The strange thing about a cooling job market is that it can still contain a hiring boom. That is the uncomfortable lesson in CyberSN’s latest cybersecurity jobs data: fewer U.S. postings overall, but a sharp climb for AI security specialists. For learners, the point is not to chase a shiny title. It is to notice where security work is being reshaped by AI systems, data pipelines, and model risk.

What CyberSN counted, and what it did not

SecurityWeek reports that CyberSN’s jobs report uses data aggregated from JobSpikr with duplicates removed, then maps postings to CyberSN’s taxonomy of 45 cybersecurity functional roles across ten categories. That matters because job titles are messy. An “AI Engineer” in one company may mean model integration, in another it may mean security testing of AI systems, and in a third it may mean writing Python scripts around a vendor API.

According to SecurityWeek, U.S. cybersecurity postings fell to 235,786 between January and September 2026, down 26.4% from 320,210 in the same period of 2025. Infosecurity Magazine says CyberSN published the report on October 16, and that the 2026 count was the lowest in the four years CyberSN has run the analysis. Infosecurity’s four-year sequence shows 273,498 postings in 2023, 244,911 in 2024, 320,210 in 2025, and 235,786 in 2026 for the same January to September window.

@title CyberSN posting counts
@source Infosecurity Magazine

  2023 ····· 273498
  2024 ····· 244911
  2025 ····· 320210
  2026 ····· 235786

@caption CyberSN counted fewer January to September postings in 2026 than in the prior three years.

The report is useful, but it is not a complete diagnosis. SecurityWeek describes it as a count of job listings rather than a study of employer intent, calling it a “what not why report.” Infosecurity Magazine also notes that CyberSN researchers said it is not clear whether the decline reflects weaker employer demand or a retreat from an unusually strong 2025.

The split market is the career signal

SecurityWeek reports that AI Security Engineer demand increased 268.3% year over year, while Cyber Data Scientist demand rose 203.5%. That is the headline learners will notice, and fair enough. But it does not mean every cybersecurity role is quietly becoming an AI role, because SecurityWeek also reports that just under 15% of postings referenced AI, close to 15.1% in the same period last year.

The contraction was broad. Infosecurity Magazine says nine of CyberSN’s 10 tracked cybersecurity functions had fewer postings in 2026 than in 2025, with research roles the only exception, up 26.1%. SecurityWeek’s role examples show the pressure in familiar areas: Cyber Insider Threat Analyst fell 55.6% to 1,088 postings, Cyber Risk Analyst fell 51.5% to 4,031, and Penetration Tester fell 45.9% to 3,063.

This is where title sprawl becomes dangerous. If you see “AI Security Engineer,” do not assume it is just penetration testing with a chatbot added to the toolkit. The better read is that employers are trying to secure AI systems, evaluate data exposure, understand model behavior, and connect security controls to fast-changing software workflows.

What hiring managers are likely to screen for

CyberSN says on its own site that its workforce work is built around matching capabilities to business needs, using cyber and IT job taxonomies. That framing is a useful antidote to credential inflation. A certificate can help if it gives you evidence of capability, but the hiring conversation still comes back to whether you can do the work a team is missing.

For AI security roles, that evidence should look more like workflows than slogans. A stronger portfolio might show how you evaluate an AI feature for data leakage, document abuse cases, test access controls around model outputs, or explain where a security control fits in an application lifecycle. A weaker portfolio says “AI security” loudly but never shows what was built, tested, measured, or fixed.

The Bureau of Labor Statistics still gives the broader field a positive long view. It projects employment of information security analysts to grow 21% from 2025 to 2035, and says information security analysts plan and carry out security measures to protect computer networks and systems. That does not cancel out CyberSN’s near-term posting decline, but it does separate a cyclical listings slump from a claim that security work is disappearing.

How to adjust your upskilling plan

The Bureau of Labor Statistics reports a 2025 median annual wage of $129,180 for information security analysts and about 14,100 projected openings each year on average over the decade. Those numbers are attractive, but they should not be used as marketing wallpaper for a course that teaches buzzwords. If you are paying for training, ask what artifact you will have at the end: a lab report, a secure design review, a detection pipeline, or a tested control around an AI-enabled product.

If you are 25, you may have more room to take a longer technical detour into data engineering, cloud security, or applied machine learning. If you are 45, you may need a tighter bridge from what you already know, such as governance, incident response, infrastructure, audit, or software delivery. The hype treats both learners the same, but the constraints are different.

The practical move is to read AI security postings like a checklist of work, not a personality test. Track whether employers ask for model evaluation, data classification, application security, cloud controls, detection engineering, or policy translation. If CyberSN’s next report shows the same pattern, the winners will not be people who collected the newest title first. They will be the ones who can show how AI changes the security workflow, and where their skills reduce the risk.

Sources