Is Software, IT & Cybersecurity a Good Job Market in Washington-Arlington-Alexandria, DC-VA-MD-WV?

Executive Verdict

Market rating: competitive | Confidence: High

Washington remains a large Software, IT & Cybersecurity market, with more than 6,300 postings across more than 1,500 companies over the last 90 days, but it is a harder market than its headline size suggests.[11] Metro unemployment was 4.4% in February 2026, total nonfarm employment was down -3.2% year-over-year in March, and the metro's Information sector was down -5.6% year-over-year.[7][9][8] At the same time, openings skew toward experienced candidates and in-person work, with about 45% mid-level roles, about 40% senior roles, and about 70% of postings on-site.[12][10]

Best positioned: Your best odds are as a mid-career candidate who can work on-site or hybrid and show real depth in Python, Java, Kubernetes, AWS, Docker, SQL, or CISSP-aligned security work.[10][13][14]

Main caution: The biggest mistake is treating this like a remote-friendly generalist market; only about 10% of postings are remote and only about 10% are entry-level.[10][12]

What Changed Recently

• The local employer backdrop weakened further in March: metro Information employment fell -5.6% year-over-year and overall metro nonfarm employment fell -3.2% year-over-year.[8][9]: That is a softer backdrop than the national topline and helps explain why callbacks are slower and fit standards are tighter.
• Openings are still plentiful on paper—more than 6,300 postings across more than 1,500 companies over the last 90 days—but the market is constrained by work mode, with about 70% on-site, about 20% hybrid, and about 10% remote.[11][10]: If you insist on remote-only work, you are cutting yourself off from most of the available market.
• The local mix is senior-heavy: about 45% of postings are mid-level, about 40% are senior, and about 10% are entry-level.[12]: This is why experienced candidates can still move, while true entry-level applicants face much longer odds.
• Nationally, inflation was +3.1% year-over-year in March 2026, the federal funds rate was 3.64% in April, and total nonfarm payrolls were up just 0.2% year-over-year in April.[15][16][17]: For Washington tech job seekers, that means employers can still fund hiring, but they are doing it cautiously and protecting margins.
• Recent public layoff notices in the metro include General Dynamics Information Technology in Washington, D.C., Amentum affecting 27 employees, and WP Company LLC affecting 277 workers.[1][2][3]: These notices do not prove a category-wide collapse, but they do add short-term candidate supply and more noise around employer demand.

What This Means for You

Entry-Level Candidates

Difficulty: Hard: only about 10% of local postings are entry-level, while about 45% are mid-level and about 40% are senior.[12]

Best target: Aim for on-site or hybrid support, QA, junior automation, and cloud-ops-adjacent roles where you can show Python, AWS, Docker, SQL, or Java project proof instead of waiting for a pure junior remote software opening.[10][13]

Biggest mistake: Applying like a generic junior software engineer to remote-only roles; only about 10% of postings are remote.[10]

Next step: Publish two reviewable projects in the next 30 days: one Python automation workflow and one containerized app deployed on AWS, then mirror those exact terms in your resume bullets.[13]

Mid-Career Candidates

Difficulty: Competitive but workable if you match the local center of gravity: about 45% of postings are mid-level and about 70% are on-site.[12][10]

Best target: Prioritize enterprise and contractor-style employers such as Booz Allen Hamilton, Peraton Corp, CACI, and Leidos, especially for application, platform, cloud, and security engineering work.[24]

Biggest mistake: Sending one generic resume across software, infrastructure, and cyber roles instead of splitting into targeted versions aligned to Python or Java application work, Kubernetes or AWS platform work, or security depth.[13]

Next step: Build a target list of 30 employers and tailor each application to the exact stack named in the posting within 48 hours of the role appearing, since the typical active posting stays open around 25 days.[25]

Career Switchers

Difficulty: Difficult if you are trying to jump straight into software engineering; the market is senior-heavy and not especially remote-friendly.[12][10]

Best target: Start with bridge roles such as support, implementation, IT risk, or systems operations, then move toward software or security once you have local proof of delivery.

Biggest mistake: Over-investing in broad coursework without job-shaped evidence. In this market, a visible project that uses Python, SQL, AWS, Java, or Docker matters more than another generic course line.[13]

Next step: Choose one lane for the next 90 days—software automation, cloud or platform, or security operations—and build a portfolio around the 3-4 skills that recur most often in local postings.[13]

Salary Reality

high pay highly concentrated

The cleanest direct local wage benchmark is a $138,410 median annual wage for information security analysts in the Washington metro, though that figure reflects May 2024 data and one sub-role rather than the whole category.[18] Current local postings are higher at the center, clustering around about $121k to $192k, with a broader band of about $92k to $230k.[19] As a narrower software-engineer proxy, Levels.fyi places Washington, DC at $161,000 median total compensation, with a $120,000 25th percentile and a $202,000 75th percentile, but that reading is lagged to August 2025 and does not represent all IT or cyber jobs.[20] Nationally, Revelio Public Labor Statistics puts the mean offered salary on new Software, IT & Cybersecurity openings at about $124,141 in April 2026 based on n=153,010 postings.[21]

This market can still pay very well, especially for specialized engineering and security work. The catch is that the richer posted ranges sit inside a market dominated by mid-level and senior openings rather than broad-access hiring.[19][12]

High pay is offset by selectivity: about 70% of postings are on-site, only about 10% are remote, and the local Information sector is weaker than a year ago at -5.6%.[10][8]

Best-paying path: The strongest pay tends to sit in specialized software and cybersecurity paths rather than generic support work, with local postings centering well into six figures and national cybersecurity-engineer guides clustering around $108K-$172K or $128,700-$148,157 for mid-level engineers.[19][22][23]

Caution: Do not anchor on the very top of posted or self-reported ranges. Band widths can reflect seniority, role scope, and employer-specific compensation design, and the direct government wage benchmark here covers only one occupation.[19][18]

Where the Opportunities Are Concentrated

Real opportunity is concentrated less in broad remote consumer-tech hiring and more in enterprise-oriented employers. The market is fragmented across employers rather than dominated by one company, but the most consistently active names include Booz Allen Hamilton with more than 150 postings, Peraton Corp with more than 100, and Dataannotation, CACI, and Leidos with more than 75 each over the last 90 days.[6][24] About 30% of postings in the sample come from enterprise employers, and the most-active industries are technology at about 40% and information technology at about 30%.[29][30] This is also not a broad-access market. The mix skews to about 45% mid-level and about 40% senior roles, while entry-level roles are only about 10%.[12] It is largely an in-person market, with about 70% on-site and about 20% hybrid, so candidates who insist on remote-only work are screening themselves out of most available opportunities.[10] The practical takeaway is that you should target employers and titles where your stack maps cleanly to application, platform, or security delivery—not generic “tech” positioning.

• Enterprise and contractor-style employers (high): Best place to start if you can handle structured hiring, longer processes, and on-site expectations; the named-employer list is led by Booz Allen Hamilton, Peraton Corp, CACI, and Leidos.[24]
• Software, platform, and cloud roles built around Python, Java, Kubernetes, and AWS (high): These skills recur most often in local postings, which suggests durable demand where application work overlaps with infrastructure and delivery tooling.[13]
• Security-focused roles with credentialed depth (moderate): CISSP is the clearest named certification signal in the local sample, which suggests employers reward proven security specialization more than generic cyber interest.[14]
• Entry-level remote-first roles (limited): This is the thinnest slice of the market because only about 10% of postings are entry-level and about 10% are remote.[12][10]

Where to focus: Focus first on mid-market to enterprise employers where your background matches Python, Java, Kubernetes, AWS, or security delivery work and where you can accept on-site or hybrid expectations.[13][10]

Skills and Credentials Worth Pursuing

• Python (premium): Python is the single most-requested hard skill in the local sample at about 35%, so it travels across software, automation, scripting, and security use cases.[13]
• Java (differentiator): Java shows up in about 25% of local postings, making it one of the clearest markers for enterprise application work in this market.[13]
• JavaScript (differentiator): JavaScript appears in about 20% of postings, which keeps full-stack and frontend-capable candidates in play even in a market tilted toward infrastructure and enterprise work.[13]
• Kubernetes (premium): Kubernetes is named in about 20% of postings, which makes container orchestration a strong lever for platform, DevOps, and cloud-oriented roles.[13]
• AWS (premium): AWS appears in about 15% of postings and pairs well with the local demand for platform, automation, and enterprise delivery work.[13]
• Docker (differentiator): Docker shows up in about 15% of postings, which is a sign that employers want candidates who can ship and support runnable workloads, not just write code.[13]
• SQL (table stakes): SQL appears in about 10% of postings and is one of the easiest overlap skills if you need to bridge into analytics-adjacent, application, or support-heavy technical roles.[13]
• CISSP (differentiator): CISSP is the most frequently named certification in the local sample, appearing in about 5% of postings that specify a certification requirement.[14]

Adjacent Roles to Consider

• Data analyst / BI analyst (both): If your strongest proof is Python plus SQL reporting or automation rather than production engineering, this is the closest neighboring category.[13]
• IT auditor / risk analyst (pivot): This is a sensible pivot for candidates coming from compliance, operations, or controls who like structured evidence and policy-heavy work.
• Technical implementation / solutions consultant (bridge): This fits candidates who can explain systems, handle clients, and work in enterprise rollouts where on-site or hybrid work is common locally.[10][29]
• Systems / integration engineer (both): There is local evidence of software-adjacent systems work in aerospace and defense, such as Lockheed Martin's avionics role tied to software systems.[31]

30 / 60 / 90-Day Plan

First 30 Days

• Split your resume into two versions: one for software or platform roles and one for security or IT operations roles, each mapped directly to Python, Java, Kubernetes, AWS, Docker, and SQL where relevant.[13]
• Prioritize fresh openings and fast applications; the typical active posting has been open around 25 days, so waiting a week meaningfully hurts your odds.[25]
• Build a short target list led by Booz Allen Hamilton, Peraton Corp, CACI, Leidos, and other enterprise employers instead of spraying applications across the whole market.[24][29]
• Rework your search filters around on-site and hybrid jobs first, because about 70% of postings are on-site and about 20% are hybrid.[10]

Days 31-60

• If you already qualify by experience, move CISSP higher on your list; it is the clearest named certification signal in local postings.[14]
• Create two proof artifacts that hiring managers can review in under five minutes: one containerized deployment and one automation or monitoring workflow using the exact tools named most often in postings.[13]
• Add a commute-ready line to your resume and recruiter outreach so employers do not assume you are remote-only in a market where remote roles are only about 10%.[10]
• If pure software roles are stalling, widen into adjacent searches that still use Python, SQL, AWS, or delivery experience, especially data, implementation, or risk-oriented roles.[13]

Days 61-90

• If you still are not getting traction, stop leading with junior or generalist branding and reposition around the strongest evidence from your background, because the market is centered on mid-level and senior hiring.[12]
• Use the local posted pay center of about $121k to $192k as a reality check for roles that match your depth, and be cautious with postings far outside that band unless the scope clearly justifies it.[19]
• Build employer-specific interview stories for enterprise environments: a production incident, a deployment problem, a security control, and a system improvement with measurable impact.
• If remote-only remains non-negotiable, treat Washington as a selective secondary market rather than your primary one, because the local mix strongly favors in-person work.[10]

Methodology and Confidence

This April 2026 report was generated on May 10, 2026. Latest direct national data: April 2026. Latest direct Washington-Arlington-Alexandria, DC-VA-MD-WV data: April 2026.

Confidence: Overall confidence: High. Based on 7 direct local occupation data points and 29 total local evidence items with recent coverage.

Limitations

• The freshest hard local employment readings are recent, but some of the most specific occupation and wage signals still lag the current month, so conditions may have shifted by the time you read this.
• Several local year-over-year government changes for Washington and D.C. are preliminary and may be revised, so treat small month-to-month changes as directional rather than final.
• The only direct local wage benchmark in this bundle is for information security analysts, so pay for software engineering, infrastructure, help desk, QA, network, and other sub-specialties is estimated with broader posting and salary sources instead of one clean metro wage table.
• The Callings.ai job database is a partial, deduplicated sample of online postings, so direction of demand, leading employer names, skill patterns, and work-arrangement mix are more reliable here than exact market size or exact share estimates.
• This category bundles software, IT, and cybersecurity together, so sub-markets can move differently; for example, clearly data-first roles may belong in a neighboring analytics category and should not be assumed to follow the exact same pattern.

References

1. Does. Industry Closings and Layoffs WARN Notifications 2026 | does · 2026-04 · does.dc.gov
2. Labor. Labor - warn_notice_layoff · 2026-03 · labor.maryland.gov
3. Warntracker. WP Company LLC Lays Off 277 Workers — Washington D.C., DC WARN Notice April 2026 · 2026-02 · warntracker.com
4. Coalage. Coronado Issues WARN Notices in West Virginia - Coal Age · 2026-02 · coalage.com
5. Workforcewv. WARN Listing - WorkForce West Virginia · 2026-04 · workforcewv.org
6. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
7. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-02 · data.bls.gov
8. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-03 · data.bls.gov
9. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-03 · data.bls.gov
10. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
11. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
12. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
13. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
14. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
15. Federal Reserve Economic Data. Consumer Price Index for All Urban Consumers: All Items in U.S. City Average · 2026-03 · fred.stlouisfed.org
16. Federal Reserve Economic Data. Federal Funds Effective Rate · 2026-04 · fred.stlouisfed.org
17. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-04 · data.bls.gov
18. Ccitraining. Cybersecurity Salary Guide (2026): Top Jobs & Locations · 2026-01 · ccitraining.edu
19. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
20. Levels. Software Engineer Salary in Washington, DC · 2025-08 · levels.fyi
21. Reveliolabs. Salaries - Revelio Public Labor Statistics (RPLS) · 2026-04 · reveliolabs.com
22. Bluesignal. 2026 Compensation Trends and Salary Guide - Blue Signal Search · 2025-11 · bluesignal.com
23. Motionrecruitment. 2026 Cybersecurity Salary Guide: Engineer, Analyst, and Job Insights · 2026-01 · motionrecruitment.com
24. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
25. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
26. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-04 · data.bls.gov
27. Bureau of Labor Statistics. Bureau of Labor Statistics Data · 2026-03 · data.bls.gov
28. Federal Reserve Economic Data. Average Hourly Earnings of All Employees, Information · 2026-04 · fred.stlouisfed.org
29. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
30. Callings.ai. Callings.ai job-market aggregation · 2026-04 · callings.ai
31. Lockheedmartinjobs. Aircraft Electrical/Avionics Technician, F-22 - Level 4 | Lockheed Martin · 2026-04 · lockheedmartinjobs.com