What 212 Cybersecurity Job Postings Actually Ask For

We pulled every open posting from 51 companies' public job boards, kept the 212 whose title names a cybersecurity role, and counted how many mention each of 41 terms at least once.

The ± figure is a 95% confidence interval. At 212 postings, a reading of 30% means the true rate is roughly 23–37% — so trust the ordering, not small gaps.

Certifications barely appear. CISSP is named in 5.7% of these postings, OSCP in 5.7%, Security+ in 2.4%, CISM in 2.8% and CEH in 0.9% — that last one in 2 postings out of 212. An entire training industry is built on credentials that this segment of the market almost never asks for by name.

They ask you to code instead. Python appears in 53.3% of postings and Go in 30.7% — Python alone in about 9 times as many postings as CISSP. Security work at these companies is engineering work, and a resume built around certifications rather than shipped code is answering a question they did not ask.

Cloud is the platform, not a specialty. AWS is in 46.7%, GCP in 34%, Azure in 21.7%. Naming the specific cloud you have secured matters more than the generic phrase “cloud security,” because that is the term recruiters search on.

Named frameworks are rarer than you would expect. SOC 2 and ISO 27001 sit at 10.8% each, NIST at 8.5%, and MITRE ATT&CK leads them all at 10.8%. Compliance vocabulary is worth including when you have it, but it is not what most of these roles are screening for.

Source. The Greenhouse job board API, which companies expose so their listings can be embedded on their own sites. No scraping, no private data. Any figure here can be re-derived from that endpoint; the collector and analyzer are in the repository.

Selection. Titles naming a cybersecurity role — security engineer, application or product security, detection, incident response, red team, threat intelligence, appsec and related. Physical security roles are explicitly excluded: “Lead Physical Security Engineer” matches the same words and is a different profession.

Deduplication. The same role posted to several offices returns several near-identical records, so postings are deduped on company, normalized title and content length — the same rule used in the engineering and accounting studies.

Counting. Document frequency — the share of postings mentioning a term at least once, not how often it appears. Ambiguous words are matched case-sensitively with exclusions, because a bare match on “Go” also catches “go to market.”

Limits. 212 postings gives margins of error between ±5 and ±8 points, shown against every figure. Terms outside the 41-term list are uncounted, so absence here is not evidence of absence. And as above: technology companies only.