Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
,
Recruitment & Reskilling Strategy
But There’s No Consensus Way to Assess Levels of Skill
A growing number of cybersecurity jobs require not just a baseline familiarity with AI tools, but significant AI expertise, according to an analysis of validated job vacancies in the field.
See Also: OnDemand | Shorter Certificates, Higher Risk: What Security Teams Must Do Now
“We’re mapping this stuff in real time and using real data,” said Rob T. Lee, chief AI officer and chief of research at the Sans Institute, a training and certification organization. Lee said he gathered data through application programming interfaces on job sites using an artificial intelligence agent, not through web-scraping, which means job postings could be validated individually. The data comprises a two-day job market snapshot of 6,193 active postings taken from Sept. 15 to Sept. 17.
The methodology produces reliable, accurate data, which can be analyzed to show trends over time, Lee told ISMG. “It won’t tell you the total number of AI cybersecurity jobs that are out there … but it is a good sample to be able to do trend analysis” because it is basically looking at the same data set over and over again, as it changes over time.
Sans found employers are already hiring four types of AI-heavy positions: AI/ML Security Engineer, AI Security Architect, AI Governance and Security Risk Lead and AI Red Team Engineer.
“These roles are probably going to be needed by every organization that’s out there. I just can’t see anyone who’s pulling an AI into their organization feeling comfortable that cybersecurity engineering is not a key part of that,” Lee explained.
Lee also identified four roles the report lists as “building,” with fewer postings and hiring typically being done under non-AI related titles, but a growing proportion of the role focused on AI issues. These are: Agentic AI Security Engineer, AI Security Operations Center Orchestrator, AI Incident Response Orchestrator and AI Threat Intelligence Analyst.
An orchestrator is a coder who manages and directs a fleet or swarm of AI agents. Agents are AI programs that don’t just chat with users but can interact with company applications and perform functions. These jobs would become more common next year, as SOCs and cyber defense teams figured out how to use AI agents in their workflows, Lee said.
The tally of 1,654 AI-focused vacancies comes not from looking at the job title alone, but analyzing the content of the posting and the skills required, said Lee.
The hiring companies included some of the nation’s largest corporations including JP Morgan Chase, Leidos, Amazon, Mastercard and PepsiCo. “This isn’t cybersecurity firms doing these hires. You’ve got the energy sector, healthcare, oil and gas,” Lee said.
“This year I actually think that AI is going to have new roles on the cybersecurity side of these organizations,” Lee said. “Just like with ICS and OT, you need specific expertise in this field,” he said, referring to industrial control systems and operational technology.”
Sans has posted the data online and pledged to update it regularly.
Kee said the data collected so far undermines the narrative that AI will replace humans in cybersecurity. Instead, he argued, it will augment them.
“The analogy I like to use is, you could swim through a pool, but if you put flippers on, you’re going to be able to swim it faster. That’s what AI is going to enable you to do, but you’re still hiring a swimmer.”
And, despite the growing number of AI-specialist jobs, the predicted drop off in entry level openings as those positions were replaced by AI hasn’t materialized either, Lee added.
“We’re not seeing a downward curve on the entry-level jobs in cybersecurity either. Those are remaining flat,” he said.
Other data out this week told a slightly different story. CyberSN’s jobs report is aggregated from web scrapers, between January and September, with the various job titles analyzed and assigned to CyberSN’s taxonomy of 45 cybersecurity functional roles in ten categories. Like the Sans data, CyberSN assesses the skills required for a role, rather than simply relying on its title.
Overall, CyberSN said there had been a decline in cybersecurity job postings to a four-year low: Just 235,786 postings between January and September 2026, down 26% from the 320,210 postings in the same nine months of last year.
By contrast, the number of job postings for AI Security Engineers had nearly tripled, increasing by 268% since last year. Demand for Cyber Data Scientists has more than doubled, with the number of job postings up 203% over last year.
CyberSN doesn’t track salaries, and Lee said there were too many other variables affecting pay (location for in-office roles, for instance) to tell whether there was a premium on AI-focussed roles, or how much it might be.
But competition was stiff, according to the Sans report, with many of the positions having pay ranges that started at $120,000 or more and being at the harder to fill senior/expert level.
And there’s the rub, said JC Vega, a cybersecurity strategist and retired U.S. Army colonel, because there’s no consensus in the cybersecurity community about what constitutes expertise in AI.
“I put a call out to my community,” said Vega, who administers a private Signal channel for cyber professionals, “How could I establish my expertise in AI?”
The range of responses made it clear that there were many different ideas about expertise, said Vega, “Some said you need a data science degree… Some said you needed to be able to build your own model.”
While AI frameworks and competency standards are emerging, thanks to NIST, Vega said, “what are the knowledge, skills, and practical experience required to secure AI systems and defend against AI-enabled threats? The training organizations [like ISACA and GIAC Sans] have their certs, but that is just the beginning.”
There is a baseline expertise with generative AI that is now required and assumed for cyber professionals, Vega said, recalling the moment that “fluency with Microsoft office tools” ceased to be a resume bullet point because it was simply assumed into a baseline tech literacy.
“AI literacy is quickly becoming a baseline expectation for cybersecurity professionals. But knowing how to use these tools doesn’t necessarily make you an AI expert. … We as an industry have to come up with standards,” he said.