Security QA: market
A Security QA Engineer tests the product for vulnerabilities during development: checks web and API security, runs scanners, triages findings with developers and makes sure fixes don't break functionality. We currently track 13 open positions for this role, 12 of them fresh. Valued skills are the OWASP Top 10 and testing methodologies, Burp Suite and OWASP ZAP, SAST and DAST scanners, pentesting basics, HTTP and authentication, Python scripting and embedding checks into CI. By co-occurrence in requirements, Python, Penetration testing, Ceh and Offensive security appear most often. 33% of the postings allow fully remote work. Below is a live slice of the Security QA Engineer market: geography, seniority, adjacent stack and sources.
The Security QA market currently has 13 open roles, 12 of them freshly observed.
33% of Security QA Engineer postings allow fully remote work; the share counts only postings that state the format.
⚠ salary known for 0 of 13 jobs; remote share from 6 with a stated format; 12 counted as fresh observations; trend and hiring difficulty are not shown
Timeline: postings and sources
How many Security QA postings appeared each week since 4 May, and from how many sources. The second line separates market growth from coverage growth: a jump in the week new sources were connected means we started seeing more, not that the market grew.
New postings and active sources per week
Sources over the period: 23
New sources connected: 11 May +1 · 25 May +1 · 1 Jun +1 · 22 Jun +2 · 29 Jun +1 · 6 Jul +2 · 13 Jul +2 · 20 Jul +4 · 3 Aug +1 · 31 Aug +1 · 21 Sept +1 · 5 Oct +1 · 12 Oct +5
Week = posting first-seen date, all statuses; postings are selected by the same rule as this page's counter. Sources are distinct collection channels; their names are not published.
Demand and observed supply: Security QA
| Open demand | 13 |
| Observed supply | — not published |
⚠ candidates matching a vacancy are not counted yet: demand and the observed pool are shown
Salary distribution: Security QA
The range histogram for Security QA Engineer uses only postings with an explicit compensation range; the median is computed over the same sample.
The chart will appear once enough observations accumulate for this breakdown.
Demand geography: Security QA
| country | jobs |
|---|---|
| SG | 4 |
| IN | 3 |
| GB | 2 |
| AE | 1 |
| PH | 1 |
| PL | 1 |
The top country for Security QA Engineer demand is Singapore (4 positions).
⚠ job counts only: salary by country is not published
Used together with
In Security QA Engineer requirements the most frequently named skills and technologies are Python, Penetration testing, Ceh and Offensive security.
Demand by grade: Security QA
| grade | jobs |
|---|---|
| senior | 3 |
| principal | 1 |
Senior-and-above is about 100% of 4 Security QA Engineer postings with an explicit grade.
⚠ demand side only: the grade of the observed pool is unknown for most of it
Employers: Security QA
Demand is spread across 12 employers. The largest accounts for 15.4%, the top ten for 84.6%; the remaining 15.4% is long tail.
| share | value |
|---|---|
| top-1 | 15.4% |
| top-3 | 30.8% |
| top-10 | 84.6% |
| long tail | 15.4% |
Security QA Engineer openings come from 12 distinct employers.
⚠ names are not shown: staffing agencies and end employers are not yet told apart by the classifier
Where Zorky sees this market
Observed across 8 sources; the largest accounts for 30.8% — this market does not rest on a single channel.
Security QA Engineer postings arrive mostly from job boards & aggregators and ATS & career sites.
Recent openings: Security QA
- Security Testing Engineer - CREST Certified · GB
- Principal Cyber Security Test Engineer · IN
- Risk Services, Cybersecurity Senior Associate / Assistant Manager - Offensive Security (Security Testing Delivery) · SG
- Security Testing Engineer - Penetration Tester
- Security Testing Engineer (m/f/d) · AE
- Quality Assurance - Security Tester · IN
- IT Security QA · PH
- Security Engineer-Pentest, Continuous Security Testing · GB
Adjacent markets
⚠ adjacent markets for comparison are not defined yet
How this is measured
- Vacancy
- an open job that cleared the quality gate and lists at least two technologies
- Observed candidate
- a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter
- Matchable candidate
- not counted yet
- Window
- jobs open at the moment the snapshot was built
About the data
- Some breakdowns are hidden: their data coverage is not yet sufficient.
- Statistics are shown only where the sample clears a quality gate.
- A missing block does not mean a value of zero.
Breakdowns currently hidden: 9.
Data as of 2026-10-24
Frequently asked questions
Common questions about the Security QA Engineer role — short answers from the same data slice.
What does a Security QA Engineer do?
A Security QA Engineer tests the product for vulnerabilities during development: checks web and API security, runs scanners, triages findings with developers and makes sure fixes don't break functionality.
Which skills do Security QA Engineer postings require?
Valued skills are the OWASP Top 10 and testing methodologies, Burp Suite and OWASP ZAP, SAST and DAST scanners, pentesting basics, HTTP and authentication, Python scripting and embedding checks into CI. In the current slice, Python, Penetration testing, Ceh and Offensive security appear in requirements most often.
How does Security QA differ from a penetration tester?
A pentester runs an attack-style assessment of the whole system, often as an external contractor; Security QA sits in the team and checks the security of every release within the normal development cycle.
How remote-friendly are Security QA Engineer jobs?
33% of postings with an explicit format allow fully remote work; the slice tracks 13 open positions.
Get the full Security QA market details
Full role analytics — salary bands, employers, trends and available candidates. Leave a contact and we'll send the details.