Two Headlines, One Market
In mid-October, two reports landed in the same week. The first said US cybersecurity hiring had hit a four-year low. The second said the largest companies were rushing to create a brand-new executive job: head of AI security.
Read separately, they tell opposite stories. Read together, they describe one market that is changing shape. Demand is not disappearing. It is moving from some roles to others, and AI is the force pushing it.
What Is Shrinking
CyberSN maps every posting to 45 functional roles based on the skills required, not on the title a recruiter picked. That matters, because, as the report puts it, "job titles are noisy." Here are the roles with the steepest drops compared with the same period of 2025:
| Role | Postings 2026 (Jan-Sep) | Change vs 2025 |
|---|---|---|
| Cyber Insider Threat Analyst | 1,088 | -55.6% |
| Cyber Risk Analyst | 4,031 | -51.5% |
| Penetration Tester | 3,063 | -45.9% |
| Cybersecurity Lead | 4,688 | -41.0% |
| Threat Hunter | 1,013 | -40.0% |
| Cybersecurity Project Manager | 783 | -39.4% |
| CISO (incl. CSO, BSO, ISO) | 2,832 | -38.9% |
The pen tester line stands out. Offensive testing is one of the areas where AI tools have improved fastest, and funding is flowing to startups that automate it. Fewer ads for manual testers is consistent with that trend, even if the report itself does not claim a cause.
What Is Growing
AI Security Engineer: +268.3%
Postings for AI security engineers more than tripled. Cyber data scientist postings rose 203.5%. Keep the scale in mind: Help Net Security notes that AI security engineer postings still total only about 2,400. It is a small role growing very fast, not yet a mass market.
AI is also spreading into ordinary job descriptions. Just under 15% of all postings referenced AI over the nine months, and that share peaked at 20.0% in September. By function, research roles lead (32.7% of postings mention AI, up 11.7 points), followed by offense (23.3%), GRC (19.8%) and planning (18.9%).
Governance is the other winner. GRC grew from 9.4% of all postings in 2023 to 14.8% today, while defense (the engineers and analysts who run and monitor controls) slipped from 47.1% to 41.5%, though it is still the largest category. Within GRC, privacy and cybersecurity attorneys are the only one of the ten largest role categories with more postings this year than last.
Read the Numbers Carefully
Three more caveats before drawing conclusions:
- Postings are not hires. The data counts job ads, collected from JobSpikr with duplicates removed. It does not say how many people were hired.
- The report describes, it does not explain. It shows what changed, not why.
- No recovery yet. September was the only month of the nine to beat its 2025 total, by fewer than 400 postings.
CyberSN CEO Deidre Diamond links much of the leadership volatility to turnover in the C-suite: "Security roles need executive champions, decision-makers, and budget approval. When those relationships are disrupted, hiring is disrupted." She adds that "the demand for security leadership hasn't necessarily disappeared."
The New Executive: Head of AI Security
At the top of the org chart, the shift is even clearer. A study by IANS and Artico Search, published October 20, found:
| Company revenue | Has a head of AI security |
|---|---|
| $10bn and more | 65% (18% dedicated, 47% combined with another role) |
| $1bn to $10bn | 9% |
| Under $1bn | 6% |
Who actually owns AI governance is still unsettled. CISOs hold primary accountability in only 7% of large organizations, against 26% of small ones. In large firms, chief AI officers are the most common owners, at 22%. Between 14% and 19% of organizations say no single executive is accountable, and 43% to 48% have no board committee for AI ethics and none planned.
Steve Martano of IANS and Artico Search summed it up: "The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance." The pay data backs that up. In large companies, deputy CISOs average $350,000 a year and BISOs $342,000, and experience drives pay more than company size or location.
Why the Market Is Moving
Look at the news from this same month. Researchers used AI models to find PHP2Shell, critical PHP flaws that sent defenders around the world scrambling. AI agents are already acting on real websites, sometimes in ways nobody planned, as the OpenAI wiki incident showed.
The attack surface now has a new layer: models, agents, prompts, plugins and API keys. Companies need people who understand that layer. At the same time, AI is automating parts of the old checklist, which is exactly where postings are falling.
The Skills Did Not Die. The Wrapper Changed.
An AI agent is a new identity with permissions. A prompt injection is untrusted input. A leaked model API key is a leaked credential. Data poisoning is an integrity problem. Almost every AI security risk maps to a fundamental that security people already know. The professionals who win are the ones who carry those basics into AI systems.
A 90-Day Plan for Security Professionals
Days 1 to 30: Understand How AI Apps Work
Build or deploy one small LLM app that calls a model API, uses a tool and stores data. You cannot secure what you have never built. Learn where the API keys live, what the agent is allowed to call, and what gets logged.
Days 31 to 60: Learn the Threats
Study the OWASP Top 10 for LLM Applications and the MITRE ATLAS knowledge base. Then attack your own app: try prompt injection through a web page or a document, try to make the agent leak its system prompt, try to make it call a tool it should not.
Days 61 to 90: Secure It and Show It
Fix what you broke: least-privilege tool access, secrets in a vault, rate limits and spend caps, logging of every agent action. Write it up as a public lab on GitHub or a blog. In a market with about 2,400 AI security engineer postings, a documented project is a strong signal.
And Do Not Drop the Fundamentals
Networking, identity, logging and incident response still make up most of the job. Defense is still roughly four in ten postings. AI skills are a layer on top, not a replacement.
US cybersecurity job postings fell 26.4% to a four-year low, but the market is shifting, not dying. Classic roles like pen tester, risk analyst and insider threat analyst are posted far less often, while AI security engineers (+268%), cyber data scientists (+204%) and governance roles grow. Against 2024, the drop is only about 4%. The winning profile combines security fundamentals with a working knowledge of AI systems.
Frequently Asked Questions
My Take
I work in network security and follow the job market closely, so I read these numbers with real interest. My conclusion is not "the field is dying." It is "the field is moving, and fast."
What reassures me is how much of AI security is old security in a new place. Least privilege, segmentation, input validation, logging, incident response: all of it still applies. An agent connected to a company's tools is just another identity that needs rules, and a firewall engineer already knows how to think about rules.
What worries me is the gap between the 65% of large companies with an AI security leader and the 6% of small ones. Small businesses are adopting AI tools just as fast, with nobody in charge of securing them. That is where a lot of the next incidents will come from, and where a lot of the next jobs should be.
The job titles are changing. The core skills are not. So, are you seeing this shift in your own job search or on your team?
Sources:
- SecurityWeek: US Cybersecurity Job Postings Fall 26% as AI Security Engineer Demand Soars
- Help Net Security: The cyber talent shortage? Job postings just hit a four-year low
- ClearanceJobs: Cybersecurity Hiring Hits a Four-Year Low as AI Skills Gain Ground
- Infosecurity Magazine: Head of AI Security Roles Surge in Large Organizations
- CNN: Websites shut down globally after AI finds cybersecurity flaw
This article is published for information purposes only, to help readers understand trends in AI and cybersecurity.
Related Articles:
