CyberSN’s latest Cybersecurity Jobs Report was covered by SecurityWeek on October 18. The data was pulled October 7 and covers January to September 2026: US postings from JobSpikr, deduplicated, sorted into CyberSN’s 45 role types.
The headline. US employers put up 235,786 cybersecurity postings in nine months, 26.4% below the 320,210 of the same stretch in 2025. It is the lowest January-to-September total in four years.
The number to hold beside it: AI Security Engineer postings rose 268.3% and Cyber Data Scientist postings 203.5%, per SecurityWeek’s rundown. Neither comes with a base.
The total fell; the AI share did not
The easy story is that AI took over the work and the postings went with it. The report does not back that. Across January to September, 14.6% of postings mention AI or machine-learning terms, against 15.1% a year earlier. September alone hit 20.0%, the highest month since January 2025.
The mix is lopsided. Defense work holds 41.5% of postings, GRC 14.8% and Product Security 12.8%, and of postings with a known employer size through August, 47.3% came from companies with more than 1,000 staff.
So for most of the nine months, AI was no more visible in the ads than the year before. It surfaced late. The report is also explicit about its own limits: it describes what, not why. What we can read is narrower: the fall in volume and the share of ads naming AI are not the same curve.
A second yardstick changes the size of the drop. The 2025 figure was a high. Against 2024’s 244,911, 2026 is down 3.7%; against 2023’s 273,498, down 13.8%. Those are our divisions of the report’s raw counts. A good part of the 26.4% is a return from a 2025 peak. The report’s full-year projection runs from 288,911 to 325,540, a wide band.
Which roles are shrinking
SecurityWeek’s list of the steepest decliners is all in the thousands: Cyber Risk Analyst at 4,031 postings, down 51.5%; Cybersecurity Lead at 4,688, down 41.0%; Penetration Tester at 3,063, down 45.9%; Threat Hunter at 1,013, down 40.0%; Insider Threat Analyst at 1,088, down 55.6%.
The report’s own page frames role momentum differently, comparing Q3 with Q2: Cybersecurity Director down 38.9%, Penetration Tester down 26.6%, Security Analyst down 11.3%, CISO up 19.5%. The comparison periods differ, so we cite the two sets separately and do not blend them.
Where AI shows up most by function: Research at 32.7% of postings, up 11.7 points; Offense at 23.3%; GRC at 19.8%. Penetration testing belongs to Offense. That link is ours, not the report’s: the function with the second-highest AI mention rate is also where a core job title is losing postings. It could be connected, or not.
Against what we have already covered
Two days ago we reported that Anthropic’s own new-hire mix for junior technical roles fell from 27% to 9%. The day before that, 75% of US CEOs in KPMG’s survey said AI had them rethinking what entry-level roles require. The CyberSN data differs in what it counts: public ads across a whole sector, not one company’s payroll or a CEO questionnaire.
A security-sector precedent sits in August. Pentera cut about 20% in four months and kept hiring AI engineers. Shed one group, hire another: the same shape as a falling total with rising AI-titled roles.
What it means for jobs
The postings pointing down are in analysis and testing: risk analysis, penetration testing, threat hunting, insider-threat work. The ones rising carry AI in the title. We have no base counts for those two, so they cannot be read as a number of new seats.
For people in the field, the usable signal is the 20.0% of September ads that mention AI. If that holds near 20% through Q4, AI fluency has moved from a plus toward a baseline requirement. If it falls back to 15%, September was a one-month spike.
On timing, the next test is the last quarter. The report projects 288,911 to 325,540 postings for the year. Reaching the low end means about 53,000 more in Q4, our subtraction of 235,786 from 288,911. A Q4 well short of that puts the year below the report’s own band.
The limits matter. This counts public US online postings: no internal moves, no recruiter-only roles, and the report itself calls job titles noisy. It shows fewer ads went out. It does not show how many people lost work.
