US Cybersecurity Hiring Hits Four-Year Low, But AI Security Roles Are Bucking the Trend Hard
The US cybersecurity job market is quietly having a rough year. According to CyberSN's latest Cybersecurity Jobs Report, postings between January and September 2026 dropped to 235,786, down 26.4% on the same period in 2025. That's the lowest figure in four years, and it's not a rounding error.
The report pulls data from JobSpikr, strips out duplicates, and maps every listing to one of 45 functional roles across ten categories. The idea is to cut through the noise of whatever creative job title a recruiter decided to invent that week and actually measure what skills employers are asking for.
Amid the general carnage, two roles are having a genuinely good year. AI Security Engineer postings are up 268.3% year-on-year. Cyber Data Scientist demand has grown 203.5%. Those are not typos. The market is clearly reconfiguring itself around AI, even as overall hiring shrinks.
The AI thread runs deeper than just specialist roles. Around 15% of all cybersecurity postings now reference some need for AI understanding, roughly level with last year's 15.1%. But there's a notable acceleration happening right now, with September 2026 hitting 20.0%. Research roles are most likely to mention AI, with 32.7% of postings referencing it, up nearly 12 percentage points from last year. Offense roles come in at 23.3%, GRC at 19.8%.
Remote work availability varies considerably by function. Sales leads the pack at 32.8% of postings offering remote options, followed by GRC at 31.2% and Offense at 24.7%. Defense roles sit at 21.3%, which will either reassure or disappoint people depending on their commute situation.
The roles that have taken the biggest hits make for uncomfortable reading. Cyber Insider Threat Analyst is down 55.6%. Cyber Risk Analyst has fallen 51.5%. Penetration Tester postings dropped 45.9%, which will surprise no one who's watched AI-assisted testing tools proliferate over the past couple of years. Threat Hunter is down 40%, and CISO postings fell 38.9%.
The CISO decline comes with a caveat worth noting. The 2026 figure of 2,832 postings is almost identical to 2024's 2,808, suggesting that 2025 was the anomaly rather than 2026 being a collapse. CISO postings also rose 19.5% between Q2 and Q3, so anyone panicking about the death of the security leadership role might want to hold off.
The report is honest about its own limits. It tracks what is being advertised, not why hiring patterns are shifting. As it puts it, job titles are noisy, and the whole point of the taxonomy approach is to measure actual work being requested rather than whatever label a company has slapped on the listing.
The practical takeaway is fairly straightforward. If you're an AI security specialist, the market is actively looking for you. If you're a penetration tester, a risk analyst, or eyeing a CISO role, the numbers suggest patience is currently more useful than optimism.