Blue team jobs report: October 2026
490 new blue team jobs from 114 employers in October 2026. SOC analysts led with 83.
Covers every defensive security job first listed on BlueTeamJobs in October 2026, counted once even when an employer posted it more than once.
October 2026 at a glance
- New jobs
- 490
- Employers
- 114
- Remote
- 30.6%
- Entry level
- 4.9%
- Published pay
- 44.3%
SOC analysts
83 new jobs. 31.3% remote, 12% entry level. Median published pay $113,000, with the middle half between $76,000 and $145,000 (37 postings with pay).
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| Security+ | 25 | 30.1% | |
| CISSP | 17 | 20.5% | |
| GCIH | 14 | 16.9% | |
| CySA+ | 12 | 14.5% | |
| GSEC | 12 | 14.5% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| SIEM | 43 | 51.8% | |
| Python | 29 | 34.9% | |
| AWS | 27 | 32.5% | |
| MITRE ATT&CK | 26 | 31.3% | |
| EDR | 23 | 27.7% |
Browse open roles: SOC Analyst jobs. Pay detail: SOC Analyst salaries.
DFIR and incident response
69 new jobs. 50.7% remote, 0% entry level. Median published pay $154,000, with the middle half between $128,000 and $182,000 (18 postings with pay).
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| SIEM | 37 | 53.6% | |
| AWS | 27 | 39.1% | |
| EDR | 24 | 34.8% | |
| Python | 23 | 33.3% | |
| Azure | 21 | 30.4% |
Browse open roles: Digital Forensics (DFIR) jobs, Incident Responder jobs. Pay detail: Digital Forensics (DFIR) salaries.
Detection engineering and threat hunting
33 new jobs. 21.2% remote, 0% entry level. Median published pay $183,000, with the middle half between $155,000 and $220,000 (13 postings with pay).
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| SIEM | 22 | 66.7% | |
| Python | 21 | 63.6% | |
| MITRE ATT&CK | 16 | 48.5% | |
| EDR | 14 | 42.4% | |
| Splunk | 12 | 36.4% |
Browse open roles: Detection Engineer jobs, Threat Hunter jobs. Pay detail: Detection Engineer salaries.
Threat intelligence (CTI)
28 new jobs. 32.1% remote, 3.6% entry level. Median published pay $161,000, with the middle half between $142,000 and $190,000 (14 postings with pay).
| Certification | Jobs | Share | Bar |
|---|---|---|---|
| Security+ | 7 | 25% | |
| CySA+ | 6 | 21.4% | |
| GCTI | 4 | 14.3% | |
| GSEC | 4 | 14.3% | |
| CISSP | 3 | 10.7% |
| Skill | Jobs | Share | Bar |
|---|---|---|---|
| Python | 13 | 46.4% | |
| MITRE ATT&CK | 11 | 39.3% | |
| SIEM | 8 | 28.6% | |
| EDR | 7 | 25% | |
| AWS | 6 | 21.4% |
Browse open roles: Threat Intelligence (CTI) Analyst jobs. Pay detail: Threat Intelligence (CTI) Analyst salaries.
Every role
| Role | Jobs | Share | vs September 2026 | Bar |
|---|---|---|---|---|
| Security Engineer | 214 | 43.7% | new | |
| SOC Analyst | 83 | 16.9% | new | |
| Incident Responder | 50 | 10.2% | new | |
| Threat Intelligence (CTI) Analyst | 28 | 5.7% | new | |
| Cloud Security Engineer | 22 | 4.5% | new | |
| Security Operations Leadership | 22 | 4.5% | new | |
| Detection Engineer | 20 | 4.1% | new | |
| Digital Forensics (DFIR) | 19 | 3.9% | new | |
| Vulnerability Management | 16 | 3.3% | new | |
| Threat Hunter | 13 | 2.7% | new | |
| Governance, Risk and Compliance (GRC) | 2 | 0.4% | new | |
| Identity and Access Management (IAM) | 1 | 0.2% | new |
Using these numbers
You're welcome to quote or chart this report in a newsletter, article or talk. Please link back to this page. The counts come from jobs first listed on BlueTeamJobs in the month, from employers' own applicant tracking systems and direct posts. Offensive roles such as pentesting aren't included. Pay figures use US postings that published a salary, at the midpoint of each range.
More: all monthly reports, quarterly hiring reports and salary data.