Only 1 in 35 cybersecurity job postings is entry level: 2,875 openings counted
"Entry-level cybersecurity job" is one of the most searched phrases in the field, and one of the most argued about. Some people say there are millions of open seats; others say nobody hires juniors. We counted instead. O
"Entry-level cybersecurity job" is one of the most searched phrases in the field, and one of the most argued about. Some people say there are millions of open seats; others say nobody hires juniors. We counted instead. On 14 November 2026, CyberJobs.cc took the 2,875 security roles open at 638 employers, each read straight from the employer's own hiring system, and sorted them by the level each title states.
80 of them are entry level: 39 junior, associate, graduate or "level I" roles and 41 internships. That is 2.8%, about 1 posting in 35.
What level security postings ask for
| Level in the title | Postings | Share | Middle stated pay (US dollar postings, yearly) |
|---|---|---|---|
| Internship | 41 | 1.4% | $27 an hour |
| Junior, associate, graduate, level I | 39 | 1.4% | $144,500 (12 postings) |
| Level II | 20 | 0.7% | $167,000 |
| No level in the title | 1,054 | 36.7% | $182,500 |
| Senior or lead | 830 | 28.9% | $190,500 |
| Staff, principal or architect | 539 | 18.7% | $227,000 |
| Manager | 229 | 8.0% | $223,000 |
| Director and above | 123 | 4.3% | $261,000 |
Six in ten postings say senior or higher in the title. Another third say no level at all, and those are not junior roles in disguise: their stated pay sits at $182,500, close to the senior median.
The junior median of $144,500 needs a warning. Only 12 junior postings state a US dollar salary, and new-grad engineering roles at SpaceX, Anduril and Applied Intuition ($130,000 to $175,000) pull it up. The lower end is real too: Cobalt's associate security researcher states $60,000 to $80,000, and Alan's junior GRC engineer in France states EUR 61,000 to 70,000.
Where the entry-level roles are
| Specialty | Entry-level postings | Share of that specialty |
|---|---|---|
| Penetration testing and red team | 9 of 177 | 5.1% |
| GRC (governance, risk, compliance) | 16 of 342 | 4.7% |
| Threat intelligence and research | 3 of 87 | 3.4% |
| Security architecture and consulting | 12 of 364 | 3.3% |
| Security engineering | 22 of 687 | 3.2% |
| Security operations and incident response | 11 of 372 | 3.0% |
| Cloud security | 2 of 112 | 1.8% |
| Application security | 4 of 300 | 1.3% |
| Identity and access management | 1 of 140 | 0.7% |
| Security leadership | 0 of 294 | 0% |
Offensive security and GRC open the most doors for their size. Part of the GRC figure is one employer: Tevora, a consultancy, runs a summer and a winter internship across seven tracks (threat, enterprise risk, SOC 2 controls, healthcare, payments, federal and solutions), 14 postings at a flat $27 an hour. Cloud, AppSec and IAM hire almost nobody at the bottom: they expect you to arrive from engineering or operations.
Internships pay by the hour, and the spread is wide
28 internships state a US dollar hourly rate. The middle is $27, but that is Tevora's 14 tracks again; without them the middle is $37 an hour. The range runs from $18 (Rocket Lab's security analyst internships) to $74 (Figma's PhD security engineering intern). Product companies pay most: Tanium's cloud security intern and Galaxy's off-cycle security intern state $55, Appian's $50.
Most are for summer or winter 2027, so the window to apply is now, months before they start.
Remote junior roles exist, but they are rare
19 of the 80 entry-level roles are remote: Samsara's Security Operations Engineer I (remote from Austin, $95,200 to $144,000), Cobalt's associate security researcher (remote in the eastern or central US), GuidePoint Security's associate cloud security engineer (anywhere in the US), Ontinue's junior SOC analyst (remote in Canada), and a handful in India, Mexico, France and Germany. As with senior roles, "remote" almost always means remote inside one country.
What this means if you are trying to get in
- Apply to the 80, but do not wait on them. One posting in 35 is entry level. If you only apply to roles with "junior" in the title, you are choosing from a very small pool.
- Read the unlabelled third. A posting with no level in its title and two years in its requirements is worth applying to with strong project work; the title is not the filter, the requirements are.
- Go where juniors are hired: consultancies and SOCs. GRC consultancies, offensive security firms and managed detection providers train people, because billable hours and 24-hour rotas need people. Product security, cloud and IAM teams hire from inside engineering.
- Apply for 2027 internships now if you are a student. Most of the 41 open today start next summer.
Counts are from the roles open on 14 November 2026. Levels are read from each title; a title that says "Senior" or "II" counts as that level even if the requirements read otherwise. Pay is what each posting states, as the middle of its range, with hourly rates as 2,080 hours a year in the table. The snapshot is open data on Kaggle and Hugging Face under CC BY 4.0. The live lists, re-read every hour: entry-level cybersecurity jobs and cybersecurity internships.
This article was written by CyberJobs.cc's AI operator from the board's own data. CyberJobs.cc is a job board; some of its pages carry training partners' referral links, and none of those partners paid for or saw this article.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.