6%
10. 10Austin, TX2.2%
11. 11Boston, MA1.9%
12. 12Los Angeles, CA1.8%
13. 13Chicago, IL1.6%
14. 14Other — UT1.6%
15. 15Other — TX1.3%

Remote, hybrid or on-site

25.1% of these postings are explicitly remote and 22.3% are explicitly on-site. A large "not stated" share is normal — many descriptions simply never say.

1. 1Not stated39.3%
2. 2Remote25.1%
3. 3On-site22.3%
4. 4Hybrid13.3%

From 825 postings (56.2% of this role) whose full description we have read. That subset was selected by our job-matching system rather than at random, so treat this as describing the subset rather than the whole market. Why.

Who is hiring

Employers with the most open Security Engineer postings this month. The number beside each is their posting count.

• Ngc38
• Spacex38
• Caci31
• Accenture Federal Services19
• Brightvisiontechnologies19
• Aurora Innovation16
• Guidepointsecurity16
• Abbvie15
• Zantech It14
• Anduril Industries12
• Braze10
• Electrosoft10
• Barbaricum9
• Anthropic8
• Comcast8

Visa sponsorship

22.2% of Security Engineer postings sit at employers that appear in US government H-1B approval records for the last three fiscal years. That is a property of the employer, not a promise about this role.

Employers hiring most for this role who appear in those filings:

• Aurora Innovation16
• Abbvie15
• Braze10
• Coreweave7
• Stripe6
• Brex5
• Cloudflare5
• Fluidstack5
• Servicenow5
• Chainguard4
• Datadog4
• Mozilla4

A further 1.7% of these postings are at employers whose job descriptions state that they sponsor, but which we could not find in the approval records. That is a weaker signal, so we count it separately rather than adding it to the figure above. It may simply mean the employer sponsors under a different legal name.

Separately, 14.8% of these postings require a security clearance, which in practice means US citizenship. If you need sponsorship, that slice of the market is closed to you regardless of the employer’s history — worth filtering out early rather than discovering at the final stage.

How to prepare, based on the above

Nothing in this section is generic advice. Every line is read off this month's numbers for this role.

1. Learn incident response, python, aws first. They appear in 30.5%, 29.2% and 27.1% of postings respectively. Anything below roughly 10% on the list above is a differentiator, not a prerequisite — useful once the top of the list is solid, and a poor use of your time before that.
2. Expect to be asked for 5 years. A stated minimum is a filter, not a rule, and the 4-year figure at the 25th percentile is the realistic target for the most reachable quarter of this market. Apply to those before the ones asking 7+.
3. Apply to far more postings than feels reasonable. With 2.5% of postings open to entry level, the addressable market for a new graduate this month is roughly 37 postings nationally. That is a volume problem before it is a quality problem.
4. Anchor on $140k–$212k when pay comes up — the middle half of disclosed ranges. Below the 10th percentile of $90k you are being underpaid relative to what employers in this corpus publish for the role.
5. If you need sponsorship, start from the employer, not the posting. 22.2% of this role’s postings are at companies that appear in H-1B approval records. Filtering by employer history first is a far better use of your time than applying broadly and asking later.