← Back to blog

State of Cloud Security Hiring - August 2026

Cloud security hiring is shrinking three times faster than security hiring overall. We tracked 217 cloud security roles in August 2026, down 18% from July's 266. All security postings fell 5% over the same two months, from 6,370 to 6,037.

Cloud security is now 3.6% of every security role we classify, down from 4.6% in June.

Here's the rest of August.

The short version

• 217 cloud security postings in August, down 18% from July's 266. The wider security market fell 5%.
• AWS is mentioned 10% more often than Azure, down from 15% in July and 19% in June.
• AZ-500 overtook AWS Security Specialty for the first time: 21 postings to 20.
• Prisma Cloud collapsed from 28 postings to 10. Wiz still leads CSPM at 30.
• Terraform leads Kubernetes for the second month running.
• AI tooling appears in 8.8% of cloud security postings, up from 7.5% in July and 4.2% in June.
• Median advertised US salary was $162,250, up 3.7% on July but within noise.

The category is shrinking faster than the market

Three months is three data points, not a trend line. But the direction holds. Cloud security's share of all security postings went 4.6% in June, 4.2% in July, 3.6% in August. The denominator shrank too, and cloud security lost ground inside it.

The obvious explanation is that the work moved rather than vanished, renamed as platform or DevSecOps work and filed elsewhere by our classifier. It didn't.

DevSecOps has been flat all quarter, 3.2% of postings in June and 3.1% in August. Security Engineering slipped from 19.7% to 19.2%. Neither absorbed anything, and the titles didn't move either. Postings with "platform" in the title fell faster than cloud security did.

The clearest test is cloud tooling outside the cloud security category. If the work were being renamed, other categories would mention AWS, Azure and GCP more. They mention it less. Across 5,820 August postings the density went 33.0% in June, 32.8% in July, 29.4% in August. The cloud language is thinning everywhere, not relocating.

Two things soften the 18%. Collapsing the duplicate rows that employers publish through several ATS endpoints narrows the fall to 16%, against a market that fell 6%. And a few bulk hirers pulled back. Across its four ATS entities PwC posted 26 cloud security roles in June and 2 in August, while its overall posting volume fell by a third. That is a real retreat, not a crawl gap.

Platforms

AWS appears in 159 of 217 postings (73%), Azure in 145 (67%), GCP in 101 (47%).

AWS is mentioned 10% more often than Azure this August. In July it was 15% more, in June 19% more. Measured in percentage points the gap went 12pt to 6pt. Either way it has narrowed every month we've measured it.

GCP rose in share for the third month running, from 42% in June to 44% in July to 47% in August. It's still the third platform in almost every posting that names it, rarely the primary.

Oracle Cloud appeared in 17 postings (7.8%), down from 23 in July and down in share from 8.6%. It's an enterprise and government-contractor signal, not a general one.

Microsoft is taking the stack

This is the clearest movement in the data this month, and it isn't just Azure.

Every Microsoft component rose in count and share against July, in a month when postings fell 18%. Defender alone went from 12% to 20%. Most sit below their June counts, but June carried 407 postings to August's 217, so all of them are up in share.

Entra ID (33) still leads Active Directory (25). The ratio has held near 1.3 since June, so cloud identity is holding its lead, not extending it.

The Defender number needs splitting. All 23 Defender for Cloud postings also match Microsoft Defender, so the 44 mixes the CSPM product with the EDR one. Strip the overlap and Defender as EDR is 21 postings, behind CrowdStrike's 29.

The cert numbers say the same thing. AZ-500 appears in 21 postings, AWS Security Specialty in 20. That's the first month AZ-500 has led. AWS Security Specialty fell from 34 to 20 while AZ-500 rose from 16 to 21.

Hold two things apart. AWS is still the most-mentioned platform by a clear margin. But Microsoft's security products are the ones filling job descriptions. Different claims.

Skills

Terraform (100) leads Kubernetes (94), as it did in July at 116 to 106. Kubernetes led in June, 171 to 161. One swap in three months, and the two are never far apart. Treat them as tied and learn both.

Python leads languages at 86 (40%), PowerShell at 38 (18%) tracks Azure's rise, Go sits at 28.

HashiCorp Vault jumped from 10 postings to 21, doubling its share from 3.8% to 9.7%. Jenkins rose faster still, 8 to 18, from 3.0% to 8.3%. Both are small numbers on a shrinking base. Worth watching, not worth betting on.

Bash fell from 48 postings to 21, an 18%-to-10% share drop, and we can't explain it. A regex match on a common word swings when a few large employers change their posting template. Treat it as noise until it repeats.

AWS-native services: CloudTrail (21), EKS (18), Security Hub (16), GuardDuty (16), Lambda (14), AWS Config (8). GCP-native: GKE (8) and little else. That asymmetry hasn't changed since May.

CSPM tools

Wiz still leads at 30 postings (14%), but it fell from 39 in July, a 23% drop. Its share slipped only a point, from 14.7% to 13.8%, so it lost roughly as much as the market did.

Prisma Cloud is the story here. It fell from 28 postings to 10, from 10.5% to 4.6%. Orca fell from 14 to 4. Defender for Cloud edged up from 22 to 23 and is now close behind Wiz.

On a 217-posting base, 28 to 10 is real, not sampling noise. Whether it holds is a September question.

The practical read hasn't changed. Wiz is still the third-party CSPM worth having on a resume. But if your target employers are Azure-first, Defender for Cloud is now almost as common.

AI is entering cloud security job descriptions

19 of 217 August postings (8.8%) mention an AI tool we track - OpenAI, ChatGPT, Claude, Gemini, GitHub Copilot, Cursor or LangChain. In June that was 17 of 407 (4.2%). In July, 20 of 266 (7.5%).

The count barely moved. The share doubled because the base shrank. July and August both sit near 8%, so the step up happened in July and has held.

Read the match loosely. Axos Bank's Cloud and AI Security Engineer names Claude, LangChain and OpenAI, which is the real thing. But several of the 19 qualify only because the posting mentions GitHub Copilot as a perk, and three are the same CrowdStrike AIDR role listed three times. Distinct postings with a genuine AI-security scope are fewer than 19.

This counts only the AI tools already in our tool list. A signal, not a market. We'll keep counting it.

Compensation

Median advertised US annual salary was $162,250 in August, across the 83 distinct postings that disclosed a USD annual range. July's was $156,500 across 79. A 3.7% rise, which on this sample is not a trend.

Both figures drop the ATS duplicates. Leave them in and August's sample inflates to 92 and the gap flattens to nothing.

The top of the range, also deduplicated:

Security vendors are three of the top seven. Illumio, SentinelOne and Orca Security all top out at $260K or above for senior and staff cloud security work. June's pattern of developer-infrastructure companies at the top (Vercel, Temporal) didn't repeat. This month it's payments, hardware and vendors.

These are advertised ranges, not paid salaries, and they come from the minority of postings that disclose. US pay-transparency laws drive most of that disclosure, so it's really a median of the states that must publish.

Experience levels

Percentages are of the 173 August postings we could assign a level to. The other 44 are excluded.

Senior climbed from 47% to 58% of classified postings. Mid fell from 30% to 25%, staff from 19% to 14%. Entry fell from 3.5% to 2.9%, which is 5 postings.

A shrinking market that skews further senior is the worst combination for anyone trying to break in. Nothing in August changes the entry advice. Get a broader security, platform or DevOps role first and build cloud hours there.

Work mode

Onsite 99 postings (46%), hybrid 62 (29%), remote 56 (26%).

Remote fell from 31% of July postings to 26% of August ones. Onsite rose from 40% to 46%. That is a rebound to about where June sat at 48%, not a new high, so July looks like the outlier.

Of the 56 remote postings, 31 are US-locked and 6 Canada-locked. Three name no country at all, and that is missing data rather than an open invitation. Remote in cloud security still means work from home inside one country.

Geography

The US holds 51% of the 217 August postings, up from 45% in July. India is second at 13%. Canada fell from 22 postings to 12. Three postings name no country and are left in the denominator.

The country mix reflects which employers use the ATSs we crawl. It overweights large US enterprises and consultancies, and underweights anyone hiring through a local job board.

Most active employers in August by raw postings: Booz Allen Hamilton (9), Bank of America (6), HPE (6), CrowdStrike (5), Pfizer (4), Illumio (4), GDIT (4).

Those counts flatter everyone. HPE's six rows are two jobs published through three Workday endpoints, and Bank of America's six are three jobs listed twice. Counting distinct roles, Booz Allen leads with eight and nobody else clears four. Government contractors and large enterprises at the top, which is what an ATS-sourced dataset shows.

Certifications

CISSP appears in 31% of postings, CCSP in 21%. Both fell slightly in share from July (35% and 25%).

AZ-500 passing AWS Security Specialty is the change that matters. It's a 21-to-20 gap on a 217-posting base, so it's one month and a thin margin. But it moves with every other Microsoft number this month, and that's what lifts it above noise.

CKS reached 10 postings (4.6%) against Kubernetes' 43%. The gap between the skill and the cert is still an order of magnitude.

A cert appearing in a posting isn't a requirement. CISSP at 31% of cloud security postings says more about how HR builds a filter than about what the work needs. The people doing this job aren't reading the CBK.

What I'd do with this data

If you're already in cloud security: learn the Microsoft security stack whether or not you want to. Defender, Sentinel and Entra ID each appear in a fifth to a seventh of postings, and every one of them grew in a down month. AZ-500 is now mentioned as often as AWS Security Specialty.

If you're choosing a CSPM to learn: still Wiz. But add Defender for Cloud rather than Prisma Cloud, which lost more than half its mentions in a month.

If you're trying to get in: August was worse than July. 5 entry-level postings out of 217. Don't target cloud security directly. Target platform engineering, DevOps or broad security engineering, and build the cloud hours there.

If you want remote: 56 of 217 postings were remote, and all but three named a country. Plan for onsite or hybrid, and negotiate location later.

Published September 1, 2026 · Updated September 1, 2026 · Chandrapal Badshah