The cybersecurity field is chronically short of personnel. Corporations and public sector organizations have trouble recruiting and then retaining talent. Degree programs promise lucrative careers in cybersecurity. But first the graduate needs to perform well and avoid burn out from a potentially stressful career.
The United States, likely the world’s largest cybersecurity employer, has many thousands of unfilled jobs. This report explores this situation and offers insights into cybersecurity jobs and hiring data across the US. It asks and provides some answers to the question, “What are the best places to find a cybersecurity job?” It’s based on industry surveys and publicly available statistics.
In this guideBackground: The cybersecurity skills gap
There are not enough trained people to fill all the cybersecurity jobs in the world. The New York Times reported in 2018 that there would be 3.5 million unfilled cybersecurity jobs worldwide by 2021. This is known in the industry as the “cybersecurity skills gap.” It’s hard to know how accurate this number is, but other industry research bears out the idea that security teams are struggling with many unfilled positions.
The skills gap is also detectable, indirectly, in the many solutions coming on the market. The increasing use of Artificial Intelligence (AI) and security workflow automation exemplify the emerging trend of people-less security solutions. It’s all about achieving the mission of security without adding staff — and keeping existing staff involved in interesting work so they won’t get bored and quit.
Cybersecurity jobs report findings
The data reveal an unexpected truth about cybersecurity jobs in the US. They’re not all in the places one would expect. Plenty of security jobs can be found well outside Silicon Valley, Boston, New York, and the major population centers.
Indeed, cybersecurity job openings are well dispersed throughout the United States. Traditional technology centers like the San Francisco Bay Area are still the major cybersecurity hiring hubs, but other parts of the country are also hiring at rapid rates — especially when viewed on a per-capita basis.
Earning potential is high within the cybersecurity industry. Not every city offers the same lifestyle for a cybersecurity salary, however. When cybersecurity job opening data is combined with salary information and adjusted for cost of living, non-tech hub centers start to emerge as the best places to find cybersecurity employment. Getting out of the major cities may be a smart move for a cybersecurity job seeker.
The number of cybersecurity jobs available by location
Where are the cybersecurity jobs, and why are there so many of them? The answer to the first part of the question is “all over the place.” As Figure 1 shows, companies are hiring for cybersecurity positions in all the major cities, but also in places like Miami and San Antonio. The answer to the second question is a little more subjective, but important to understand if one wants to pursue a career in security.
The field of cybersecurity has expanded dramatically in recent years. A number of causative factors are driving this trend. One of the biggest issues is the increasing severity of the cyber threat environment. As nation state actors like Russia, China, and Iran now regularly deploy the full might of the cyber military operations against American government and corporate targets, the US has gotten besieged with cyberattacks.
The news regularly reports on massive data breaches and shocking penetrations of the country’s most secret digital domains. Fighting back takes people… a lot of people.
The cybersecurity profession has expanded as virtually every corporation, nonprofit and government agency has sought to increase its cyber defense capabilities. They are in full hiring mode as a result. On the vendor side, the technology industry is witnessing a massive influx of investment capital into cybersecurity startups as well as in-house investment by major players in security like IBM and Microsoft. In all, there are more than 3,000 cybersecurity technology companies in the world. All of this activity and investment means more jobs in cybersecurity.
With these factors in mind, the distribution of jobs shown in Figure 1 starts to make more sense. Large corporations and government agencies, all of which are hiring for cyber, are spread out across the country. The big tech companies have intense cyber hiring needs in San Jose, Raleigh, Austin, Seattle, San Francisco, and so forth. The government hires cybersecurity people in the Washington, DC area as well as in places like San Diego, which is a Navy hub with many cyber defense needs.
In general, though, Fortune 500 companies need cybersecurity analysts and technologists in locations across the country, showing up in the chart as job opportunities in metro areas like Atlanta, St. Louis, and Phoenix.
| METRO AREA | JOBS |
|---|---|
| Washington-Arlington-Alexandria DC-VA-MD-WV | 78,309 |
| New York-Newark-Jersey City NY-NJ-PA | 29,723 |
| Dallas-Fort Worth-Arlington TX | 22,225 |
| Los Angeles-Long Beach-Anaheim CA | 21,049 |
| San Francisco-Oakland-Hayward CA | 17,077 |
| Chicago-Naperville-Elgin IL-IN-WI | 15,479 |
| Atlanta-Sandy Springs-Roswell GA | 14,381 |
| Boston-Cambridge-Nashua MA-NH | 13,800 |
| Baltimore-Columbia-Towson MD | 13,193 |
| Phoenix-Mesa-Scottsdale AZ | 12,705 |
| Denver-Aurora-Lakewood CO | 11,929 |
| Philadelphia-Camden-Wilmington PA-NJ-DE-MD | 11,086 |
| San Jose-Sunnyvale-Santa Clara CA | 10,839 |
| Charlotte-Concord-Gastonia NC-SC | 9,483 |
| San Diego-Carlsbad CA | 9,003 |
| Austin-Round Rock TX | 8,890 |
| Seattle-Tacoma-Bellevue WA | 8,440 |
| Minneapolis-St. Paul-Bloomington MN-WI | 7,526 |
| Houston-The Woodlands-Sugar Land TX | 7,142 |
| Tampa-St. Petersburg-Clearwater FL | 6,873 |
| St. Louis MO-IL | 6,719 |
| San Antonio-New Braunfels TX | 6485 |
| Raleigh NC | 5,994 |
| Miami-Fort Lauderdale-West Palm Beach FL | 5,490 |
| Virginia Beach-Norfolk-Newport News VA-NC | 5,460 |
Cybersecurity jobs on a per capita basis
Figure 2 looks at cybersecurity employment across the US from a different perspective. It shows the per-capita rate of cyber jobs in each metro area —meaning, it quantifies the number of jobs in cyber that are open per 1,000 people who work there. Again, some of the results are bit surprising.
Washington, DC has a very high number: 124.69 cyber jobs per thousand jobs in the overall workforce. That makes sense upon reflection, because so much of the DC area workforce is in government, which has intense cybersecurity needs. Indeed, entire government agencies, such as the NSA, are devoted to cybersecurity in one way or another.
It is interesting, however, that Huntsville, Alabama has 78.14 cyber jobs per capita. What’s in Huntsville? It turns out that the city is actually one of the country’s most prominent centers for aerospace, especially rockets and space technology. These industries are technology-intensive, and where there’s tech, there is cyber risk. So, companies and government entities in Huntsville need cyber staff. Similarly, Colorado Springs has a lot of military infrastructure, so it has a high proportion of cyber jobs.
A metro area with industries that rely on technology will also likely have a high per capita rate of cyber employment. Richmond, Virginia is home to the tobacco industry, which uses significant Information Technology (IT) resources for its operations. Or, take Dallas, which has a great deal of oil and gas industry. That business is a big user of information technology, including the new Internet of Things (IoT). It’s also vulnerable to cyberattack. Oil and gas facilities are considered “critical infrastructure” by the government. As such, they have to have rigorous cybersecurity operations.
Cities that have financial and insurance industries need cyber staffing, as well as people working in compliance, a related field. Banks and insurance companies are heavily regulated. Many of the laws that govern these industries require specific cybersecurity standards to be observed, subject to audits. This, in turn, drives cyber hiring. And, it’s not just cities like New York and Chicago that have such businesses. One can find insurance companies and banking operations across the country.
| METRO AREA | JOBS PER CAPITA |
|---|---|
| Washington-Arlington-Alexandria DC-VA-MD-WV | 124.69 |
| Huntsville AL | 78.14 |
| Colorado Springs CO | 69.94 |
| San Jose-Sunnyvale-Santa Clara CA | 54.45 |
| California-Lexington Park MD | 52.24 |
| Sierra Vista-Douglas AZ | 51.38 |
| Baltimore-Columbia-Towson MD | 47.12 |
| Raleigh NC | 43.10 |
| Denver-Aurora-Lakewood CO | 40.20 |
| Austin-Round Rock TX | 39.92 |
| Boulder CO | 37.06 |
| San Francisco-Oakland-Hayward CA | 36.09 |
| Charlotte-Concord-Gastonia NC-SC | 35.96 |
| Des Moines-West Des Moines IA | 35.36 |
| Durham-Chapel Hill NC | 35.34 |
| Virginia Beach-Norfolk-Newport News VA-NC | 30.87 |
| Trenton NJ | 30.73 |
| Dallas-Fort Worth-Arlington TX | 29.35 |
| Boston-Cambridge-Nashua MA-NH | 28.32 |
| Madison WI | 27.67 |
| San Diego-Carlsbad CA | 26.97 |
| Richmond VA | 26.57 |
| Phoenix-Mesa-Scottsdale AZ | 25.68 |
| Harrisburg-Carlisle PA | 25.61 |
| Urban Honolulu HI | 25.45 |
Average cybersecurity salary by metropolitan area
How much do cybersecurity employees make in the different metro areas? That’s the topic covered in Figure 3. The top of the scale can be found in Silicon Valley and the New York City area, with average cyber salaries weighing in at $133,040 and $127,850, respectively. The lowest paying metro is the greater Philadelphia-Camden-Wilmington area, at $107,310.
All things considered, though, the range between top and bottom pay rates is pretty tight. Seemingly out-of-the way places Idaho Falls, Idaho and Albuquerque, New Mexico, with average salaries of $113,000 and $111,060, respectively, are not that different from Seattle, which has an average salary of $111,390. In places like Idaho and New Mexico, regional industry and government jobs are likely driving these relatively high rates of pay. In Idaho, it’s agribusiness, paper mills, and lumber. In New Mexico, it’s the military and government (e.g., Los Alamos laboratory) and oil and gas.
| METRO AREA | SALARY |
|---|---|
| San Jose-Sunnyvale-Santa Clara CA | $133,040 |
| New York-Newark-Jersey City NY-NJ-PA | $127,850 |
| San Francisco-Oakland-Hayward CA | $122,570 |
| Bridgeport-Stamford-Norwalk CT | $121,330 |
| Chambersburg-Waynesboro PA | $119,320 |
| Washington-Arlington-Alexandria DC-VA-MD-WV | $117,810 |
| Beaumont-Port Arthur TX | $117,600 |
| Trenton NJ | $116,620 |
| Sacramento–Roseville–Arden-Arcade CA | $115,420 |
| Austin-Round Rock TX | $114,280 |
| Dallas-Fort Worth-Arlington TX | $114,100 |
| Riverside-San Bernardino-Ontario CA | $113,990 |
| Kennewick-Richland WA | $113,780 |
| Winchester VA-WV | $113,040 |
| Idaho Falls ID | $113,000 |
| Seattle-Tacoma-Bellevue WA | $111,390 |
| Boulder CO | $111,110 |
| Albuquerque NM | $111,060 |
| Rochester MN | $110,500 |
| Baltimore-Columbia-Towson MD | $110,150 |
| North Port-Sarasota-Bradenton FL | $109,700 |
| Colorado Springs CO | $108,520 |
| Harrisonburg VA | $108,380 |
| Las Vegas-Henderson-Paradise NV | $107,380 |
| Philadelphia-Camden-Wilmington PA-NJ-DE-MD | $107,310 |
Relative salary based on cost of living-adjusted by metro area
Sometimes salary numbers don’t tell the entire story. Cost of living is also an important factor when thinking about relative earning power. In terms of cybersecurity-specific salaries, it’s really important to think about salary in terms of location.
Figure 4 looks at average cybersecurity salaries in metro areas and then adjusts that number based on cost of living data. For example, the average salary reported by cybersecurity workers in the Austin, Texas area is $114,280 (figure 3), but when factored by a cost of living index, the earned salary actually feels like $119,418 (figure 4).
The reverse is true for areas with a high cost of living index. In the San Francisco Bay Area, a salary of $122,570 can actually feel more like $73,445 once factored by the cost of living.
| METRO AREA | SALARY |
|---|---|
| Beaumont-Port Arthur TX | $128,519 |
| Austin-Round Rock TX | $119,418 |
| Flint MI | $119,035 |
| Chambersburg-Waynesboro PA | $118,643 |
| Dallas-Fort Worth-Arlington TX | $117,141 |
| Albuquerque NM | $114,696 |
| Yuma AZ | $114,203 |
| Winchester VA-WV | $113,199 |
| Houston-The Woodlands-Sugar Land TX | $112,108 |
| Idaho Falls ID | $112,010 |
| Harrisonburg VA | $110,938 |
| Rapid City SD | $109,434 |
| Memphis TN-MS-AR | $107,814 |
| Raleigh NC | $107,714 |
| Rochester MN | $107,223 |
| Lynchburg VA | $106,778 |
| Palm Bay-Melbourne-Titusville FL | $106,424 |
| Atlanta-Sandy Springs-Roswell GA | $106,260 |
| Bloomington IL | $105,713 |
| Blacksburg-Christiansburg-Radford VA | $105,226 |
| Gainesville FL | $105,148 |
| Columbus OH | $105,073 |
| North Port-Sarasota-Bradenton FL | $104,638 |
| Knoxville TN | $104,267 |
| El Paso TX | $103,810 |
Cities with the highest COL and job openings per capita
Figure 5 starts to put it all together, showing the 25 cities with the highest cost of living-adjusted salary and above average job openings per capita. The average per capita job openings for cybersecurity positions if 15.9. Each city has something to offer, though they are not all the same. For example, Austin has 39.92 jobs per capita, an average salary of $114,280 and a COL of $119,418.
| METRO AREA | PER CAPITA | AVERAGE SALARY | COL SALARY |
|---|---|---|---|
| Austin-Round Rock TX | 39.92 | $114,280 | $119,418 |
| Dallas-Fort Worth-Arlington TX | 29.35 | $114,100 | $117,141 |
| Albuquerque NM | 19.72 | $111,060 | $114,696 |
| Raleigh NC | 43.10 | $103,260 | $107,714 |
| Palm Bay-Melbourne-Titusville FL | 19.37 | $106,450 | $106,424 |
| Atlanta-Sandy Springs-Roswell GA | 23.89 | $100,810 | $106,260 |
| Columbus OH | 21.59 | $99,260 | $105,073 |
| Charlotte-Concord-Gastonia NC-SC | 35.96 | $100,330 | $102,336 |
| Durham-Chapel Hill NC | 35.34 | $103,300 | $102,248 |
| Colorado Springs CO | 69.94 | $108,520 | $101,623 |
| Chicago-Naperville-Elgin IL-IN-WI | 16.37 | $103,130 | $101,178 |
| Minneapolis-St. Paul-Bloomington MN-WI | 20.68 | $102,690 | $99,329 |
| Pittsburgh PA | 19.09 | $101,560 | $99,101 |
| Washington-Arlington-Alexandria DC-VA-MD-WV | 124.69 | $117,810 | $98,955 |
| Huntsville AL | 78.14 | $94,280 | $98,676 |
| Dayton OH | 21.42 | $92,660 | $98,619 |
| Kansas City MO-KS | 16.85 | $89,460 | $96,937 |
| Sierra Vista-Douglas AZ | 51.38 | $100,580 | $96,346 |
| Augusta-Richmond County GA-SC | 23.71 | $90,820 | $95,212 |
| Trenton NJ | 30.73 | $116,620 | $95,068 |
| Boulder CO | 37.06 | $111,110 | $94,748 |
| San Antonio-New Braunfels TX | 25.42 | $91,080 | $93,979 |
| Virginia Beach-Norfolk-Newport News VA-NC | 30.87 | $98,180 | $93,976 |
| Des Moines-West Des Moines IA | 35.36 | $92,610 | $93,902 |
| Omaha-Council Bluffs NE-IA | 20.91 | $91,500 | $93,002 |
Conclusion
The good news is that cyber jobs are plentiful and high paying. Cybersecurity companies, as well as cybersecurity departments within corporations and government agencies are staffing up. Indeed, they are scrambling to fill open positions.
The category continues to grow, with the future promising even greater opportunities for employment. The question is, where is the best place to embark on a career in security?
The interesting truth is that cyber jobs are available all over the United States, not just in the major cities and obvious technology centers like Silicon Valley. Many locations, like Saint Louis and Knoxville, have many attractive openings.
That said, not all metro areas are financially equal. In some places, the salary from a cybersecurity job won’t cover the basic cost of living. Other places, though, offer very advantageous ratio between salary and COL. Finding the right fit is a subjective process.
The job itself is a critical factor in deciding where to work. After that, many aspects of a metro area can affect its desirability. With knowledge about the economics of the location, it is possible to make a truly well-informed decision.