CyberSN Cybersecurity Jobs Report Shows a 26% Drop as AI Security Hiring Surges

CyberSN recorded 235,786 US cybersecurity job postings through September 2026, a 26.4% annual drop, while AI security engineer demand rose 268.3%.

That contrast defines the latest CyberSN cybersecurity jobs report. Employers are advertising fewer security positions overall, yet they are rapidly expanding a small group of AI-focused roles.

The result is not a simple story about artificial intelligence eliminating cybersecurity work. It is a sharper shift in the work employers want security teams to perform.

Traditional security engineering, analysis, penetration testing, and leadership postings all declined from unusually high 2025 levels. Meanwhile, organizations sought specialists who can assess models, secure AI infrastructure, and manage new forms of automated risk.

The headline numbers also require context. The 2025 comparison period was exceptionally strong, and total postings were only about 4% below the same months of 2024.

Even so, the distribution of demand is changing. The market increasingly rewards professionals who can connect established security practice with AI engineering, governance, and data expertise.

That creates a difficult opponent for workers and employers alike: broad cybersecurity hiring versus concentrated demand for hybrid AI security skills.

The CyberSN Cybersecurity Jobs Report Reveals a Split Market

The central change is not the disappearance of cybersecurity demand, but its concentration around fewer and more specialized roles.

CyberSN counted 235,786 US cybersecurity postings from January through September 2026. That total was down from 320,210 during the same period in 2025.

The 26.4% decline produced the lowest January-to-September total in CyberSN’s four-year comparison. The corresponding totals were 273,498 in 2023 and 244,911 in 2024.

Those figures come from the organization’s cybersecurity jobs report. CyberSN aggregated US listings supplied by JobSpikr and excluded duplicate postings at the source.

CyberSN then mapped listings against a taxonomy containing 45 functional roles across ten categories. This method measures the work requested by employers, rather than relying entirely on inconsistent job titles.

That distinction matters because a “security engineer” title can describe several different jobs. One employer might need cloud access expertise, while another expects model evaluation and automated incident response.

CyberSN also stresses that its figures count postings, not employed people or completed hires. One company can advertise several openings, withdraw a listing, or leave a position unfilled.

The report therefore measures employer demand signals. It does not establish how many people lost jobs or whether every advertised position represented an approved hire.

The annual decline also looks less severe when compared with 2024. The 2026 total was roughly 3.7% below the 244,911 postings recorded during that year’s equivalent period.

Eight of the first nine months of 2026 remained below their 2025 counterparts. However, September reached 20% for the share of postings mentioning AI or machine learning terms.

For the entire nine-month period, 14.6% of tracked postings mentioned those terms. That was slightly below the 15.1% share recorded one year earlier.

The two patterns can coexist because the total market contracted while AI language gained momentum late in the period. A stable share can also conceal significant changes within specific roles.

CyberSN found 2,409 AI security engineer postings, a 268.3% increase from the comparable 2025 period. Cyber data scientist postings rose 203.5% to 1,493.

These roles remain small beside established categories. Security engineer postings totaled 44,083, while security analyst postings reached 24,095.

The growth rates are still meaningful because they show the direction of new investment. Employers appear to be defining specialist positions instead of merely adding AI tasks to every existing role.

SecurityWeek characterized the findings as a “mixed bag” because the report combines contraction with clear areas of expansion. Its labor-market analysis also cautioned against treating postings as definitive employment outcomes.

The tension begins there. Cybersecurity remains strategically important, but employers are becoming more selective about which capabilities justify additional headcount.

Falling Postings Do Not Mean Security Demand Has Vanished

The 26.4% decline measures a hiring reset from a strong year, not a 26.4% collapse in the underlying need for cybersecurity.

The clearest evidence comes from the historical comparison. CyberSN recorded 320,210 postings through September 2025, far above the totals for both 2023 and 2024.

Using that high point as the baseline makes the 2026 decline look especially dramatic. Comparing 2026 with 2024 produces a much smaller difference.

CyberSN does not claim to know why the market changed. Its report explicitly focuses on what employers advertised, rather than the budget decisions or organizational strategies behind those advertisements.

Several explanations can operate together. Companies can slow hiring, consolidate responsibilities, rely more heavily on contractors, or rewrite positions around emerging technical needs.

A decline in duplicate-free postings can also reflect longer employee retention or fewer replacement searches. It does not automatically prove that security teams are shrinking at the same rate.

Long-term government projections provide another useful reference point. The US Bureau of Labor Statistics expects information security analyst employment to grow 29% between 2024 and 2034.

The agency projects about 16,000 openings per year across that decade. Its occupational outlook attributes demand partly to cyberattacks, AI adoption, and expanding digital commerce.

BLS projections and CyberSN posting counts measure different things. BLS models long-term occupational employment, while CyberSN analyzes current advertisements across a broader security taxonomy.

Taken together, they describe a market with enduring security needs and unstable hiring patterns. Organizations still need protection, but that need does not guarantee smooth demand across every quarter or role.

The contraction was particularly visible in established positions. Security engineer postings fell 32.3%, and security analyst postings dropped 30.5% from the comparable 2025 period.

Penetration tester postings declined 45.9% to 3,063. Threat hunter postings fell 40% to 1,013, while cybersecurity project manager listings dropped 39.4% to 783.

Cyber insider threat analyst postings experienced the steepest listed decline. They fell 55.6% to 1,088 during the nine-month period.

Leadership hiring also weakened. CyberSN counted 2,832 postings carrying Information Security Officer titles, including Chief and Business Information Security Officer positions.

That was 38.9% below the 4,632 postings recorded through September 2025. However, it was close to the 2,808 postings seen during the same months of 2024.

Quarterly movement further complicates the annual comparison. CISO postings rose 19.5% from the second quarter to the third quarter of 2026.

Security architect postings gained 14% over that same quarterly interval. Application security engineer postings increased 9.9%, while security engineer listings rose 7.9%.

These rebounds do not erase the annual declines. They show why one percentage cannot describe the entire cybersecurity job market.

The report also found that 22.9% of postings were flagged as remote. Contracts represented 9.2% of listings with a recognized job type, up 1.4 percentage points.

Contract hiring can let companies test a capability before approving permanent positions. It can also shift risk from employers to workers without increasing stable headcount.

For job seekers, the practical message is sobering. Broad demand remains, but employers are setting narrower requirements and showing less urgency across many conventional career paths.

For companies, fewer postings can create a misleading sense of efficiency. Unfilled responsibilities still exist when teams merge roles or defer hiring.

AI Security Engineer Demand Is Growing From a Small Base

AI security engineer demand is rising quickly, but 2,409 postings cannot offset declines across a market of more than 235,000 listings.

The 268.3% increase is the report’s strongest reversal. It suggests that employers are moving beyond general calls for “AI knowledge” toward positions dedicated to securing AI systems.

An AI security engineer applies security controls to models, training data, inference systems, and applications that use artificial intelligence. The job can also include testing AI-enabled attacks.

These responsibilities differ from merely using an assistant to summarize alerts. They require understanding how AI systems behave, connect to data, and make decisions inside production environments.

The small starting point is essential context. A role can triple while remaining a modest part of the market.

AI security engineer postings represented about 1% of CyberSN’s total tracked postings. That makes the role strategically notable, but not yet a replacement market for displaced analysts or managers.

Cyber data scientist demand presents a similar pattern. Its 203.5% increase produced 1,493 postings, still far below the largest traditional categories.

The broader distribution offers stronger evidence of a skills transition. AI references appeared in 32.7% of research postings, an increase of 11.7 percentage points.

They appeared in 23.3% of offense postings and 19.8% of governance, risk, and compliance listings. Those shares rose 4.8 and 2.1 percentage points, respectively.

Research roles can involve studying new attack techniques or evaluating model behavior. Offense teams test systems before adversaries do, including through red teaming and adversarial exercises.

Governance, risk, and compliance teams translate technical exposure into policies, controls, and accountable decisions. AI expands that work because model behavior can be difficult to predict or audit.

Separate research from the Cisco-led AI Workforce Consortium reinforces the direction. It examined cybersecurity job demand across G7 economies using Indeed, Cornerstone, and Lightcast data.

The consortium found that the share of cybersecurity postings requiring AI skills averaged 28.5% from October 2025 through March 2026. That was twice the comparable year-earlier share.

Its AI security study identified five recurring capability areas: Python, context engineering, AI security, agent orchestration, and machine-learning operations.

Those categories explain why the transition creates friction. Few professionals began their careers with equal depth in security architecture, software engineering, data systems, and model behavior.

Employers can respond by hiring rare hybrid specialists. They can also retrain existing staff, combine several people’s expertise, or redesign jobs around multidisciplinary teams.

The consortium found a strong preference for senior-titled candidates. Senior cybersecurity postings grew much faster than junior-titled postings in its G7 comparison.

That creates an experience paradox. Employers want workers who already understand emerging systems, even though the systems are too new to support conventional experience requirements.

CyberSN’s own report identified only 9.5% of postings as entry level, based on JobSpikr’s inferred classification. The figure should be read cautiously because employers often describe senior expectations without using senior titles.

Still, the market signal is consistent. Companies want immediate operational competence, and they are reluctant to fund long learning curves.

That pressure affects established practitioners too. A penetration tester cannot simply rename existing work as AI red teaming without learning model-specific failure modes.

Likewise, an AI engineer does not automatically understand identity controls, threat modeling, incident response, or regulated risk. The growing positions sit at the intersection of two demanding disciplines.

Professionals can prepare by documenting applied work instead of collecting disconnected keywords. A practical portfolio might connect model evaluation, data access, logging, and incident response within one project.

Engineering teams also need searchable records of design choices, test results, and known limitations. A shared technical knowledge base can help preserve that evidence across security and AI teams.

The goal is not to chase every new tool. It is to show that established security judgment still works when models and autonomous agents enter the architecture.

Traditional Roles Are Absorbing AI Work Even When Titles Stay the Same

The larger workforce shift is happening inside familiar roles, where AI responsibilities are becoming part of ordinary security work.

CyberSN found that 14.6% of all tracked postings mentioned AI or machine learning terms. That share was nearly unchanged from the equivalent 2025 period.

At first glance, the stable figure appears inconsistent with surging specialist demand. The explanation lies in how responsibilities and titles overlap.

CyberSN treats AI security engineer as a role within the broader security engineer function. It displays that series for orientation without adding it separately to overall totals.

An employer might advertise a security engineer while expecting candidates to review model access, monitor agent activity, and protect retrieval pipelines. Another employer might use the explicit AI security title.

The title difference does not necessarily indicate a different capability. It can reflect organizational maturity, compensation structures, or the language a recruiter understands.

This makes broad cybersecurity hiring compete with specialization. Teams cannot assume that every traditional candidate possesses AI knowledge, yet they cannot staff each new risk with a separate specialist.

The pressure is especially acute in security operations centers. AI can summarize alerts, enrich investigations, propose queries, and automate repetitive response steps.

Automation can reduce routine work without reducing overall responsibility. Faster analysis often lets teams examine more events, integrate more data, and respond to a wider attack surface.

AI systems also create their own security work. Teams must control model access, inspect prompts and outputs, protect connected data, and monitor automated actions.

An agent with permission to search email or modify infrastructure presents a different risk from a chatbot with no external access. Its mistakes can cross system boundaries.

Security professionals therefore need to understand both adversarial misuse and accidental failure. They must evaluate what an AI system can access, retain, reveal, or change.

Cybersecurity hiring trends also show pressure on management. Director postings fell 32.5%, lead postings declined 41%, and manager postings dropped 24.4% year over year.

Those figures suggest that employers are not simply adding AI specialists above unchanged organizational layers. Some are reconsidering how many leadership positions and coordination roles they need.

Yet governance responsibilities are not disappearing. CyberSN found that governance, risk, and compliance increased its share of overall postings by 5.4 percentage points from 2023.

Cybersecurity and privacy attorney postings also increased 9.1% year over year to 24,193. That role became one of the report’s largest categories.

The shift makes sense as organizations face questions that automation alone cannot settle. Someone must decide acceptable risk, assign accountability, and document compliance.

Technical AI security work and governance therefore reinforce each other. Engineers identify system behavior, while legal and risk specialists determine which behavior the organization can accept.

The most pressured workers are those whose roles are treated as narrow collections of repeatable tasks. The strongest positions combine technical execution with judgment, communication, and ownership.

This does not mean every analyst must become a machine-learning engineer. It means analysts need enough AI literacy to investigate systems that use models and evaluate tools that claim to automate security.

Employers face a corresponding obligation. Adding a long list of AI requirements to existing postings does not create qualified candidates.

Teams need realistic role boundaries, training access, and supervised opportunities to develop experience. Otherwise, the hiring market rewards inflated résumés instead of dependable capability.

What the Numbers Cannot Prove About AI and Cybersecurity Hiring

The report shows correlation between market contraction and specialist growth, but it does not prove that AI caused the overall decline.

CyberSN describes its analysis as a “what” report, not a “why” report. That methodological limit should shape every conclusion drawn from its numbers.

The dataset does not reveal whether employers canceled positions because automation replaced tasks. It also does not measure internal transfers, promotions, retained staff, or unadvertised hiring.

A posting can disappear because a position was filled. It can also disappear because a budget was frozen or because an employer switched recruiting platforms.

The report uses listings from JobSpikr’s US job-board and Fortune 500 datasets. Its duplicate-removal and taxonomy methods improve consistency, but they cannot capture every hiring channel.

Recruiters increasingly use private networks, internal referrals, and direct sourcing for specialized positions. Those channels can matter greatly when candidates are scarce.

The role-level comparisons also depend on title queries and description filters. CyberSN notes that some series overlap broader queries, while certain generic titles require cyber-related terms for inclusion.

These choices are reasonable, yet they introduce classification uncertainty. Job descriptions frequently contain aspirational skills that employees rarely use after hiring.

AI terminology is especially vulnerable to this problem. Companies can add “generative AI” or “LLM” to a posting without defining a meaningful operational responsibility.

The annual comparison also begins with an exceptional baseline. The 2025 posting total exceeded both 2023 and 2024, so some of the 2026 decline represents normalization.

Leadership data demonstrates this effect. CISO postings fell sharply from 2025 but returned almost exactly to their 2024 level.

The September acceleration deserves similar caution. A 20% monthly share of postings mentioning AI is notable, but one month does not establish a durable trend.

CyberSN identified one-month spikes in several other categories and treated them separately from trends. AI-related momentum needs the same disciplined observation.

Other datasets can produce different results because they cover different regions, platforms, and definitions. Cisco’s G7 research found overall cybersecurity demand increasing during an earlier six-month window.

That does not invalidate CyberSN’s US decline. It demonstrates how geography, timing, and taxonomy can change the apparent direction of the market.

Worker surveys add another perspective. The ISC2 workforce study found that professionals using AI generally saw opportunities for new jobs and skill development.

Survey optimism does not prove that employers will preserve headcount. Posting declines do not prove that AI will eliminate the profession.

The most defensible interpretation sits between those claims. AI is changing the composition of demand faster than it is resolving the underlying need for security expertise.

That transition can still harm workers. A market can maintain long-term demand while creating shorter career ladders and fewer accessible entry points.

It can also strain organizations. Concentrating responsibilities among experienced hybrid specialists creates bottlenecks and makes succession planning harder.

Readers should therefore resist two easy narratives. Cybersecurity is neither collapsing because of AI nor protected from automation by permanent talent shortages.

The current evidence describes redistribution. The uncertainty concerns its scale, persistence, and effect on people entering the field.

Three Signals Will Show Whether the Shift Is Durable

The next three signals are specialist volume, broader AI requirements, and recovery across foundational security roles.

First, watch the absolute number of AI security engineer postings through the end of 2026 and into early 2027.

Another triple-digit growth rate would attract attention, but the base matters more. Growth from 2,409 postings into sustained five-figure demand would strengthen the specialization thesis.

A plateau would suggest that employers needed an initial layer of experts rather than an entirely new employment category. A decline would weaken claims of a lasting hiring realignment.

Second, track how frequently AI skills appear inside ordinary security engineering, governance, offense, and research positions.

The September share of 20% offers a useful benchmark. Continued growth across several months would show that AI expectations are spreading beyond specialist titles.

The details will matter more than generic mentions. Requirements involving model security, agent orchestration, evaluation, data controls, or AI incident response indicate operational adoption.

Vague references to “AI familiarity” provide weaker evidence. They can reflect recruiting fashion rather than actual changes in the work.

Third, compare specialist growth with hiring for security analysts, penetration testers, threat hunters, managers, and entry-level workers.

A recovery in those roles alongside sustained AI hiring would indicate expansion. Employers would be adding new capabilities without hollowing out the broader profession.

Continued declines would support a more difficult conclusion. Organizations would be concentrating budgets around senior specialists while reducing conventional pathways into cybersecurity.

Quarterly movement already offers a tentative positive signal. Security engineer, application security engineer, security architect, and CISO postings all improved from the second quarter.

That improvement needs to persist before it can outweigh the annual declines. Seasonal hiring patterns and isolated spikes can easily distort short windows.

Candidates should respond by building adjacent skills without abandoning core security practice. Threat modeling, access control, software security, incident response, and governance remain central.

AI knowledge becomes valuable when it extends those foundations. It becomes fragile when it consists only of tool familiarity or prompt-writing terminology.

Hiring managers should test applied judgment rather than assemble impossible requirement lists. They should distinguish skills needed on arrival from those employees can develop safely.

Executives should also ask whether lower posting totals reflect true productivity or deferred risk. An absent vacancy does not mean the underlying work disappeared.

The CyberSN cybersecurity jobs report ultimately captures a labor market in transition, not a settled outcome. Its sharpest lesson comes from the contrast between scale and direction.

Traditional roles still account for most openings, while AI security engineer demand identifies where employers expect new risk. Both facts matter.

Will specialist hiring expand the profession, or will it narrow cybersecurity into a smaller collection of senior hybrid roles? The next several reporting periods should provide the answer.