US Cyber Job Openings Drop 26% as Demand for AI Security Engineers Surges

The U.S. cybersecurity job market is undergoing a significant structural shift as enterprise hiring priorities pivot sharply toward artificial intelligence and automation. According to new data from CyberSN’s Cybersecurity Jobs Report, overall cybersecurity job listings fell to a four-year low between January and September 2026, dropping 26.4% year-over-year to 235,786 postings compared to 320,210 during the same period in 2025.

However, this macroeconomic cooling masks intense competition for specialized skills. While generalized and tactical roles face severe contractions, demand for professionals capable of securing AI models, engineering machine learning guardrails, and analyzing complex data pipelines has surged into triple digits. The findings, derived from aggregated job posting data via JobSpikr and mapped against CyberSN’s 45-role functional taxonomy across ten categories, highlight how organizations are attempting to do more with leaner, highly specialized engineering teams.

AI Security Roles Experience Explosive Growth

As enterprises scramble to deploy Large Language Models (LLMs), AI agents, and autonomous workflows, securing these emerging technologies has become an immediate priority. This urgency is reflected directly in recruitment numbers:

• AI Security Engineer postings grew by 268.3% year-over-year.
• Cyber Data Scientist roles saw a 203.5% increase over the same period.

Overall, just under 15% of all cybersecurity job postings now explicitly mandate an understanding of artificial intelligence, with momentum accelerating throughout the year to hit a peak of 20.0% of all open listings in September 2026.

The integration of AI skill requirements spans multiple core security disciplines. Postings in Research led the trend, with 32.7% of listings referencing AI needs (a 11.7 percentage point increase over last year). Offense followed at 23.3% (up 4.8 points), while Governance, Risk, and Compliance (GRC) reached 19.8% (up 2.1 points) and strategic Plan functions reached 18.9% (up 0.6 points).

This demand reflects a fundamental expansion of the enterprise attack surface. Organizations are realizing that traditional network and endpoint security controls do not protect against prompt injection, model inversion, training data poisoning, or rogue AI agent behaviors in operational environments.

Sharp Declines in Traditional and Tactical Functions

The overall contraction in job listings has hit operational, risk management, and entry-to-mid-level testing positions hardest. The steepest year-over-year drops in job postings include:

• Cyber Insider Threat Analyst: Down 55.6% (1,088 postings)
• Cyber Risk Analyst: Down 51.5% (4,031 postings)
• Penetration Tester: Down 45.9% (3,063 postings)
• Cybersecurity Lead: Down 41.0% (4,688 postings)
• Threat Hunter: Down 40.0% (1,013 postings)
• Cybersecurity Project Manager: Down 39.4% (783 postings)
• CISO (including CSO, BSO, and ISO): Down 38.9% (2,832 postings)

The decline in operational roles like threat hunters, insider threat analysts, and pen testers correlates with the rapid adoption of automated security platforms, AI-driven Security Operations Center (SOC) triage, and automated penetration testing frameworks. Enterprise security leaders are increasingly relying on vendor orchestration tooling to handle telemetry analysis and routine vulnerability validation, reducing the raw headcount required for manual tier-1 and tier-2 tasks.

The drop in executive leadership titles (CISO/CSO/ISO) requires context. The 2,832 CISO-level postings recorded in 2026 represent a normalization following an unusually aggressive hiring surge in 2025; the current baseline is virtually identical to 2024’s total of 2,808 postings. Furthermore, CISO hiring demonstrated resilience late in the year, rising 19.5% from Q2 to Q3 2026 as corporate boards recalibrated their oversight structures.

Remote Work Distribution and Tactical Takeaways

Remote work flexibility remains widely available, though distribution varies significantly depending on the functional function:

• Sales: 32.8% remote
• GRC: 31.2% remote
• Offense: 24.7% remote
• Product Security: 22.9% remote
• Educate: 22.8% remote
• Research: 21.9% remote
• Defense: 21.3% remote

Roles that rely heavily on cloud architecture, governance frameworks, and code evaluation continue to support remote options, whereas hands-on infrastructure defense and incident response roles show higher rates of hybrid or on-site requirements.

For security professionals and team leads, the data signals a clear transition point. Purely administrative risk assessments and manual vulnerability scanning roles are facing headwind pressures from market consolidation and automation. Practitioners looking to future-proof their careers should focus on software engineering fundamentals, data science, and AI safety controls—learning to build and audit secure systems rather than manually monitoring static alert queues.