Is Software, IT & Cybersecurity a Good Job Market in Baltimore-Columbia-Towson, MD?

Executive Verdict

Market rating: competitive | Confidence: High

Baltimore is still a real market for Software, IT & Cybersecurity, not a dead one: metro unemployment was 3.9% in August, and the metro had 66,200 workers in the broad computer and mathematical group with a $128,330 median annual wage in 2025.[35][36][20] But landing a role is not easy. The local sample shows more than 2,400 postings across more than 400 companies, yet about 55% of openings are senior, about 80% are on-site, and less than 5% of postings that state a sponsorship policy mention visa sponsorship.[13][4][16][5] Statewide September signals reinforce the idea of a selective market rather than a weak one: Maryland software, IT & cybersecurity postings were up 14.4% year over year while employment in the same occupation family was down 1.9%.[11][12]

Best positioned: Candidates with proven delivery in Python or Java plus cloud, Kubernetes, Docker, AWS, Linux, and security- or clearance-friendly experience have the best odds right now.[24][29]

Main caution: The biggest trap is mistaking high advertised pay for broad access; Baltimore's openings skew senior, on-site, and weighted toward consulting, public-sector, and defense-linked work more than broad-remote consumer software teams.[4][16][23]

What Changed Recently

• Maryland software, IT & cybersecurity postings were up 14.4% year over year in September, even as statewide employment in the same occupation family was down 1.9%.[11][12]: That usually means employers are still posting and backfilling, but they are being choosier about who they hire and where they add net new headcount.
• Baltimore metro Information employment was down 4.1096% year over year in August, while Professional and Business Services was down a milder 0.3512%.[3][26]: Pure product-style or media/telecom-adjacent roles look tighter than contractor, consulting, infrastructure, and client-delivery work.
• Anduril announced a $3.7 billion investment at Tradepoint Atlantic with more than 3,100 planned permanent jobs, though software and cyber counts were not specified.[27]: It is not an immediate hiring list, but it is a strong local signal that defense-tech demand around Baltimore is deepening.
• National CPI was up +3.0% year over year in August, average hourly earnings were up +3.0% year over year in September, and the federal funds rate was 3.75% in September.[8][10][9]: Compensation pressure is steadier than it was during the hottest tech market, so you should expect firmer budgets and tougher salary negotiations.
• Baltimore Polytechnic Institute added a cyber range for hands-on threat detection and incident response training in late September.[28]: For cyber candidates, local employers have more reason to expect practical proof of skill, not just coursework.

What This Means for You

Entry-Level Candidates

Difficulty: Hard.

Best target: Aim first at support, QA, junior cyber operations, and infrastructure-heavy roles where you can prove troubleshooting, scripting, and systems reliability.

Biggest mistake: Applying only to remote software engineer roles and leading with coursework instead of shipped work.

Next step: Build one portfolio artifact that shows Python plus AWS, Linux, testing, or security operations in a way a hiring manager can review in under five minutes.

Mid-Career Candidates

Difficulty: Moderate if your skills map cleanly to current demand.

Best target: Senior software, platform, DevOps, cloud, and security engineering roles tied to consulting, public-sector, or defense-adjacent buyers.

Biggest mistake: Using a generic full-stack resume when your strongest advantage is platform, automation, security, or delivery at scale.

Next step: Split your resume into two versions: one for software/platform work and one for infrastructure/security work, each with quantified outcomes and tool depth.

Career Switchers

Difficulty: Hard to very hard without adjacent proof.

Best target: Bridge through GRC, implementation, technical support, QA automation, or SOC-support paths rather than competing immediately for core engineering titles.

Biggest mistake: Trying to make a total reset instead of converting prior domain knowledge into a tech-flavored role.

Next step: Pick one lane and create an evidence trail: a compliance write-up, a support runbook, a test-automation repo, or a security lab that directly matches that lane.

Salary Reality

high pay highly concentrated

Government wage data shows Baltimore's broader computer-and-mathematical group at $62.85 per hour versus $36.72 across all occupations locally in May 2025.[18] For the BLS computer and mathematical major group, annual pay ranged from $88,690 at the 25th percentile to $209,210 at the 90th, with a $128,330 median.[19][20][21] Current posted salary ranges in the local job sample center on about $141k to $216k, but that sample is heavily senior and on-site.[22][4][16]

This is a market where solid six-figure pay is realistic once you are in the core of demand, but not a market where most candidates can walk into that pay band quickly.

The upside is offset by selectivity: many openings skew senior, local work is often tied to consulting or security-sensitive environments, and fully remote access is narrow.

Best-paying path: The strongest pay tends to sit in senior software, cloud, DevOps, and security work serving consulting, public-sector, or defense-oriented employers, especially where Python, Java, Kubernetes, Docker, AWS, and Linux stack together.[23][24]

Caution: Do not overread the top end of advertised pay. The current posting sample likely overweights senior, specialized, and sometimes clearance-linked roles, while statewide mean offered salary on new openings was about $121,645 in September across a broader role mix.[25][22]

Where the Opportunities Are Concentrated

Real opportunity is concentrated less in broad consumer-tech hiring and more in service-heavy, government-linked, and defense-adjacent work. In the local posting sample, the most-active industries were IT services and IT consulting at about 30%, government and public sector at about 20%, software development at about 20%, defense and space manufacturing at about 10%, and aerospace and defense at about 10%.[23] That mix fits Baltimore's on-site bias and with TS/SCI clearance showing up as the most frequently named credential in the sample.[16][29] The skill pattern also points to infrastructure-aware software work rather than narrow front-end specialization. Python appears in about 55% of sampled postings, Java in about 40%, Kubernetes and Docker in about 30% each, AWS and Git in about 25% each, Linux in about 20%, and CI/CD in about 15%.[24] Employers are numerous rather than concentrated—more than 2,400 postings across more than 400 companies over the last 90 days, with fragmented hiring and Erias Ventures, LLC. the only named high-volume employer in the evidence at more than 175 postings.[13][14][15] Fresh local investment also leans defense-tech. Anduril announced a $3.7 billion Tradepoint Atlantic investment with more than 3,100 planned permanent jobs, though it did not specify how many of those jobs will be software or cyber roles, and Fulton-based RemoteThreat emerged from stealth with $7 million for an offensive-cyber platform.[27][34]

• Defense and public-sector tech (high): This lane stands out because government and public sector account for about 20% of local postings, defense and space manufacturing about 10%, aerospace and defense about 10%, and TS/SCI clearance is the most common named credential in the sample.[23][29]
• IT services and consulting (high): This is the single largest industry slice at about 30%, which usually favors candidates who can implement, operate, secure, or modernize systems across client environments.[23]
• Software product and platform roles (moderate): There is still meaningful software-development demand at about 20% of local postings, but it sits inside a market that skews senior and on-site.[23][4][16]
• Remote-first local roles (limited): Only about 5% of sampled openings are remote, so candidates insisting on fully remote local roles are shopping in a much smaller pool.[16]

Where to focus: Focus first on mid- to senior-level roles that combine software with cloud, infrastructure, or security in consulting, public-sector, or defense environments.

Skills and Credentials Worth Pursuing

• Python (table stakes): Python appears in about 55% of sampled local postings, making it the clearest common language across software, automation, cloud, and security workflows in this market.[24]
• Java (table stakes): Java shows up in about 40% of sampled local postings, which keeps it highly relevant for enterprise and contractor-heavy environments around Baltimore.[24]
• Kubernetes + Docker (differentiator): Kubernetes and Docker each appear in about 30% of local postings, and that matters even more in a market where senior roles dominate the sample.[24][4]
• AWS (differentiator): AWS appears in about 25% of sampled local postings, so cloud fluency is often the difference between being seen as an app coder and being seen as deployment-ready.[24]
• Linux + Git + CI/CD (differentiator): Linux appears in about 20% of local postings, while Git and CI/CD appear in about 25% and about 15%, respectively, which signals that employers want operational delivery habits, not just coding skill.[24]
• TS/SCI clearance (premium): TS/SCI clearance is the most frequently mentioned credential in the local sample, even though it appears in only about 5% of postings overall; that is a strong signal because cleared roles tend to be harder to fill.[29]
• AI-assisted development workflow (differentiator): AI-assisted tools are now used daily or weekly by 88.3% of surveyed organizations, more than half of U.S. tech postings require AI or machine-learning skills, and the emerging skill set includes LLM APIs, RAG architecture, evaluation, observability, and cost control.[30][31][32]
• Cloud security / DevSecOps / threat intelligence (premium): These specializations are repeatedly flagged as higher-value cybersecurity paths in 2026 and fit Baltimore's mix of security-sensitive, infrastructure-heavy, and defense-adjacent work.[33]

Adjacent Roles to Consider

• Technical project manager / scrum master (bridge): It is a practical bridge for people who understand software delivery but are not the strongest fit for hands-on engineering screens.
• Solutions engineer / sales engineer (pivot): This works well for candidates with technical depth plus client-facing communication skills.
• GRC or cybersecurity compliance analyst (bridge): It is a realistic entry point for career switchers who can map prior audit, policy, risk, or regulated-industry experience into cyber work.
• Implementation consultant / technical account manager (both): Baltimore's consulting-heavy demand makes client-delivery work a useful alternative for people who can configure, troubleshoot, and translate requirements.

30 / 60 / 90-Day Plan

First 30 Days

• Split your resume into two tracks: software/platform and IT/security. Do not send one generic version to both kinds of jobs.
• Build a target list of Baltimore-area employers in consulting, government, and defense-adjacent work, and rank them by skill match rather than brand name.
• Turn one recent project into a hiring asset: GitHub repo, architecture diagram, deployment notes, and a short results summary.
• Stop filtering for remote-only roles if Baltimore is your intended market; widen to on-site and hybrid within commuting range.
• Rewrite your headline and bullets around Python, Java, Kubernetes, Docker, AWS, Linux, Git, and CI/CD where you can honestly support them.

Days 31-60

• Finish one portfolio project that proves deployment, not just coding: for example, a containerized app on AWS with CI/CD and monitoring.
• If you are targeting cyber, complete a hands-on lab sequence in detection, incident response, or cloud security and document what you learned.
• Apply in tighter batches by lane: one batch for software/platform, one for infrastructure, one for cyber. Measure response rate by lane and cut the worst-performing one.
• Ask three working contacts to review your resume against a real Baltimore posting and mark what still looks generic.
• If you need a baseline cyber credential, finish it before the market pivots to the newer Security+ version later this year.[17]

Days 61-90

• If core software roles are not converting, pivot deliberately into implementation, GRC, QA automation, or technical project delivery instead of continuing a low-yield scattershot search.
• Track defense-tech expansion around Baltimore and revisit employers tied to secure, on-site, or public-sector work every two to three weeks.
• Create a proof packet for interviews: resume, portfolio links, one architecture page, one incident or troubleshooting write-up, and one metrics-based case study.
• Use salary conversations to anchor on scope and tool stack, not just title, because seniority and specialization drive the best-paying local roles.
• Decide whether you are building toward a clearance-friendly path, a cloud/platform path, or a cyber-specialist path, and align every application to that decision.

Methodology and Confidence

This September 2026 report was generated on October 10, 2026. Latest direct national data: September 2026. Latest direct Baltimore-Columbia-Towson, MD data: October 2026.

Confidence: Overall confidence: High. Anchored in recent local labor data, wage benchmarks, and current local hiring signals.

Limitations

• The freshest metro labor-market context in this report is from August 2026, while some occupation wage benchmarks are annual 2025 figures, so official pay and employment data can lag current conditions.
• Some Baltimore figures refer to the broader computer and mathematical occupational family or the combined Software, IT & Cybersecurity category rather than one title like software engineer, sysadmin, or SOC analyst, so niche sub-roles can behave differently.
• Statewide occupation data was used as a proxy when monthly occupation-specific direction was available for Maryland but not for the Baltimore metro, so statewide hiring and employment changes may not match the metro perfectly.
• The Callings.ai job database is a partial, deduplicated sample of online postings, so it is more reliable for showing demand patterns, leading employer names, work setup, and requested skills than for exact market size or exact employer share.
• Several August 2026 unemployment, employment, and labor-force change figures are preliminary and may be revised in later releases.

References

1. Labor. Work Adjustment and Retraining Notification (WARN) and Other Dislocation Notices - Division of Workforce Development and Adult Learning · 2026-08 · labor.maryland.gov
2. Reveliolabs. Mass-layoff Notices — Revelio Public Labor Statistics (RPLS) · 2026-09 · reveliolabs.com
3. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-08 · data.bls.gov
4. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
5. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
6. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-09 · data.bls.gov
7. Federal Reserve Economic Data. All Employees, Total Nonfarm · 2026-09 · fred.stlouisfed.org
8. Federal Reserve Economic Data. Consumer Price Index for All Urban Consumers: All Items in U.S. City Average · 2026-08 · fred.stlouisfed.org
9. Federal Reserve Economic Data. Federal Funds Effective Rate · 2026-09 · fred.stlouisfed.org
10. Federal Reserve Economic Data. Average Hourly Earnings of All Employees, Total Private · 2026-09 · fred.stlouisfed.org
11. Reveliolabs. Job Openings — Revelio Public Labor Statistics (RPLS) · 2026-09 · reveliolabs.com
12. Reveliolabs. Employment — Revelio Public Labor Statistics (RPLS) · 2026-09 · reveliolabs.com
13. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
14. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
15. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
16. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
17. CompTIA. Security+ Certification V8 (Coming Soon, Launching November 2026) | CompTIA · 2026-09 · comptia.org
18. Bureau of Labor Statistics. Occupational Employment and Wages in Baltimore-Columbia-Towson — May 2025 : U.S. Bureau of Labor Statistics · 2026-07 · bls.gov
19. Bureau of Labor Statistics. Bureau of Labor Statistics Data · data.bls.gov
20. Bureau of Labor Statistics. Bureau of Labor Statistics Data · data.bls.gov
21. Bureau of Labor Statistics. Bureau of Labor Statistics Data · data.bls.gov
22. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
23. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
24. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
25. Reveliolabs. Salaries — Revelio Public Labor Statistics (RPLS) · 2026-09 · reveliolabs.com
26. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-08 · data.bls.gov
27. Commerce. State of Maryland, Baltimore County Announce Anduril Industries to Invest $3.7B, Create Over 3,100 Jobs with New Shipbuilding Facility · 2026-10 · commerce.maryland.gov
28. Baltimorecityschools. City Schools celebrates a high school first: Poly's "cyber range" cybersecurity learning environment | Baltimore City Public Schools · 2026-09 · baltimorecityschools.org
29. Callings.ai. Callings.ai job-market aggregation · 2026-09 · callings.ai
30. Linearb. AI in software development: what the 2026 data shows · 2026-09 · linearb.io
31. Alliedonesource. Your Guide to 2026 IT Salary Ranges · 2026-01 · alliedonesource.com
32. Ayautomate. 15 AI Engineer Skills Every Hire Should Have · 2026-06 · ayautomate.com
33. Lockedinai. High-Income Skills to Master in 2026 for Higher Pay · 2026-02 · lockedinai.com
34. Citybiz. RemoteThreat Emerges From Stealth With $7M and Offensive Cyber Platform · 2026-09 · citybiz.co
35. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-08 · data.bls.gov
36. Bureau of Labor Statistics. Bureau of Labor Statistics Data · data.bls.gov

Live Openings in This Market

This report is published monthly; its companion page tracks the active Software, IT & Cybersecurity openings in Baltimore-Columbia-Towson, MD from the live Callings.ai job index. Browse current Software, IT & Cybersecurity openings in Baltimore-Columbia-Towson, MD.