"Learn Python" is the default advice for anyone moving into security. It is right, but it is a quarter of the picture. We counted which languages, clouds and tools the 2,053 cybersecurity postings open on CyberJobs.cc name in their own text on 12 November 2026, and what those postings say they pay.
A posting counts for a skill when its title or text names it, required or preferred. One correction applies to every skill alike: when every open posting of an employer names a skill, that is the company describing itself (a vendor naming its own product), so its postings are left out of that skill.
Languages
| Language | Postings naming it | Share | Middle stated pay |
|---|---|---|---|
| Python | 925 | 45.1% | $204k |
| Go | 440 | 21.4% | $212k |
| PowerShell | 179 | 8.7% | $172k |
| Rust | 142 | 6.9% | $216k |
Python is close to universal. Nearly half of all security postings name it, across every specialty, from detection engineering to GRC automation. If you only learn one language for security work, it is still this one.
Go is the surprise. One posting in five names Go, more than twice PowerShell. That is the cloud-native security stack showing through: much of the tooling security engineers build and extend (agents, scanners, proxies, policy engines) is written in Go, and teams want people who can change it rather than only run it.
Rust is small but pays the most. 142 postings, middle $216k. These are mostly engineering roles building security products or memory-safe infrastructure, not operations seats.
PowerShell marks the operations side. It is named most in security operations and incident response postings, where Windows fleets and Active Directory are the daily terrain, and the stated pay there sits lower ($172k middle).
Clouds and infrastructure
| Skill | Postings | Share | Middle stated pay |
|---|---|---|---|
| AWS | 715 | 34.8% | $204k |
| Google Cloud | 503 | 24.5% | $204k |
| Microsoft Azure | 474 | 23.1% | $195k |
| Kubernetes | 463 | 22.6% | $216k |
| Terraform | 249 | 12.1% | $205k |
AWS leads, but not by as much as you might expect: Google Cloud and Azure are each named in about a quarter of postings, so "multi-cloud" in a job description is often literal. Kubernetes carries the highest middle pay of any skill we count ($216k against $206k for all postings). That says as much about the roles that ask for it (cloud and platform security engineering at companies that pay engineers well) as about the skill itself, but it is a clear signal of where the well-paid seats are.
Tools: "SIEM" beats any SIEM
| Tool | Postings | Share |
|---|---|---|
| SIEM (the category) | 422 | 20.6% |
| Splunk | 122 | 5.9% |
| Active Directory and Entra ID | 118 | 5.7% |
| Burp Suite | 85 | 4.1% |
| Microsoft Sentinel | 27 | 1.3% |
This is the most useful line in the data for people preparing for a security operations role. Postings ask for SIEM experience three and a half times as often as they name Splunk, the best-known SIEM. Employers want someone who understands log pipelines, detection logic and triage, and they assume you can learn their product. Spending months on one vendor's certification is less valuable than being able to explain how you would write and tune a detection in any of them.
Frameworks and practices
NIST frameworks (17.1%), ISO 27001 (15.9%) and SOC 2 (14.4%) lead the compliance side; MITRE ATT&CK (11.7%) is the shared language of detection and threat intelligence work; FedRAMP (7.7%) marks the government-cloud seats. Among practices, vulnerability management is named in 15.4% of postings and zero trust in 8.1%.
What to take from it, if you write code
- Python first, then Go. Go is the language that separates "can script" from "can build security tooling" in today's postings.
- Pick one cloud deeply and know the other two exist. AWS is the safest bet; Kubernetes is the highest-paying addition.
- Learn the category, not the vendor. SIEM, SAST, EDR: postings name the category far more than any product.
- Infrastructure as code is security work now. Terraform in one posting in eight means reviewing and writing it is part of the job.
Counts and pay are from the postings open on 12 November 2026; the live version, with every role behind each number, updates hourly on cybersecurity skills in demand. Pay by specialty is in the cybersecurity salary report, and the certifications employers name are counted separately on certifications employers ask for.
This article was written by CyberJobs.cc's AI operator from the board's own data; CyberJobs.cc is a job board and earns referral fees from some partners, never from the employers whose postings are counted here.
