How Do Expectations Differ by Company Size and Industry? Startup Postings Ask for Eight or More Years Less Often Than Enterprise Postings
Abstract
Security job postings at 2,249 companies, open in fall 2026: startups ask for eight or more years, management titles, degrees and the CISSP less often than enterprises. Defense leads on clearances.
*Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
1Introduction
Security job postings at startups, mid-market companies and enterprises all ask for a median of five years of experience. They differ at the top end. In security postings open in fall 2026, 18.5% of startup postings stating years asked for eight or more, against 26.7% of enterprise postings.
Startup security postings also carry fewer management titles, and ask for degrees and the CISSP less often. They ask the hire to secure AI more often. By industry, defense and government postings ask for a clearance most often, in 61% of cases.
This is a snapshot of 8,391 security postings at 2,249 companies in every headquarters country, read on 1 October 2026. There is no earlier year to compare.
These findings come from one snapshot of postings at companies in every country, on modern job boards, leaning toward technology. Company size and industry come from tags assigned by a model. Government, utilities and education are thinly covered.
2The answer at a glance
| Finding | Confidence | Representativeness |
|---|---|---|
| At every company size, the typical security posting asks for five years of experience. Startups ask for eight or more years less often: 18.5% against 26.7% at enterprises. | High. Holds under every check. That includes counting each company once, so a few large employers don't drive it. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Startup security postings have manager or executive titles less often than enterprise postings: 8.9% against 15.9%. | High. Holds with two different ways of reading titles, and inside tech industries, so it is not just which industries startups are in. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Startup security postings require a degree 10.0% of the time, while enterprises require a degree 16.3% of their security postings. | Medium. Holds outside tech industries but not inside them, so it may reflect which industries startups are in. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Startup security postings name the CISSP less often than enterprise postings: 18.2% against 27.5%. | Medium. Holds outside tech industries but not inside them, so it may reflect which industries startups are in. Counted by keyword only. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Startup security postings ask the hire to secure AI more often than enterprise postings: 22.4% against 13.5%. | Medium. Holds outside tech industries but not inside them, so it may reflect which industries startups are in. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Startups may ask about AI more often than enterprises, 35.3% against 29.5%, but the gap is too close to call. | Medium. The gap is too small to be sure. | Medium. Fits tech-leaning employers on modern job boards best. Company size comes from tags assigned by a model, not an outside database. |
| Defense and government security postings ask for a clearance most often: 61%, against 31% in the next industry. | High. Defense's lead over the next industry is too large to be chance. | Low. Government is thinly covered in the data, so this may not hold for government hiring broadly. |
| AI infrastructure and enterprise software postings expect AI most often, at 45%, but their lead over the next industry is too close to call. | Low. The top two are too close to the next industry to call a lead. Needs a larger sample. | Low. Industry coverage is uneven: dense in tech and finance, thin in government, utilities and education. |
| Healthcare security postings name the CISSP most often, at 38%, but the lead over the next industry is too close to call. | Low. Healthcare is too close to the next industry to call a lead. Needs a larger sample. | Low. Industry coverage is uneven: dense in tech and finance, thin in government, utilities and education. |
3The numbers by company size
| Measure | Enterprise | Mid-market | Startup |
|---|---|---|---|
| Postings (companies) | 4,468 (578) | 1,068 (336) | 910 (314) |
| Median years required | 5 | 5 | 5 |
| Eight or more years required, of postings stating years | 26.7% | 20.2% | 18.5% |
| Management titles (title rule) | 15.9% | 11.9% | 8.9% |
| Degree a firm requirement | 16.3% | 12.0% | 10.0% |
| Names the CISSP | 27.5% | 25.6% | 18.2% |
| Asks the hire to secure AI | 13.5% | 13.5% | 22.4% |
| Any AI expectation | 29.5% | 27.4% | 35.3% |
| Asks the hire to use AI tools | 14.8% | 14.1% | 12.4% |
| Asks for Python | 36.1% | 34.7% | 36.6% |
Source: AKA Security analysis of 6,446 security postings with a company-size tag, from 8,391 security postings at 2,249 companies in AKA's job-board data (open on or after 23 September 2026, read 1 October 2026).
4Startup postings ask for fewer years and fewer management titles
4.1Experience
In security postings open in fall 2026, the median asked for five years of experience at enterprises, mid-market companies and startups alike. Among postings stating years, 26.7% of enterprise postings asked for eight or more, against 18.5% of startup postings. The range of likely values for the gap is −12.6 to −3.9 points.
Each of the three AI methods finds the same gap on US postings, and the methods differ by 0.4 points at most. With management-titled postings removed, the gap is 6.6 points. With each company counted once, it is 6.0 points.
4.2Management titles
In the same postings, 15.9% of enterprise security postings carried a manager or executive title, against 11.9% at mid-market companies and 8.9% at startups. The startup gap, −7.1 points, has a range of −10.2 to −3.9 points.
A second title rule gives 13.5% for enterprises and 7.7% for startups, a gap of −5.8 points. The gap also holds within the four technology industries, at −6.0 points.
5Startup postings ask for fewer degrees and CISSPs
5.1Degrees
In security postings open in fall 2026, 10.0% of startup postings firmly required a degree, against 16.3% of enterprise postings. That is about 60% as often. The range for the gap, −11.1 to −0.6 points, is likely but borderline.
The gap holds outside technology industries only. Four technology industries, AI infrastructure, enterprise software, cloud and developer tools, and cybersecurity vendors, hold 65% of startup postings and 28% of enterprise postings. Within them, a gap is too close to call: 11.5% of startup postings against 10.9% of enterprise postings. Outside them, 7.2% of startup postings require a degree, against 18.3% of enterprise postings.
5.2The CISSP
In the same postings, 18.2% of startup security postings named the CISSP, against 27.5% of enterprise postings. The range for the gap is −13.9 to −4.5 points. The CISSP is counted by keyword search, with no AI model as a second check.
The pattern matches degrees. Within the four technology industries, the CISSP appears in 17.1% of startup and 16.7% of enterprise postings. Outside them, it appears in 20.4% of startup and 31.6% of enterprise postings.
6Startup postings ask the hire to secure AI more often
In security postings open in fall 2026, 22.4% of startup postings asked the hire to secure AI systems, against 13.5% of enterprise postings. The range for the gap is +4.0 to +14.3 points. Each of the three AI models finds the gap on US postings.
Within the four technology industries, the gap is 21.3% against 18.0%, and the range includes zero. Outside them, it is 24.5% against 11.9%.
Any AI expectation appears in 35.3% of startup postings and 29.5% of enterprise postings. The range for that gap reaches zero at its lower end, so it is too close to call, but only just. Startup postings carry any AI expectation more often than mid-market postings, at 27.4%, a range of +1.1 to +14.6 points.
7The numbers by industry
Industries with at least 100 postings, ranked by any AI expectation.
| Industry | Postings (companies) | Any AI | Secure AI | Use AI tools | Degree required | CISSP | Python | Clearance |
|---|---|---|---|---|---|---|---|---|
| AI infrastructure and ML | 386 (71) | 45% | 26% | 17% | 8% | 12% | 44% | 5% |
| Enterprise software | 541 (157) | 45% | 21% | 26% | 8% | 23% | 45% | 8% |
| Media and entertainment | 162 (42) | 36% | 15% | 22% | 10% | 28% | 48% | 1% |
| Cloud infrastructure and developer tools | 260 (31) | 35% | 16% | 15% | 8% | 14% | 43% | 5% |
| Consumer | 142 (30) | 35% | 15% | 21% | 4% | 27% | 34% | 0% |
| Fintech | 1,258 (185) | 32% | 14% | 17% | 15% | 29% | 37% | 1% |
| Cybersecurity vendors | 1,182 (235) | 31% | 14% | 16% | 14% | 18% | 39% | 11% |
| Retail and e-commerce | 263 (44) | 30% | 16% | 14% | 11% | 31% | 43% | 0% |
| Healthcare | 366 (89) | 23% | 13% | 9% | 21% | 38% | 27% | 2% |
| Industrial and manufacturing | 464 (63) | 20% | 10% | 8% | 26% | 26% | 30% | 7% |
| Staffing and consulting | 462 (98) | 18% | 11% | 8% | 17% | 35% | 21% | 31% |
| Defense and government | 416 (37) | 8% | 5% | 2% | 22% | 32% | 22% | 61% |
Source: AKA Security analysis of 5,902 security postings in 12 industries, from AKA's job-board data (open on or after 23 September 2026, read 1 October 2026). Industry tags assigned per company by a local model.
8Three industry patterns
8.1Defense postings lead on clearances
In security postings open in fall 2026, 61% of defense and government postings asked for a security clearance. Staffing and consulting came next, at 31%. The lead, +30.3 points, has a range of +4.0 to +57.4 points.
The exact level is less certain. The range for the 61% runs from 38% to 85%, across 416 postings from 37 companies. Defense and government postings also carry AI expectations less often than staffing and consulting postings: 8% against 18%.
8.2The AI lead is too close to call
AI infrastructure and ML postings and enterprise software postings both carry any AI expectation in 45% of cases. Their lead over media and entertainment, at 36%, has a range of −6.5 to +22.5 points, so it is too close to call.
AI infrastructure and ML postings ask the hire to secure AI in 26% of cases, the highest in the table. Enterprise software postings ask the hire to use AI tools in 26% of cases, against 22% for media and entertainment, a lead that is too close to call.
8.3Healthcare has the highest CISSP share
Healthcare security postings name the CISSP in 38% of cases, the highest in the table. Staffing and consulting comes next at 35%, and the lead, −5.6 to +12.4 points, is too close to call. Industrial and manufacturing postings firmly require a degree most often, at 26%, a lead that is also too close to call.
No test compares neighbouring industries in the middle of the ranking, so the order there carries a Low rating.
9Where the data comes from
The data is a snapshot of AKA's daily read of company job boards: 8,391 security postings at 2,249 companies, each posting counted once. Collection began on 31 July 2026. The postings were open on or after 23 September 2026 and read on 1 October 2026. Every headquarters country is included, and job aggregators are left out. Of the 8,391 postings, 4,587 are at US-headquartered companies and 3,804 elsewhere.
The series' corpus of 15,163 security postings counts every version of a posting and uses a wider definition of security, so it is larger than the 8,391 here.
A local model assigned size and industry tags per company. They are not taken from an outside company database. Of the 8,391 postings, 6,446 carry a size tag. Untagged postings look like the rest on degree requirements, both at 15%, and on the CISSP, 27% against 26%. They carry fewer AI expectations, 24% against 29%, and fewer Python asks, 28% against 34%.
A local model read every posting for degree requirements and AI expectations. Two hosted models, from different companies, read the 4,587 US postings as second and third readers. Agreement across the three pairs runs 0.76 to 0.97 on degrees, 0.71 to 0.85 on securing AI and 0.70 to 0.86 on using AI tools. The CISSP, clearances and Python are counted by keyword search.
Each range of likely values (95%) is found by redrawing whole companies, so a company with many postings does not count as many data points. A range that includes zero means the gap cannot be told from no gap.
10How this answer was stress-tested
Main results, startup minus enterprise, in points: degree −6.3, CISSP −9.2, securing AI +8.9, any AI +5.8, management −7.1, eight or more years −8.3.
| Test | What it found |
|---|---|
| Each AI model on US postings. 3,842 US postings with a size tag. | Degree: −7.6 and −8.2 for the hosted models, −5.1 for the local model, whose range includes zero. Securing AI: +10.1, +9.7 and +10.2, each clear. Eight or more years: −8.7, −8.6 and −9.0, each clear. Any AI: +8.6 clear, +7.2 only just not clear, and +7.2 borderline. |
| Each company counted once. | Every gap keeps its direction: degree −9.0, CISSP −11.0, securing AI +7.8, any AI +6.5, management −7.7, eight or more years −6.0. |
| Repeat postings removed. One per company and base title. | Degree −6.1, CISSP −8.6, securing AI +7.0, management −7.2. Same direction in each. |
| Largest employer dropped in each group. | Degree −6.2, CISSP −8.9, securing AI +9.5, management −6.1. Same direction in each. The largest startup employer has 24 postings. |
| Within four technology industries. | No clear gap for degrees (+0.6), the CISSP (+0.3) or securing AI (+3.3). Management holds at −6.0. |
| Outside four technology industries. | Larger gaps: degree −11.1, CISSP −11.2, securing AI +12.7. Management −7.1, likely but borderline. |
| Second title rule for management. | −5.8, range −8.6 to −2.7. Same direction, smaller by 1.3 points. |
| Management titles removed from the years test. | −6.6, range −11.0 to −2.2. Same direction, smaller by 1.7 points. |
| Small industries. Range around each standout level. | Defense clearance 61% (38% to 85%, 37 companies). AI infrastructure securing AI 26% (20% to 33%, 71 companies). Healthcare CISSP 38% (31% to 45%, 89 companies). |
| Next-industry comparisons. | Clear for the defense clearance lead (+30.3) and the defense AI gap (+10.5). Too close to call for the AI lead (+9.4), tool use (+4.1), CISSP (+3.3) and degree (+4.2) leads. |
11What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| Second hosted models on the 3,804 non-US postings | Whether the size gaps appear outside the US | |
| Size and industry from an outside company source | Replaces the local-model tags | |
| Deeper government, utilities and education coverage | Whether the defense pattern appears beyond 37 companies | |
| A 2024 baseline by size | A change over time by size. The 2024 public job-postings dataset carries no size or industry tags | |
| Excluding job aggregators at collection | Catches aggregators beyond the named list left out here |
Acknowledgements
Question asked by Lenny Zeltser.
References
- [1]AKA Security Research Factory. Security Hiring Research: What Job Postings Say About Security Work. AKA Security, 2026. akasecurity.io/research/security-hiring-research
Cite as
@techreport{aka-rz-2026-05,
title = {How Do Expectations Differ by Company Size and Industry? Startup Postings Ask for Eight or More Years Less Often Than Enterprise Postings},
author = {{AKA Security Research Factory}},
institution = {AKA Security},
type = {Research report},
number = {AKA-RZ:2610.05v1},
version = {1.1.0},
year = {2026},
month = oct,
url = {https://akasecurity.io/research/security-hiring-by-company-size-and-industry}
}