Security Engineer salaries and job demand
Last updated
Security Engineer roles typically advertise around US$175,000 a year. Here's the current salary range, hiring demand, and the skills employers ask for most.
What do Security Engineer roles pay in 2026?
As of October 2026, the typical advertised salary is US$175,000 a year, with most postings between US$145,000 and US$205,000.
| 25th percentile | US$145,000 |
|---|---|
| Median (50th percentile) | US$175,000 |
| 75th percentile | US$205,000 |
Advertised base salary, from 231 job postings with pay data, as of October 2026.
Disclosed base wage (H-1B/LCA)
Employers disclose a median base wage of US$140,000 on H-1B/LCA visa filings for this role, between US$106,995 and US$172,827, against the US$175,000 median advertised above.
| 25th percentile | US$106,995 |
|---|---|
| Median (50th percentile) | US$140,000 |
| 75th percentile | US$172,827 |
Disclosed base wage, from 5,091 H-1B/LCA filings, U.S. DOL OFLC, as of Q4 2025.
| Period | 25th percentile | Median | 75th percentile |
|---|---|---|---|
| Q3 2024 | US$112,000 | US$145,000 | US$175,000 |
| Q4 2024 | US$118,693 | US$144,971 | US$177,872 |
| Q1 2025 | US$113,381 | US$144,800 | US$173,056 |
| Q2 2025 | US$98,983 | US$126,747 | US$164,212 |
| Q3 2025 | US$112,346 | US$145,887 | US$180,000 |
| Q4 2025 | US$120,286 | US$149,712 | US$181,907 |
How strong is hiring demand for Security Engineer roles in 2026?
Tarmac tracked 825 postings in September 2026, the most recent month we tracked from start to finish.
We're not publishing a month-by-month series yet: the number of postings Tarmac collects each month is still growing, so a month-on-month change would measure our coverage rather than the job market.
Skills employers ask for
- cloud-security2290
- aws2215
- python1927
- vulnerability-management1383
- siem-soar1241
- threat-modeling1215
- kubernetes1178
- network-security1071
- http-apis993
- ci-cd-pipelines985
- identity-access-management978
- devops918
Postings for this role that named each skill, out of the postings we could parse. Bars run to 2290, the most-asked skill here.
Which skills to study first
These skills matter most for this role, scored together on how often employers ask for them, what they pay, and how often people pass them when they practise.
| Skill | Market demand | Median pay | Pass rate | Leverage | Practice |
|---|---|---|---|---|---|
| Python | 55% of postings44,668 postings | US$167,500+26% | Not enough data yet | — | Practice |
| AWS | 42% of postings34,123 postings | US$172,500+30% | Not enough data yet | — | Practice |
| HTTP & APIs | 22% of postings18,019 postings | US$165,000+24% | Not enough data yet | — | Practice |
| CI-CD Pipelines | 20% of postings16,267 postings | £76,840+2% | Not enough data yet | — | Practice |
| Kubernetes | 18% of postings14,788 postings | £80,000+7% | Not enough data yet | — | Practice |
| DevOps | 14% of postings11,323 postings | £80,000+7% | Not enough data yet | — | Practice |
| Cloud Security | 5% of postings4,097 postings | US$180,000+35% | Not enough data yet | — | Practice |
| Network Security | 4% of postings2,910 postings | A$129,326 | Not enough data yet | — | — |
| Identity & Access Management | 4% of postings2,889 postings | A$135,016 | Not enough data yet | — | — |
| SIEM & SOAR | 3% of postings2,528 postings | £72,000−4% | Not enough data yet | — | Practice |
| Vulnerability Management | 3% of postings2,256 postings | US$165,000+24% | Not enough data yet | — | Practice |
| Threat Modeling | 2% of postings1,754 postings | US$176,000+32% | Not enough data yet | — | Practice |
Pass rate is the share of correct answers among people who practised that skill on Tarmac, a self-selected group rather than every developer, so read it as relative difficulty, not a universal stat. It comes from how people actually scored, not what anyone claimed, and a dash in that column means not enough people have practised the skill here yet. Leverage scores demand, pay, and difficulty together (out of 100); a higher score means a skill is both worth learning and worth your study time.
Pay by level and city in United States
These figures cover United States postings only, as of October 2026. The median above pools every level and every city; these split it, so you can read the rung you are actually applying for.
| Level | 25th | Median | 75th | Postings with pay |
|---|---|---|---|---|
| Junior | US$85,000 | US$97,638 | US$150,070 | 5 |
| Mid-level | US$133,138 | US$157,500 | US$184,406 | 32 |
| Senior | US$145,000 | US$175,000 | US$202,550 | 165 |
| Staff+ | US$182,500 | US$232,000 | US$252,000 | 25 |
| City | 25th | Median | 75th | Postings with pay |
|---|---|---|---|---|
| San Francisco, CA | US$177,000 | US$215,000 | US$245,000 | 39 |
| Seattle, WA | US$180,850 | US$202,550 | US$220,500 | 29 |
| Washington, DC | US$142,500 | US$175,000 | US$190,000 | 29 |
| Chicago, IL | US$138,613 | US$169,375 | US$184,625 | 28 |
| Los Angeles, CA | US$118,900 | US$145,000 | US$157,500 | 19 |
| New York, NY | US$135,100 | US$182,500 | US$209,750 | 19 |
Advertised base salary. A level or city with too few postings quoting pay is left out rather than shown on a thin sample.
What it takes
The entry bar and required skills employers ask for. Most job ads reach us as a short summary rather than the full posting, and the percentages below count only the ones we have in full — so they skew toward employers who publish a fuller description. Every bar runs 0 to 60% of those postings: solid is required, outlined is preferred, dashed is the posting's own words.
Australia
Required
Preferred
In the postings’ own words
Required
Preferred
In the postings’ own words
Required
Preferred
In the postings’ own words
Required
Preferred
In the postings’ own words
United States
Required
Preferred
In the postings’ own words
Required
Preferred
In the postings’ own words
- Years asked up 5 years over the last 5 weeks.
Required
Preferred
In the postings’ own words
- Google Cloud Platform now required in 40% of postings, was 20% 6 weeks ago.
- Threat Modeling required in only 20% of postings, was 100% 6 weeks ago.
- Java required in only 20% of postings, was 40% 6 weeks ago.
- Vulnerability Management required in only 40% of postings, was 60% 6 weeks ago.
United Kingdom
Required
Preferred
In the postings’ own words
- Network Security now required in 50% of postings, was 14% 4 weeks ago.
- Microsoft Azure now required in 50% of postings, was 29% 4 weeks ago.
- Identity & Access Management now required in 50% of postings, was 29% 4 weeks ago.
- CI-CD Pipelines required in only 17% of postings, was 43% 4 weeks ago.
- AWS required in only 17% of postings, was 29% 4 weeks ago.
- Google Cloud Platform required in only 17% of postings, was 29% 4 weeks ago.
Required
Not enough postings state a years-of-experience figure for Staff / lead yet.
Practice interview questions
Jobs data powered by Adzuna.
Disclosed wage data from the U.S. Department of Labor, OFLC.
Prep for these roles
Paste a job ad and practise a quiz built from what it asks, scored on the spot. One a day with no account, two a month on a free one.
Free plan · no card · sign in with an emailed code