Read the work behind job descriptions before deciding what to staff or buy.
Investigate and respond to EDR/Microsoft 365 activity; shift-based operations
Continuous service requires real staffed coverage and handovers
Control evidence, audit/compliance work, vendor reviews and customer assurance
Evidence quality and workflow automation are substantial jobs
Technical supplier risk assessment, identity/cloud review and program leadership
Supplier risk can require technical depth beyond questionnaires
Detection/telemetry engineering, automation and governance of security operations
“AI SOC” still requires engineering ownership and operational oversight
Published compensation definitions differ. These four postings do not establish a typical midmarket salary or a representative hiring sample.
Source: Hiring signals → · Research cutoff: 20 October 2026
Research cutoff: 20 October 2026. Geography: United States unless expressly stated.
Hiring evidence points to specific operating needs, not a universal increase in every security budget. Separate a national occupational forecast, an observed job-posting dataset and a small selection of employer advertisements.
This brief uses US data and employer-hosted postings observed on 20 October 2026. Posting publication dates were not consistently available, so these are observations at the cutoff, not a list of jobs necessarily created that month. Availability and pay can change.
BLS's updated Information Security Analysts page reports a $129,180 median annual wage for May 2025, 192,900 jobs in 2025, 21% projected employment growth from 2025 to 2035, and about 14,100 annual openings over that projection period.
The pay fields are deliberately not standardized into a false common measure.
The employer examples show that these work queues exist.
Use a capacity model rather than a job title.
Avoid combining a CISO, penetration tester, detection engineer, auditor and 24-hour responder into one ordinary analyst role.
Ask for the roles that service your account, the shift handover process, escalation access and the limits of shared coverage.
Maintain a small, consistent sample of employer postings by role, location, seniority and compensation definition.
It is the BLS May 2025 median for the specified occupation, not a universal offer recommendation.
Read →The employer sample is purposive and small, not statistically representative of US midmarket salaries or vacancies. Posting dates and continued…
Read →cybersecurity hiring trends 2026; security operations analyst salary US; GRC analyst responsibilities; third-party risk manager salary; hire security engineer or MDR; AI SOC jobs.
Read →Uses primary labor data and specific employer postings while preserving compensation definitions.
Read →Sources and publication dates for Hiring signals. Undated product and job pages are observations at the research cutoff.
Read →Uses primary labor data and specific employer postings while preserving compensation definitions. Limited sample size and lack of local hiring data prevent a reliable 'typical midmarket' pay band.
Read the scoring context →
Cybersecurity buying research