In the latest live check (11 November 2026), 1,000+ listings with a cybersecurity word in the title claimed to be remote. Under 1% were confirmed open worldwide, under 10% had no lock we could find, and most were limited to a place, working hours or a language. Below are the 10 remote cybersecurity job types ranked by how many live listings each had, with what the work is and who can apply from where.
Disclosure: Covesight is the site you are reading, and we built it. The counts below come from Covesight's own daily check of remote listings, rounded down.
How we counted
Covesight reads remote listings every day from companies' own hiring systems and a few job feeds, and checks each one for where the company can hire, working hours and language. For this page we kept the listings whose title contains security, cybersecurity, cyber, infosec, AppSec, SOC analyst, penetration testing, red team, threat, vulnerability, incident response, detection engineer, GRC or identity and access. Each listing counts once, under the first job type below that its title fits. A title is a rough signal, so some cybersecurity roles with plain titles, such as "Software Engineer" at a cybersecurity company, are not counted here. How Covesight works explains the three states.
Across all live remote listings, under 1% were confirmed open worldwide. For cybersecurity listings the figure was under 1%. Cybersecurity listings were more often open worldwide than remote listings overall.
The top 10 remote cybersecurity jobs right now
Ranked by live listings in the latest check, most first. Job types with the same count stay in a fixed order.
1. Security architects and general security engineers
Broad technical roles that design or build security across many systems. Titles are often just "Security Engineer", with the focus in the description.
Under 30% of the cybersecurity listings in the latest check. Some were confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and the United Kingdom. Example titles: "Security Engineer", "Security Architect", "Cyber Test Engineer".
2. Security managers, directors and CISOs
They run a security team or program, set priorities and report risk to the leadership. Most ask for years of hands-on security work first.
Under 15% of the cybersecurity listings in the latest check. Some were confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and the United Kingdom. Example titles: "VP, Security", "Head of Security", "Director, Security".
3. Security analysts, specialists and other roles
Analyst and specialist roles that do not name a focus, plus security sales, training and support. Read the description to see which of the types above it is.
Under 15% of the cybersecurity listings in the latest check. None was confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and Germany. Example titles: "SAP Security", "Cyber Analyst", "Security Analyst".
4. SOC analysts and detection and response engineers
They watch alerts, investigate suspicious activity and respond when something goes wrong. Analyst roles in a security operations center (SOC) are a common first security job.
Under 15% of the cybersecurity listings in the latest check. Some were confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and the United Kingdom. Example titles: "SOC Analyst", "L3 SOC Analyst", "SOC Analyst (CAN)".
5. Application and product security engineers
They work with developers to find and fix security bugs in the company's own software, through code review, testing and safer defaults.
Under 10% of the cybersecurity listings in the latest check. None was confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and Canada. Example titles: "Product Security Lead", "Manager, Product Security", "Product Security Engineer".
6. Cloud and infrastructure security engineers
They secure servers, networks and cloud accounts: configuration, monitoring and the guardrails that stop a mistake from becoming a breach.
Under 10% of the cybersecurity listings in the latest check. None was confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and India. Example titles: "Cloud Security Engineer", "Cloud Security Architect", "Security Engineer, Cloud".
7. Governance, risk and compliance (GRC) specialists
They map a company against security standards and laws, run audits and manage risk. It is one of the few security paths that does not start with coding.
Under 10% of the cybersecurity listings in the latest check. Some were confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and Canada. Example titles: "GRC Analyst", "GRC Manager", "GRC Officer".
8. Threat intelligence and vulnerability analysts
They track who is attacking and how, study malware, and decide which software flaws a company must patch first.
Under 10% of the cybersecurity listings in the latest check. At least one was confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and Singapore. Example titles: "Threat Analyst", "Threat Researcher", "Vulnerability Engineer".
9. Penetration testers and red team specialists
They attack a company's own systems, with permission, to find weak points before criminals do, and write up what they found and how to fix it.
Under 5% of the cybersecurity listings in the latest check. None was confirmed open worldwide, and some had no lock we could find. The places named most often: the USA and Canada. Example titles: "Penetration Tester", "Offensive Security Lead", "Senior Red Team Analyst".
10. Identity and access management (IAM) engineers
They control who can log in to what: single sign-on, permissions, keys and certificates.
Under 3% of the cybersecurity listings in the latest check. None was confirmed open worldwide. The places named most often: the USA and Canada. Example titles: "Senior IAM Engineer", "Security Engineer, IAM", "Identity / IAM Engineer".
Which remote cybersecurity jobs you can apply to from where you live
A remote listing is open to you when it names your country, names a region that includes it, or is confirmed open worldwide. This is what the latest check found for cybersecurity listings:
| If you live in | Share of cybersecurity listings open to you |
|---|---|
| The US | under 60% |
| The UK | under 15% |
| Canada | under 10% |
| Germany | under 10% |
| Australia | under 3% |
Someone in the US could apply to under 60% of them. Outside the US, the UK came closest, at under 15%. Among the listings limited to a place, the places named most often were the USA, the United Kingdom, Canada, Germany and India. Each country page on the board lists every remote job open to someone living there, in every field, and is updated every day.
Remote cybersecurity jobs with a full page on the board
None of today's cybersecurity listings has a full public page yet. The board shows the newest jobs confirmed open worldwide in full, and you can see every listing that is open to you, with the company and the apply link, with a free Covesight account.
Related role pages: Engineering jobs, Operations jobs and Data jobs. Jobs confirmed open worldwide in every field are on the open-worldwide board.
What the official numbers say
In the US, the Bureau of Labor Statistics projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. It counted about 192,900 such jobs in 2025 and a median annual wage of $129,180 in May 2025. Those are US figures for one job title, not for every security role and not for remote work.
If the job titles above feel like a maze, the US government's NICE Workforce Framework for Cybersecurity, published by NIST, describes 52 security work roles in 7 categories. It is a good map for choosing a direction and for matching your skills to the words employers use.
How to land a remote cybersecurity job
- Pick one job type above and learn its tools. A home lab, a write-up of a capture the flag challenge or a detection rule you wrote shows more than a list of courses.
- Read the location line first. Security roles often need a citizen or resident of one country because of client data and contracts, so the table above matters more here than in most fields.
- Treat a recruiter who only talks over a chat app with care. The US Federal Trade Commission warns that scammers impersonate real employers on job platforms, hold interviews only by text and ask you to pay for equipment. A real employer never asks you to pay. How to check if a remote job posting is real shows each step.
Where Covesight fits, and where other sites do better
Covesight is the site you are reading, and we built it. It is free, on the web and in the app, and employers do not pay to be listed. For a cybersecurity job search it does three things most job sites do not:
- It reads the fine print of every remote listing, every day, for where the company can hire, working hours and language, and labels each one. That is how this page can say that under 1% of 1,000+ remote cybersecurity listings were confirmed open worldwide.
- With a free account it shows only the jobs open to the country you live in, ranked, with an optional daily email.
- Listings that leave the company's hiring system are removed at the next daily check.
Where other sites do better: Covesight reads companies' own hiring systems and a few general feeds, so it misses jobs that need a government security clearance posted only on clearance job boards, contract and freelance security work, and roles posted only on LinkedIn or through recruiters (LinkedIn vs Covesight covers when to use each). If you need hybrid or office work near you, a general job site with a location search is the better tool.
Best remote job sites in 2026 compares 12 sites on the same question. Before you reply to any offer, check that the job is real. To see how many remote jobs in every field are open to your country today, try the free Country Check.