Federal Cybersecurity Hiring Statistics

Method

• +Every figure on this page, except the hand review results below, is computed from the federal job announcements that opened on USAJOBS since 2017-01, synced from the USAJOBS Historic JOA and Announcement Text APIs. Data as of 2026-11-10. Figures for "the 12 months" cover the last 12 complete calendar months, November 2025 to October 2026.
• +Searched series: 2210 (Information Technology Management), 0080 (Security Administration), 0132 (Intelligence), 0301 (Miscellaneous Administration And Program), 0343 (Management And Program Analysis), 0391 (Telecommunications), 0501 (Financial Administration And Program), 0801 (General Engineering), 0854 (Computer Engineering), 0855 (Electronics Engineering), 1550 (Computer Science), 1811 (Criminal Investigation), 2299 (Information Technology Student Trainee).
• +An announcement counts as a cybersecurity job when its title names cyber work: cyber in any form (which includes cyber operations, cyber intelligence, cyber policy, and cyber workforce titles), INFOSEC, information systems security, information assurance, ISSO or ISSM, CISO, security control assessor, penetration testing, digital forensics, system vulnerability analysis, network exploitation, zero trust, DevSecOps, or COMSEC. In the computing series 2210, 2299, 1550, and 0854, a title that names security, vulnerabilities, threats, cryptography, a red team, a security operations center, incident response, or governance, risk, and compliance counts too.
• +A 2210 or 2299 announcement with a generic title such as "IT Specialist" counts when its text says the position is a cybersecurity specialist, manager, officer, or expert, a system security officer, or an information assurance manager, gives the position a security specialty, manages an organization-wide security program, or lists security work as its first duty. A DCWF work role code alone does not count, because announcements list codes as personnel-system text.
• +IT jobs without a security specialty do not count. Neither does security work outside computing: physical, personnel, industrial, and classified-information security (including INFOSEC in the 0080 security administration series), antiterrorism, insider threat, and privacy programs, nor assistants and business staff whose title only names a cyber organization. A forensics title outside IT counts only when its text describes digital evidence work.
• +A hand review of random samples on 2026-11-09 checked the matching. Of 300 counted announcements, 290 were cyber jobs, 7 were not (mostly OPM's IT Cybersecurity Specialist title with other duties), and 3 were unclear. Of 200 uncounted 2210 and 2299 announcements, 5 were cyber jobs, so the counts miss an estimated 7% (95% range about 3% to 15%). Yearly samples of 100 found 1 in 2024, 2 in 2025, 0 in 2026 (January to July).
• +The counts cover jobs advertised on USAJOBS. Jobs an agency advertises only on its own careers site are not in them, and defense means the Department of Defense and the military departments, by the department each announcement names.
• +Counts are of announcements, not vacancies. One announcement can fill several positions, announcements later canceled still count, and 8% of the announcements in the 12 months repeat the agency, title, grade, and states of another one opened up to 14 days earlier.
• +Pay is the advertised yearly salary; hourly, unpaid, and yearly minimums under $15,000 (placeholders or typos) are left out. Starting salary is the lowest salary offered. Remote means the USAJOBS location "Anywhere in the U.S. (remote job)"; telework is not counted. A clearance counts at Confidential, Secret, Top Secret, SCI, or Q or L access; Public Trust, Other, and Not Required do not.
• +DoD 8140 and certification figures come from the announcement text. A certification counts by its name, former name, or abbreviation; abbreviations that are also other words (CISA, CND, CFR, GRID, CC, CAP, CGRC) need the full name or another certification nearby.
• +Medians are the middle value; with an even count, the average of the two middle values. Percentages are rounded to whole numbers.

Cite This Page

The figures change with the data, so a citation should include the data date.