MITRE ATT&CK jobs and hiring demand

Name: MITRE ATT&CK hiring demand
Creator: ApplyDjinn
License: https://applydjinn.com/data-license

Core and required roles are separated from contextual and optional mentions so the headline does not overstate job intent.

Explore MITRE ATT&CK by location

Select up to five markets; results and hiring evidence update together.

16core + required roles34context + optional mentions15remote-friendly• 0 this week

Employer concentration

EPAM accounts for 10 of 50 mentions (20%). The remaining 40 mentions span other employers.

View without top 1 employer →View without top 3 employers →

MITRE ATT&CK market intelligence visualization

Security · responsibility and evidence

MITRE ATT&CK market guide

MITRE ATT&CK is a knowledge base of adversary tactics and techniques grounded in observed behavior. Teams use it to structure threat analysis, detection coverage and defensive testing. A technique mapping describes behavior; it does not by itself prove that a detection works.

50 live roles26 hiring companies30% remote-friendly

Vacancy evidence map

Where MITRE ATT&CK carries hiring weight

Each segment represents roles where MITRE ATT&CK was parsed at that evidence tier. This keeps a required production skill separate from contextual stack language.

0 Core16 Required23 Supporting11 Optional

16core + required32% of mentions

1.9roles per company26 employers

Market interpretation

What MITRE ATT&CK demand means in practice

Connect a technique to the telemetry and analytic logic available in your environment. Explain what the rule can observe, which variations it misses and how you validated it. Useful portfolio evidence includes an explicit coverage gap, a test scenario and a measured improvement rather than a colored matrix without supporting data.

Threat IntelligenceDetection & Incident Response

Technical references: MITRE ATT&CK reference ↗

Reading the market

Signals to look for

Look for responsibility for technique mapping tied to observable telemetry.
Look for responsibility for a detection test and its blind spots.
Look for responsibility for a coverage gap and the change that addressed it.

Geographic demand

Top MITRE ATT&CK locations

United States11 Remote8 Israel5 California, United States4 India4 Tel Aviv, Israel4 Ukraine4 Bellevue, Washington, United States3

Questions candidates ask

MITRE ATT&CK hiring FAQ

What work does MITRE ATT&CK represent?

What evidence should I provide for a MITRE ATT&CK role?

How MITRE ATT&CK appears in job requirements

Inferred from the title and requirement wording in 50 active roles; each role is counted once. Read the methodology.

Posting evidence, not a company-wide stack claim

Main / core: 0%(0)
Required: 32%(16)
Supporting / context: 46%(23)
Nice-to-have: 22%(11)

Skills mentioned with MITRE ATT&CK

A shared posting does not always require both skills. Explicit alternatives are counted separately.

Cloud40 together13 both required Python37 together10 both required Automation31 together12 both required AWS27 together7 both required SIEM26 together8 both required Threat Intelligence26 together5 both required

Role graph

Roles hiring for MITRE ATT&CK

Application Security 20 Security 8 Detection & Incident Response 6 Security Operations 5 Software Engineering 5 Customer Success 2 Business Systems 1 DevOps & Platform 1

Latest roles mentioning MITRE ATT&CK

Detection Engineering & Automation Lead

Required

JustMarkets Tech — Europe

Cybersecurity Analyst

Context

DXC Luxoft — Hyderabad, India

Incident Response Expert

Context

Sygnia — United States

Exposure Management SME

Nice

SoftServe — Poland

SOC Analyst L1

Context

MODUS X — Kyiv, Ukraine

Security Operations Center (SOC) Analyst, 24/7 shifts

Required

SolarEdge — Sofia, Bulgaria

View all 50 roles mentioning MITRE ATT&CK →

Original hiring measurements follow the ApplyDjinn data license and attribution rules. Employer descriptions, logos and trademarks remain with their owners.