Security: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Top 5 technologies in Security jobs: cloud, aws, python, azure, devsecops. Mandatory basics: OWASP Top 10 (must-know), Linux (advanced), Python and Bash for automation, Git. Web security: Burp Suite (the pen-test standard), OWASP ZAP, OWASP Dependency-Check. SAST/DAST: SonarQube, Checkmarx, Snyk, Semgrep. SIEM: Splunk, ELK (Elasticsearch + Logstash + Kibana), QRadar. Pen-test: Kali Linux, Metasploit, Nmap, Wireshark. Cloud security: AWS Security Hub, GCP Security Command Center, Azure Sentinel. IAM: HashiCorp Vault, Keycloak. Certifications: OSCP (offensive), CISSP (managerial), OSCE, CEH, AWS Security Specialty.

AppSec (Application Security) — code and application security, code review, SAST/DAST, threat modeling, OWASP. Works inside a product team. DevSecOps — embeds security into CI/CD pipelines, secrets management, container scanning, GitOps. Close to DevOps + security. Pen-Tester / Red Team — ethical hacking, attack simulation, hunting 0-day vulnerabilities, OSCP/OSCE certifications. More often consulting or specialised companies. SOC Analyst (Security Operations Center) — 24/7 incident monitoring, triage, response, working with SIEM (Splunk/QRadar). By pay: AppSec ≈ DevSecOps > Pen-Tester ≈ Cloud Security > SOC Analyst. Career flow: SOC Tier 1 → Tier 2 → AppSec/Cloud → Senior → Security Architect.

Partially: 37% of Security jobs are full-remote. Lower than Backend/DevOps, because banks and fintech require hybrid or office due to compliance — work with PII, payment data, production access. Local security vendors — more often hybrid. International product teams — almost always remote. Pen-Tester freelance (Bug Bounty on HackerOne/Bugcrowd) — fully remote, flexible schedule, ceiling depends only on skill. SOC Analyst — many remote jobs (often shift work). Cloud Security — typically remote (everything through AWS/GCP console).

DevOps owns the infrastructure and CI/CD — automation, observability, production reliability. Security Engineer owns defence: vulnerability hunting, threat modeling, incident management, compliance. The stack overlaps (Linux, Docker, Kubernetes, cloud) but the focus differs. DevSecOps — the hybrid: a DevOps engineer with security specialisation who embeds SAST/DAST/secrets-scanning into pipelines. By pay Security typically pays 10-20% above DevOps for the specialisation and scarcity. Career flow: Senior Backend → DevOps → DevSecOps; or a separate Security track (SOC → AppSec → Senior Security). Seniors can converge into Security Architect — the top level.

There's no direct path into Security — usually an evolution from an adjacent role. The two most common entry points: 1) Backend / DevOps Middle (2-3 years) → move into AppSec/DevSecOps by picking up OWASP Top 10, SAST/DAST, threat modeling. 2) SOC Analyst Tier 1 (junior-friendly, shift monitoring) → Tier 2 → specialisation. Pet projects: HackTheBox, TryHackMe (CTF platforms for practising skills), OverTheWire, contributions to open-source security tools. Certifications: OSCP (Offensive Security Certified Professional — must-have for Pen-Test), CISSP (managerial track), AWS Security Specialty, CKS (Kubernetes Security). Books: "The Web Application Hacker's Handbook" (Dafydd Stuttard), "Black Hat Python", "Threat Modeling" (Adam Shostack).

As of the latest data refresh, the Zorky CRM sample contains 7089 active open Security positions across CIS and Eastern Europe. These are postings published in the last 90 days — companies actually hiring. Geography is distributed; the leaders are US, GB, PL. Data is collected from 101 job boards and 15 780 company career sites: Telegram channels (especially for niche Pen-Test and Bug Bounty jobs, security conferences, anti-leak communities), specialised job sites (HH, Habr Career, Djinni, DOU, NoFluffJobs, JustJoin.it, Pracuj.pl), career pages of security vendors. Security is a niche area, so the job volume is smaller than Backend/Frontend, but one of the highest-paid.

The main driver is contract currency and specialisation. Pen-Test and Cloud Security usually pay a premium (+20-30% over the median). Local Russian banks on rouble contracts have closed the gap to the Polish market over 2 years for Senior.

A Senior Security engineer owns the full defence stack in one of the specialisations (AppSec / DevSecOps / Cloud Security / Pen-Test). Basics: OWASP Top 10, Linux (advanced), Python + Bash, Git. Understanding of the development stack (pick one: Backend or Frontend at Senior level). For AppSec: SAST/DAST (SonarQube, Checkmarx, Snyk, Semgrep), Burp Suite advanced, OWASP ZAP, secure code review, threat modeling (STRIDE, PASTA). For DevSecOps: secrets management (HashiCorp Vault), container scanning (Trivy, Snyk), GitOps. For Cloud Security: AWS Security Hub / GCP SCC / Azure Sentinel, IAM at the policy level, compliance (SOC 2, ISO 27001, GDPR). Certifications (OSCP/CISSP/AWS Security/CKS), experience with incident management, leadership.