The cyber talent shortage? Job postings just hit a four-year low

US employers posted 235,786 cybersecurity jobs from January through September 2026. That is the lowest total for those months in the four years that staffing and workforce intelligence firm CyberSN has tracked. They pulled the listings from job data provider JobSpikr, removed duplicates and sorted each one by the security work it described.

The postings that remain have drifted toward governance, risk and compliance (GRC), the teams that track an organization’s risk and answer to auditors, regulators and boards. Defense covers the engineers and analysts who run and monitor security controls. It still holds the largest share of listings, but that share is shrinking. Job seekers in hands-on technical roles are applying into a smaller market, and CISOs drawing up 2027 headcount plans are hiring in a field where demand has moved.

The drop is real, and 2025 makes it look bigger

The count covers the US only and tracks postings, which measure what employers advertised, not how many people were hired. Measured against last year, the decline looks steep. Postings fell 26.4% from 320,210 in the same months of 2025. But 2025 was an unusually strong year, and against 2024 the gap narrows to about 4%. Put plainly, 2026 gave back everything 2025 added and then slipped a little further.

September was the one month of the nine to beat its 2025 figure. It did so by fewer than 400 postings, too thin a margin to call a recovery.

CISO hiring stalls, then restarts

Leadership postings followed the same arc. Listings for CISOs fell 38.9% from 2025’s record and landed close to 2024 levels. Between the second and third quarters of this year, they climbed 19.5%.

Asked what is behind the swings, Deidre Diamond, CEO of CyberSN, said: “I believe the volatility we’re seeing in security leadership hiring may have more to do with disruption across the C-suite than a fundamental decline in the need for security leaders.”

“We’ve seen significant executive turnover, organizational restructuring, and shifting priorities at the leadership level. When a CEO, CIO, CFO or other executive sponsor changes, security hiring can stall. Open positions get put on hold, budgets are reconsidered, and hiring decisions are delayed until new leadership establishes its priorities,” Diamond told Help Net Security. “Security roles need executive champions, decision-makers, and budget approval. When those relationships are disrupted, hiring is disrupted.”

Diamond also allowed for a second explanation: “It’s also possible that some organizations eliminated security leadership positions only to realize they couldn’t effectively operate without that expertise. However, I’m leaning more toward broader C-suite instability as a significant contributor to the fluctuations we’re seeing.”

“The demand for security leadership hasn’t necessarily disappeared. Instead, organizations may be delaying, consolidating, or redefining these roles as they reassess their broader business and technology strategies. The organizational ability to act on that demand may be what’s changing.”

Compliance takes a bigger slice

Since 2023, GRC’s share of postings has grown from 9.4% to 14.8%, while defense fell from 47.1% to 41.5%. Defense still accounts for about four in ten listings. Much of GRC’s gain comes from privacy and cybersecurity attorneys. They are the only one of the ten largest role categories to post more listings this year than last.

Offensive roles moved the other way. Postings for penetration testers fell by nearly half against 2025. A few small specialties grew. AI security engineer postings more than tripled, though they still number only about 2,400.

Asked whether the shift should change where security leaders invest in 2027, Diamond said: “This trend makes a great deal of sense to me. Risk is the biggest conversation in the room right now, so it’s not surprising to see the risk category grow.”

“Organizations are focused on identifying and understanding the risks they face, determining where those risks exist, and making informed decisions about how to address them. That focus naturally increases the need for people who can support risk management, governance, audit, and compliance.”

“GRC capabilities help organizations find risk, understand it, and provide the visibility and accountability needed to make decisions about it,” Diamond said. “I think what we’re seeing is a shift in how organizations prioritize cybersecurity capabilities.”

Get weekly updates on new cybersecurity job openings. Subscribe here!