Latest Cybersecurity Hiring Spotlight Highlights Surge in AI and eBPF Roles

Current cybersecurity job market trends for September 2026 show a distinct shift in enterprise defense priorities toward agentic security automation, kernel-level runtime observability, and specialized threat intelligence roles. Recent job openings published across major technology, financial, and cloud organizations illustrate how security teams are restructuring talent acquisition to address modern infrastructure complexities. Employers such as Hewlett Packard Enterprise (HPE), Mastercard, Procore, and Firmus Technologies are actively recruiting for positions that merge traditional security operations with advanced AI integration and low-level platform engineering.

Emerging Demand for Agentic AI and Autonomous Security

A prominent theme in recent job listings is the operationalization of artificial intelligence within defensive and offensive security workflows. Organizations are moving past basic assistant tooling toward multi-agent frameworks capable of executing autonomous security orchestration and incident handling. For example, Procore is seeking a Principal Security Engineer to lead strategy around AI-driven autonomous security, specifically leveraging frameworks like LangGraph, Semantic Kernel, and CrewAI to build self-healing infrastructure, agentic identity governance, and automated threat modeling.

Similarly, offensive security roles are increasingly requiring experience with AI orchestration. Penetration testing roles now emphasize integrating attack paths with AI-driven testing systems, where human security professionals collaborate directly with autonomous AI agents to expand attack coverage, research defense evasion techniques, and reduce false positive findings. In research and innovation functions, organizations expect principal specialists to turn emerging threat research into functional prototypes using AI development frameworks, bridging the gap between offensive vulnerability discovery and automated defense engineering.

Cloud Infrastructure and eBPF Runtime Security

As containerized workloads and GPU-heavy AI clusters become core infrastructure components, platform security requirements are deepening at the kernel level. Openings such as the Senior Platform Security Engineer role at Firmus Technologies highlight a growing reliance on extended Berkeley Packet Filter (eBPF) technology for runtime monitoring and enforcement across large-scale Kubernetes and GPU environments.

eBPF has become essential for high-throughput cloud environments because it provides granular observability into syscalls, process executions, and network socket activity directly within the Linux kernel without requiring invasive kernel modules or heavy agent overhead. Employers are seeking engineers proficient in eBPF-based security tooling to enforce workload identity, execute admission and network policies, manage policy-as-code, validate multi-tenant isolation, and maintain compliance frameworks such as ISO 27001 and NIST.

In parallel, cloud security roles emphasize cloud-native response automation using infrastructure-as-code (IaC) tools like Terraform, container orchestration with EKS, and Python script automation to coordinate incident response across AWS, identity providers, SIEM, and SOAR platforms.

Executive Leadership and Specialized Threat Operations

Alongside technical engineering roles, major enterprises are bolstering their defense leadership and specialized operational teams:

• Executive Defense Strategy: Hewlett Packard Enterprise (HPE) is recruiting a VP, Head of Global Cyber Defense, based on-site in the USA, to steer global operations across incident response, threat hunting, insider threat detection, detection engineering, and AI-enabled security defense.
• Product Management & IP Intelligence: Mastercard is expanding its commercial threat capabilities with a Product Manager for Threat Protection & IP Intelligence, focusing on commercializing threat intelligence and IP capabilities to match changing adversary behaviors.
• Core Operations & Engineering: Open roles span the entire operational spectrum, including Threat Intelligence Analysts mapping behavior to MITRE ATT&CK, Application Security Specialists operating across SAST, DAST, IAST, and SCA pipelines, Malware Reverse Engineers performing dynamic analysis on Windows and Linux binaries, and dedicated Threat Hunters proactively hunting across telemetry sources.

What This Means for Security Professionals

The latest hiring data underlines a clear evolution in required skill sets for security professionals. Purely reactive analyst roles are increasingly giving way to hybrid roles that combine threat hunting, detection engineering, and programmatic automation. Candidates looking to stay competitive should focus on three key domains:

1. Automation & AI Frameworks: Practical familiarity with agentic AI orchestration (e.g., LangGraph, CrewAI) and API-driven SOC automation pipelines.
2. Kernel & Cloud Observability: Hands-on experience with eBPF, Kubernetes admission controllers, policy-as-code, and runtime security tools for containerized environments.
3. Integrated Intelligence: The ability to map raw threat telemetry directly to actionable MITRE ATT&CK matrices and automated detection rules across SIEM, EDR, and SOAR ecosystems.