Blue team hiring report: Q4 2026
Defensive security hiring from Oct 1, 2026 to Dec 31, 2026, from every SOC, incident response, detection and security engineering job BlueTeamJobs listed in the quarter.
Preview: this quarter's numbers are still coming in. The final report is published after the quarter ends.
Q4 2026 at a glance
- New blue team jobs
- 390
- Employers hiring
- 108
- Fully remote
- 29.2%
- Published pay
- 43.6%
Security Engineer was the most posted role, with 45.6% of new jobs. The median published salary across all roles was $163,000.
| Role | Jobs | Share | Remote | Median pay |
|---|---|---|---|---|
| Security Engineer | 178 | 45.6% | 21.3% | $179,000 |
| SOC Analyst | 69 | 17.7% | 31.9% | $101,000 |
| Incident Responder | 45 | 11.5% | 44.4% | $142,000 |
| Cloud Security Engineer | 19 | 4.9% | 26.3% | $171,000 |
| Detection Engineer | 19 | 4.9% | 26.3% | $191,000 |
| Digital Forensics (DFIR) | 17 | 4.4% | 70.6% | $165,000 |
| Security Operations Leadership | 16 | 4.1% | 31.3% | $230,000 |
| Vulnerability Management | 14 | 3.6% | 35.7% | $146,000 |
| Threat Hunter | 13 | 3.3% | 15.4% | $160,000 |
| Month | Jobs | Bar |
|---|---|---|
| October | 390 | |
| November | 0 | |
| December | 0 |
| Level | Jobs | Share | Bar |
|---|---|---|---|
| Mid level | 197 | 50.5% | |
| Senior | 126 | 32.3% | |
| Lead / manager | 48 | 12.3% | |
| Entry level | 19 | 4.9% |
| Arrangement | Jobs | Share | Bar |
|---|---|---|---|
| On-site | 223 | 57.2% | |
| Remote | 114 | 29.2% | |
| Hybrid | 53 | 13.6% |
| Clearance | Jobs | Share | Bar |
|---|---|---|---|
| None | 269 | 69% | |
| TS/SCI | 58 | 14.9% | |
| Top Secret | 29 | 7.4% | |
| Secret | 27 | 6.9% | |
| Public Trust | 7 | 1.8% |
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| CISSP | 87 | 22.3% | |
| Security+ | 72 | 18.5% | |
| GCIH | 53 | 13.6% | |
| CySA+ | 34 | 8.7% | |
| GCFA | 34 | 8.7% | |
| CISM | 33 | 8.5% | |
| CEH | 25 | 6.4% | |
| CCSP | 24 | 6.2% | |
| SecurityX (CASP+) | 23 | 5.9% | |
| GCIA | 20 | 5.1% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| SIEM | 165 | 42.3% | |
| Python | 161 | 41.3% | |
| AWS | 156 | 40% | |
| Azure | 115 | 29.5% | |
| GCP | 84 | 21.5% | |
| EDR | 78 | 20% | |
| PowerShell | 75 | 19.2% | |
| MITRE ATT&CK | 73 | 18.7% | |
| Splunk | 73 | 18.7% | |
| SOAR | 68 | 17.4% |
| State | Jobs | Share | Bar |
|---|---|---|---|
| Virginia | 66 | 16.9% | |
| California | 35 | 9% | |
| Maryland | 20 | 5.1% | |
| New York | 15 | 3.8% | |
| Ohio | 13 | 3.3% | |
| District of Columbia | 11 | 2.8% | |
| Washington | 10 | 2.6% | |
| Texas | 8 | 2.1% | |
| Alabama | 5 | 1.3% | |
| Colorado | 5 | 1.3% |
| Employer | Jobs | Share | Bar |
|---|---|---|---|
| Accenture Federal Services | 27 | 6.9% | |
| GuidePoint Security | 20 | 5.1% | |
| Agile Defense | 14 | 3.6% | |
| Rocket Lab | 12 | 3.1% | |
| UltraViolet Cyber | 12 | 3.1% | |
| Electrosoft | 11 | 2.8% | |
| Palantir Technologies | 11 | 2.8% | |
| Sophos | 11 | 2.8% | |
| Huntress | 9 | 2.3% | |
| Stripe | 9 | 2.3% |
| Level | Median | Middle half | Jobs | Range |
|---|---|---|---|---|
| Entry level | $49,000 | $46,000 – $60,000 | 8 | |
| Mid level | $145,000 | $119,000 – $179,000 | 76 | |
| Senior | $180,000 | $143,000 – $204,000 | 61 | |
| Lead / manager | $183,000 | $170,000 – $261,000 | 25 |
Method
Every defensive security job BlueTeamJobs first listed during the quarter, from employers' applicant tracking systems and from moderated employer posts. Reposts of the same job count once; offensive and non-security roles are never listed. Pay uses the midpoint of each published US dollar range, converted to a full-time year. Certification and skill shares count jobs that mention them.