AI and the Cybersecurity Job Market: What Is Actually Changing

The question I get most from students is whether AI is going to eliminate security jobs before they finish their degree. The short answer is no, but the composition of the work is shifting, and which parts you invest in matters more than it used to.

What is genuinely being automated

Tier-one alert triage is the clearest case. Sorting a queue, correlating events, dismissing obvious false positives — this is pattern matching at volume and it is being automated quickly. It was also the traditional entry point into security operations, which creates a real problem for how people enter the field.

Initial vulnerability assessment and first-pass code review are moving the same way. Not the judgement about which findings matter, but the enumeration.

Routine reporting and evidence collection for compliance are being automated because the format is fixed and the inputs are structured.

What is not

Incident response under uncertainty. A real incident involves incomplete information, time pressure, and consequential decisions about business operations. Someone has to decide whether to take a production system offline, and that decision is not primarily technical.

Threat modelling for systems that do not exist yet. Reasoning about how a design could be attacked requires understanding intent and business context, and the design is not in any training set.

Anything requiring accountability. Someone must sign the risk acceptance, tell the board what happened, and answer to a regulator. That role cannot be delegated to a system.

Adversarial thinking. Finding the assumption everyone made without noticing remains stubbornly human, because it depends on knowing what people habitually overlook.

The new work AI created

It cuts the other way too. Securing AI systems is a genuine speciality that barely existed three years ago: prompt injection, agent permission design, model supply chain, data governance for training and inference.

The demand here is real and the supply of people who understand both security fundamentals and how these systems actually behave is thin. For someone entering now, this is where the gap is widest.

What this means if you are starting out

The entry-level squeeze is the honest concern. If tier-one work is automated, the traditional ladder loses its bottom rung, and “get an entry-level SOC role and learn” is weaker advice than it was.

Three things that seem to help:

Go deep on fundamentals rather than tools. Networking, operating systems, cryptography, how software actually fails. Tool knowledge depreciates; the fundamentals are what let you reason about a situation nobody has documented.

Build something demonstrable. A tool, a piece of research, a well-documented home lab, a CVE. Evidence of capability matters more when the traditional credential path is disrupted.

Learn the AI layer deliberately. Not prompt tips — how these systems fail, what their security properties are, how to reason about an agent’s blast radius. This is the part where being early is worth the most.

The realistic framing

Security has absorbed automation repeatedly — firewalls, SIEM, vulnerability scanners, orchestration platforms — and headcount grew each time, because each wave expanded the attack surface it was managing. AI is doing both again: automating parts of the work and creating a substantial new category of systems to secure.

The people who struggle are those whose value was executing a repeatable procedure. The people who do well are those who can reason about a system nobody has seen before. That was already true. It is just less forgiving now.