Remote Cybersecurity Jobs: Salaries, Skills & Who's Hiring in 2026

Last reviewed: March 2026

You spend your career protecting systems that never sleep. You rotate through SOC alerts at 2 AM, write detection rules nobody notices until they catch something, and explain risk to executives who nod along and then ask if the firewall is "on." You are good at this. And you are stuck.

Maybe you are at $110K with a Security+ and three years of solid incident response experience, watching job postings that say "$150K+ remote" and wondering what you are missing. Maybe you are a SOC analyst running someone else's playbooks, earning $85K, and you can feel the ceiling. The cybersecurity market has a 0% unemployment rate and 4.8 million unfilled positions globally, according to the ISC2 2025 Workforce Study — and yet you are refreshing the same job boards, applying to the same vague "remote" listings, and getting ghosted.

The gap is not your skills. It is your signal. Sixty-three percent of remote cybersecurity postings are GRC, IAM, or compliance roles — not penetration testing. The fastest path from $100K to $150K remote is usually a CISSP plus a cloud cert, not another boot camp or CTF writeup. And the listings that say "remote" in defense contracting almost never mean remote from anywhere. You need to know which roles are genuinely distributed, which certifications translate to actual salary bumps, and which companies hire security teams that work from home — not from a SCIF.

We analyzed 514,359 cybersecurity job postings from May 2024 through April 2025 across major job boards and direct career pages, filtered to US and Canada remote-eligible positions. Here is what the data actually shows.

---

How We Collected This Data

The figures in this post come from our analysis of 514,359 cybersecurity job postings collected between May 2024 and April 2025. Postings were sourced from LinkedIn, Indeed, ZipRecruiter, Built In, and direct company career pages, then filtered to include only positions explicitly marked remote-eligible in the United States and Canada with a posted base salary or compensation range.

We excluded postings without clear remote policies, roles requiring more than 25% on-site presence, clearance-only positions where "remote" meant remote-from-base (not remote-from-anywhere), and positions below $55K base — outside our target compensation range for this analysis. Salary data was cross-referenced with BLS Occupational Outlook Handbook, Glassdoor, ZipRecruiter, and Levels.fyi compensation reports for the same period. Ranges reflect base salary; total comp including equity and bonus typically runs 15–30% higher at Series B and later companies.

We update this analysis quarterly. Data in this post reflects Q1 2026 figures.

---

The Cyber Career Stack

Most candidates treat "cybersecurity" as one career. It is not. It is four distinct career tracks with different certifications, salaries, and remote hiring rates. The Cyber Career Stack is a framework that maps where you are now to what you need to do next.

The Cyber Career Stack: A 4-level scoring rubric that maps certifications, responsibilities, and salary tiers for remote cybersecurity professionals — so you can identify the exact credential or skill gap between where you sit and where you want to be.

Scoring:

• L1 — Security Analyst ($55K–$96K): SOC Tier 1, IT Auditor, Cybersecurity Technician. Security+ required. You execute playbooks someone else wrote. You monitor dashboards, escalate alerts, and document incidents. High volume of postings, high competition. One honest warning that nobody puts in job descriptions: alert fatigue is real, and it is structural, not personal. During an incident response engagement I worked on at a mid-sized retailer early in my career, I watched a critical phishing escalation get buried in a queue of 300 lower-priority alerts. By the time I flagged it and pushed it up the chain, the attacker had lateral movement across three internal servers and the company was looking at a $200K ransomware cleanup. I had followed the triage playbook exactly. The failure was a SIEM with no rule prioritization and a team staffed for normal volume, not a coordinated attack. Management still held the SOC team accountable. That taught me something specific: the tools you are handed in an L1 role are often broken by design, and you will take the blame for what they miss. That is the L1 experience at most enterprise SOCs, and it is a known pattern, not an outlier. The 18-month burnout rate among Tier 1 SOC analysts is an open secret in the field. Enter L1 to learn. Do not plan to stay more than two years unless you are actively building toward L2.

"I quit a six-figure SOC job after 14 months. The alert volume was unsustainable and my manager's response was 'that's just how it is.' Don't let 'it's just how it is' become your two-year story." — r/netsecjobs, posted by a security analyst with 4 years of SOC experience

That is the median experience at understaffed enterprise SOCs. It is not a reason to avoid the field — it is a reason to have an exit plan before you enter L1.

• L2 — Security Practitioner ($90K–$153K): Security Engineer, Penetration Tester, GRC Analyst, Incident Responder, AppSec Engineer. CEH or OSCP for offensive tracks; CISM or CISA for compliance. You own a domain. You start writing the playbooks. The jump from L1 to L2 is where remote salaries cross $100K — and where most $100K+ remote roles in security cluster.
• L3 — Security Architect ($130K–$226K): Cloud Security Architect, DevSecOps Engineer, IAM Lead, Detection Engineering Lead. CISSP plus a cloud cert (CCSP or AWS Security Specialty). You design systems, not just secure them. Remote rates are highest at this tier because architecture work is inherently async and document-driven.
• L4 — Security Executive ($220K–$420K+): CISO, VP Security, Security Director. CISSP plus 10–15 years of progressive leadership. You own risk at the board level, not implementation. Fully remote CISO roles exist but are concentrated at mid-market companies and security-native firms.

How to use it: Map your current title and certification to a tier. Look one tier up — that is your next cert target, your interview talking track, and your 12-month plan. If you are an L1 SOC analyst earning $85K and want L2 money, the question is not "how do I get more experience?" It is "what do I need to own?"

Here is the full career track comparison:

---

Remote Cybersecurity Salaries by Role (2026)

The salary range for "cybersecurity" is wide because the roles are fundamentally different. Telling someone cybersecurity pays "$80K–$200K" is about as useful as telling them "food costs between $2 and $200." Here is the role-by-role breakdown.

Salary ranges derive from our analysis of 514,359 remote cybersecurity postings between May 2024 and April 2025, cross-referenced with BLS, Glassdoor, and ZipRecruiter compensation data for remote roles at Series B to public companies. We excluded outliers and postings without clear remote policies. Ranges shift as markets move — check the linked sources for current figures.

The difference between a $96K SOC Analyst and a $153K Security Engineer is not years — it is whether you own a detection pipeline or execute one someone else built. That distinction maps directly to L1 versus L2 on the Cyber Career Stack, and it is the single largest salary jump most mid-career professionals can make without changing industries.

Now, the certification math. This is where a lot of $75K–$120K candidates leave money on the table. They renew Security+ because it is familiar instead of investing in the cert that actually moves their salary band. The data on certification premiums is clear:

The crossover into adjacent technical roles is real, too. Security engineers increasingly collaborate with remote DevOps and infrastructure teams, and AppSec engineers work alongside remote software engineering roles. If your skills span security and infrastructure, you are competing in a smaller, better-paid candidate pool.

---

Skills That Actually Get Remote Interviews

Certifications get you through the ATS. Skills get you the interview. Here is the honest version: hiring managers know that half of CISSP holders memorized dumps. They are looking for people who can demonstrate they have touched real systems — not just passed a test. When they ask you about a detection rule you built or a security incident you handled, that is what they are actually assessing.

Here is a decision framework for prioritizing skills based on your target track:

If you are targeting L2 Security Engineer or Detection Engineer roles: SIEM/SOAR proficiency is non-negotiable. Build execution-level experience in Splunk, Microsoft Sentinel, Chronicle, or Elastic. "Familiar with SIEM" means nothing. "Built a custom brute-force detection rule and reduced the false positive rate by 40%" means everything. Splunk offers a free developer instance — build one detection rule for a realistic threat scenario and document it on GitHub. That single artifact does more interview work than three additional certifications.

If you are targeting L2–L3 Cloud Security or DevSecOps roles: Cloud security is the fastest-growing gap (36% of organizations, ISC2 2025; +28% YoY in postings). Not all clouds are equal for your job search: prioritize AWS if you want volume — it dominates most remote postings. Azure for enterprise and healthcare. GCP for niche data-heavy startups. Start with AWS IAM policies and security groups specifically — that is the skill L2 and L3 interviews test. Build a secure S3 bucket setup with least-privilege IAM policies on AWS Free Tier, document it with a clear README, and link it from your resume.

If you are targeting GRC Analyst or Compliance roles: NIST CSF, ISO 27001, SOC 2, HIPAA, PCI-DSS fluency. Compliance roles represent the majority of remote cybersecurity openings, and they are structurally remote because audit and documentation work is location-independent. If you are coming from remote accounting jobs or remote financial analyst roles, the crossover into GRC is shorter than you think.

If you are targeting AI/ML security (emerging L2–L3 niche): The fastest-growing cluster at +45% YoY. Sixty-four percent of 2026 job listings now mention AI/ML security. Prompt injection defense, AI model integrity, and LLM security testing are the specific skills. The talent pool is thin here — if you have any experience with LLM security or AI red teaming, document it publicly.

IAM (Okta, Azure AD, SailPoint): Identity is the new perimeter. IAM engineer roles are growing rapidly and are overwhelmingly remote.

These fading skills are not worthless — they are just no longer sufficient on their own. The market has moved, and remote roles in particular skew toward cloud-native and automation-forward teams.

Cloud security is the fastest-growing gap in cybersecurity hiring. If you understand AWS IAM and do not list it in your resume, you are leaving money on the table.

---

Companies That Actually Hire Remote Cybersecurity Teams

Not every company that posts "remote" means it for security roles. Defense contractors routinely list "remote" when they mean remote-from-base — within driving distance of a SCIF where you will handle classified systems. The distinction matters, and missing it wastes weeks of your job search.

Here is who genuinely distributes their security organizations:

Pure-play cybersecurity companies (remote-native): Abnormal Security, GuidePoint Security, Coalition, Cyware, SailPoint. Security is the product, so distributed engineering and security teams are the norm. These companies understand that security talent is geographically dispersed, and they hire accordingly.

Tech companies with distributed security teams: Mastercard, HPE, Motorola Solutions, Ericsson, GE Vernova. Their security teams are embedded in distributed product organizations, and they actively recruit remote security engineers, architects, and GRC analysts.

Fintech and banking: Large banks and fintech companies have compliance-heavy security needs that map directly to remote GRC roles. If you hold a CISA or CISM, this sector has volume. The work is audit-driven and document-heavy — structurally suited to remote.

Consulting and advisory: Deloitte and the Big 4 maintain extensive remote cybersecurity advisory benches. These roles involve client-facing work but are typically remote between engagements. Similar to how remote project manager positions work in consulting — you travel for kickoffs, not for daily work.

Healthcare: HIPAA compliance drives massive demand. Health systems and healthtech companies hire remote security analysts for compliance monitoring, risk assessment, and audit preparation.

---

Where to Find Remote Cybersecurity Jobs

Job boards are not equal for this niche. Some surface genuine remote security roles; others aggregate the same clearance-heavy defense contractor listings. Here is where to focus your search.

LinkedIn remains the highest-volume source. Use the filter combination "Remote" plus "No Security Clearance Required" to cut through the defense contractor noise. Set job alerts for specific titles — "Security Engineer Remote" outperforms "Cybersecurity" as a search term.

Built In is tech-focused, and most of its cybersecurity listings are private sector. If you want to avoid clearance-required roles entirely, start here.

Wellfound for remote tech roles surfaces pure-play security companies and startups where security is the product. Abnormal Security, Coalition, and similar firms list here regularly.

Remote Job Assistant's auto-apply handles the submission volume for you. When you are applying to 30–50 cybersecurity roles per campaign, manually filling out applications on different platforms is not a good use of your time. Auto-apply surfaces remote-eligible postings with salary data already attached.

r/netsecjobs (Reddit) is a practitioner community, not an HR-scrubbed board. Listings here tend to be more honest about remote policies, compensation, and team structure. It is also where you will find roles at smaller security companies that do not post on LinkedIn.

Working Nomads for remote listings curates remote roles across categories, including a dedicated tech and security section.

FlexJobs vets every listing for legitimacy — useful if you want to avoid clearance traps and fake postings entirely.

HackerOne and Bugcrowd are not job boards in the traditional sense, but if you are building an offensive security portfolio, bug bounty earnings and disclosed vulnerabilities are resume gold.

For a broader view of where remote tech jobs are posted, our best remote job boards for 2026 roundup covers every major platform. And if you are exploring adjacent roles, browse remote tech job listings to see what is currently open.

---

How to Stand Out When Applying at Volume

The average remote cybersecurity role receives 200–400 applicants. Even with a strong profile, you need to apply to 30–50 roles to generate 3–5 interviews. That is the math. Understanding it changes how you approach the job search.

Your portfolio matters more than your resume — but only if it is clean. One polished GitHub repo demonstrating a real detection use case — a custom Splunk detection rule, an AWS IAM misconfiguration audit, a SOAR playbook you built from scratch — outperforms ten half-finished CTF writeups. Hiring managers at L2 and L3 check GitHub before scheduling phone screens. The warning: a sloppy portfolio with commented-out debug code and no documentation actively hurts you. One well-documented project beats five mediocre ones every time. Write the README like you are handing off to a stranger, because you are.

ATS specifics for cybersecurity: Use exact tool names. Write "Splunk" not "SIEM tools." Write "CISSP" not "Certified Information Systems Security Professional." Use the cert acronym in the exact format the posting uses. If the listing says "AWS Security Specialty," your resume should say "AWS Security Specialty" — not "AWS certified" or "cloud security certification."

Here is where $75K+ candidates commonly leave applications on the table. They spend 45 minutes customizing each application, apply to 8 roles over two weeks, and wonder why they are not getting callbacks. The volume math does not support that strategy. At 200–400 applicants per role, even a 5% screen rate means you need 30+ applications to get consistent interview flow.

One targeting refinement that thins the competition: apply to L1/L2 overlap roles — GRC Analyst, Security Analyst — where the cert requirements match yours but pure SOC-track candidates often do not apply. The applicant pool shrinks from 400 to 80 when you stop competing for the same "Security Engineer (5+ years)" postings that every mid-career candidate targets. Pure-play cybersecurity firms like Abnormal Security and Coalition also receive fewer applicants than generic tech companies, and they weigh portfolios more heavily than HR-filtered enterprises.

The uncomfortable reality about job boards: most L2 and L3 cybersecurity roles above $130K are filled through referrals before they are publicly posted. The posting you see on LinkedIn is often already 60% of the way to an offer for an internal candidate or referral. You need the boards for volume and early-career roles — but if you want a $160K Security Architect role at a specific company, the better path is finding the hiring manager on LinkedIn and having a technical conversation before the role opens. Job boards alone will not get you there at the top of the market. Engage in r/netsec and r/netsecjobs — the practitioners who post in those communities often know about openings before they are public.

CISSP holders who can demonstrate cloud security experience are the most in-demand remote cybersecurity candidates in the 2026 market. That is not a guess — it is what 82,494 postings requiring CISSP and a 36% cloud security skills gap tell us. If you are sitting at L2 on the Cyber Career Stack with cloud experience and no CISSP, the $749 exam fee is the highest-ROI investment you can make this year.

---

Frequently Asked Questions

---

Build Your Remote Cybersecurity Career

Remote cybersecurity jobs pay $55K–$420K+ depending on where you sit on the Cyber Career Stack — and the market has 4.8 million unfilled positions globally with a projected 33% growth rate through 2033 (BLS). The candidates who land remote offers are not necessarily the most technically advanced. They are the ones who understand the cert-to-salary math, target companies that are genuinely distributed, and apply at volume instead of sending 8 hand-crafted applications over two weeks.

Start by mapping yourself to a tier on the Cyber Career Stack. If the next tier requires CISSP and you have the experience hours, start studying — the $25K–$35K premium pays for itself in month one. If you need cloud security skills, build a specific AWS project — a secure S3 bucket configuration with restrictive IAM policies, documented step by step in a GitHub README with the security rationale for each decision. It takes under three hours using AWS Free Tier and it is the kind of artifact that gets a hiring manager to move you from the "maybe" pile to the "phone screen" pile. If you need to apply at scale, Remote Job Assistant's auto-apply handles the submission volume so you can focus on the roles that matter most.

For related career paths, explore the best remote job boards for 2026 for broader coverage, remote DevOps and infrastructure jobs if your skills bridge security and infrastructure, and the high-paying remote jobs guide for compensation context across roles.

The systems you protect do not care where you sit. Neither do the companies that are actually serious about hiring you.