US employers posted 235,786 cybersecurity jobs from January through September 2026, the lowest total for that period in the four years tracked by workforce intelligence firm CyberSN. The figure is 26.4% below the same months in 2025, but 2025 was an unusually strong year; against 2024, the decline narrows to about 4%. September beat its 2025 total by fewer than 400 postings, too small a margin to signal recovery.
The mix of advertised roles is changing. Governance, risk, and compliance (GRC) postings have grown from 9.4% of the total in 2023 to 14.8% now, while defense roles fell from 47.1% to 41.5%. Privacy and cybersecurity attorneys were the only large category to post more listings this year than last. Penetration tester postings fell by nearly half, while AI security engineer postings more than tripled but still number only about 2,400.
Leadership hiring followed a similar arc. CISO postings fell 38.9% from 2025's record and landed close to 2024 levels, though they climbed 19.5% between the second and third quarters. CyberSN CEO Deidre Diamond attributes the swings less to a fundamental decline in demand and more to disruption across the C-suite. When CEOs, CIOs, or CFOs change, security hiring can stall as budgets and priorities are reassessed.
Diamond said the growth in GRC makes sense because risk is the central conversation for organizations right now. The demand for security leadership has not necessarily disappeared, she argued; rather, organizations may be delaying, consolidating, or redefining roles as they reassess broader business and technology strategy. The data comes from a single source, CyberSN's analysis of JobSpikr listings, and tracks postings rather than actual hires.