DevSecOps: market
DevSecOps embeds security into the development and operations pipeline: code and dependency scanning, image checks, policies for infrastructure as code, secrets management and runtime protection. We track 2 759 open positions listing DevSecOps, 2 646 of them fresh. The role sits between DevOps and information security and requires experience in both. Most of the demand comes from DevOps, Security and Architect roles. It most often appears next to AWS, Azure and Kubernetes. 42% of the postings allow fully remote work. Below is measured demand for DevSecOps engineers.
The DevSecOps market currently has 2,759 open roles, 2,646 of them freshly observed. Median salary $11,236/mo. Observed candidate pool — 142.
42% of DevSecOps postings allow fully remote work; the share counts only postings that state the work format.
⚠ salary known for 146 of 2759 jobs; remote share from 2262 with a stated format; 2646 counted as fresh observations; trend and hiring difficulty are not shown
Timeline: postings and sources
How many DevSecOps postings appeared each week since 10 Aug, and from how many sources. The second line separates market growth from coverage growth: a jump in the week new sources were connected means we started seeing more, not that the market grew.
New postings and active sources per week
Sources over the period: 121
New sources connected: 17 Aug +16 · 24 Aug +15 · 31 Aug +3 · 7 Sept +11 · 14 Sept +10 · 21 Sept +28 · 28 Sept +5 · 5 Oct +5 · 12 Oct +7
Week = posting first-seen date, all statuses. A posting belongs to the technology by its stack tag; the series starts on 10 Aug 2026 — earlier tags were assigned differently and are not comparable. Sources are distinct collection channels; their names are not published.
Salaries over time
Median DevSecOps salary per week, USD per month.
Median salary, USD per month
Only postings with a USD salary and a known period (month or year), $500–$50,000 per month. Weeks with fewer than 10 such postings are left blank — that means no data, not zero.
Remote work over time
Share of DevSecOps postings offering fully remote work, per week.
Remote postings, %
The share is among postings that state a format (remote, hybrid, office). Weeks with fewer than 10 such postings are left blank.
Countries over time
How the share of DevSecOps postings in each of the top countries changed, per week.
Postings in the country, %
Share among postings with a known country; the chart shows the five countries with the most postings over six months. Weeks with fewer than 20 postings with a known country are left blank. A rising share can mean a newly connected source in that country rather than market growth.
Demand and observed supply
| Open demand | 2,759 |
| Observed supply | 142 |
⚠ candidates matching a vacancy are not counted yet: demand and the observed pool are shown
Salary distribution
One in ten earns under $5,375, one in ten over $16,875. Half the market falls between $8,500 and $14,000. Sample: 146.
The range histogram for DevSecOps postings uses only postings with an explicit compensation range; the median is computed over the same sample.
Demand geography
| country | jobs |
|---|---|
| US | 958 |
| PL | 280 |
| GB | 161 |
| IN | 111 |
| SG | 89 |
| DE | 89 |
| RU | 54 |
| MX | 51 |
| FR | 45 |
| BR | 43 |
The top country for DevSecOps demand is the US (958 positions).
⚠ job counts only: salary by country is not published
Used together with
DevSecOps most often appears next to AWS, Azure and Kubernetes.
Roles that use it
| role | jobs |
|---|---|
| DevOps | 843 |
| Security | 664 |
| Architect | 196 |
| Platform Engineer | 174 |
| Fullstack | 116 |
| Backend | 116 |
| PM | 82 |
| Data | 79 |
| QA | 57 |
| ML/AI | 49 |
⚠ the `Other` and `IT` buckets are excluded as non-roles
Demand by grade
| grade | jobs |
|---|---|
| senior | 847 |
| principal | 186 |
| lead | 182 |
| middle | 101 |
| junior | 35 |
Senior-and-above is about 90% of 1 351 graded DevSecOps postings. Sitting between two disciplines makes the role almost entirely senior.
⚠ demand side only: the grade of the observed pool is unknown for most of it
Employers
Demand is spread across 1,045 employers. The largest accounts for 7.8%, the top ten for 24.9%; the remaining 75.0% is long tail.
| share | value |
|---|---|
| top-1 | 7.8% |
| top-3 | 16.8% |
| top-10 | 24.9% |
| long tail | 75.0% |
⚠ names are not shown: staffing agencies and end employers are not yet told apart by the classifier
Where Zorky sees this market
Observed across 91 sources; the largest accounts for 29.4% — this market does not rest on a single channel.
DevSecOps postings arrive mostly from ATS & career sites and job boards & aggregators.
Recent openings
- Senior Cloud Architect
- AI Data Governance Deputy Director · TH
- Agentic PDLC Architect · PL
- DevOps (Platform Engineer) · RU
- Principal Data Engineer · US
- Lead Software Engineer - Product Safety · GB
- IT Security Engineer
- Staff Product Security Engineer · US
Adjacent markets
⚠ adjacent markets for comparison are not defined yet
How this is measured
- Vacancy
- an open job that cleared the quality gate and lists at least two technologies
- Observed candidate
- a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter
- Matchable candidate
- not counted yet
- Window
- jobs open at the moment the snapshot was built
About the data
- Some breakdowns are hidden: their data coverage is not yet sufficient.
- Statistics are shown only where the sample clears a quality gate.
- A missing block does not mean a value of zero.
Breakdowns currently hidden: 7.
Data as of 2026-10-22
Frequently asked questions
Common questions about the DevSecOps market — short answers from the same data slice.
How does DevSecOps differ from DevOps?
DevOps owns delivery speed and reliability, DevSecOps — making sure security is checked automatically at every step of that delivery: SAST/DAST, SCA, image and IaC scanning, access policies.
Which tools appear in DevSecOps postings?
Code and dependency scanners (Semgrep, SonarQube, Snyk, Trivy), policies (OPA, Kyverno), secrets (Vault), cloud and Kubernetes security, plus the CI/CD where all of it is embedded.
How do people get into DevSecOps?
Usually from DevOps by adding security, or from AppSec by adding automation. A practical start is embedding scanners into your own pipeline and triaging the findings.
How remote-friendly is DevSecOps?
42% of postings with an explicit format allow fully remote work; the slice tracks 2 759 open positions.