Mr.PlanB Logo

    Newsletter

    Subscribe our newsletter

    Get new infrastructure guides, comparison reports, and migration notes in your inbox.

    Infrastructure notes, guides, and new tools. Unsubscribe anytime.

    Back to Blog
    cybersecurity
    SOC
    security jobs
    entry-level
    AI
    NIS2
    Poland
    AI-era IT jobs

    Cybersecurity jobs split in two: senior engineers scarce, junior analysts gone

    November 6, 2026
    8 min read

    Part of a 14-post series on IT jobs in the AI era. Start with the overview: IT job market 2022 to 2026: openings fell, jobs held.

    Between May 2022 and May 2025 the US added almost 27,000 information security analysts, a rise of 16.5 % to 190,650 [BLS OEWS, 2025]. Over roughly the same years, the share of UK core cyber job ads open to someone with less than a year of experience fell from 25 % to 17 % [DSIT, 2025]. Neither the "four million unfilled cyber jobs" headline [ISC2, 2023] nor the "AI is eating the SOC" headline explains both numbers. The profession is growing while the bottom rung of its ladder disappears, and the people trying to get on it notice first.

    More security jobs, fewer ways in

    US employment in the occupation rose every year from 2021 to 2025, and the Bureau of Labor Statistics projects another 21 % over the next ten years [BLS Occupational Outlook Handbook, 2026]. The median wage went from $112,000 to $129,180. That is 4.8 % above inflation, which makes security one of the few IT occupations where real pay rose [BLS OEWS, 2025].

    The way in narrowed in every dataset I could find. The UK series went 25 %, 22 %, 17 % for 2022, 2023 and 2024 [DSIT, 2025]. ISACA's annual survey found that 21 % of security teams had entry-level openings in 2023 and 18 % in 2024. In Europe the figures were 22 % and 19 % [ISACA, 2024]. Across the G7, senior-titled cyber postings grew 65 % in the six months to March 2026 and junior-titled ones grew 5.9 %. Junior titles were 0.7 % of all cyber postings [AI Workforce Consortium, 2026]. Practitioners feel it: in a May 2026 ISC2 survey of security staff who use AI, 56 % said AI has already reduced the need for entry-level roles [ISC2, 2026].

    US information security employment 2021 to 2025 and the UK share of cyber postings open to beginners, 2022 to 2024 Left: US employment, SOC 15-1212, May of each year. Right: UK core cyber postings open to under one year's experience. Sources: BLS OEWS; UK DSIT, Cyber security skills in the UK labour market 2025.

    The UK share started falling in 2023, before any SOC copilot was on sale, so budgets closed the junior door first. ISC2's 2024 study found growth in the security workforce had stalled at 0.1 %, and for the first time "lack of budget" beat "lack of talent" as the main reason for shortages [ISC2, 2024]. The 2025 study published no workforce-gap figure at all [ISC2, 2025]. The AI tools arrived after the freeze and gave employers a reason to keep it shut.

    The tier-1 queue moved to software and to the MDR provider

    A junior analyst used to spend two years on the alert queue, closing false positives on shift work and slowly learning what a real attack looks like. Automation now works that queue. In ISACA's 2026 survey only 13 % of security teams said they do not use AI in operations. Automating detection and response was the top use (41 %, up from 32 % a year earlier), followed by routine security tasks (40 %, up from 28 %) [ISACA, 2026].

    The best controlled measurement comes from a vendor, so read it with that in mind. Microsoft researchers ran a randomised trial with 167 professional security analysts on phishing triage. Analysts working with the agent found up to 6.5 times as many true positives per minute, and their verdicts were 77 % more accurate. The authors estimate that 83 % of the gain came from the agent putting the queue in the right order and 17 % from its verdicts and explanations [Microsoft, arXiv 2511.13860, 2025]. Deciding which alert to open first is the first thing a tier-1 analyst learns, and the agent now does it. An earlier Microsoft trial found experienced analysts 22 % faster and 7 % more accurate with Security Copilot [Microsoft, 2024]. Vendor marketing goes further: Google says its triage agent cuts a 30-minute alert review to 60 seconds, but publishes no false-positive rates [TechInformed, 2026].

    Diagram: the 2022 in-house SOC ladder compared with the 2026 SOC where vendor agents triage alerts Schematic of where the tier-1 seat went. Sources: ISACA 2024; ISC2 2026; Microsoft phishing-triage RCT (arXiv 2511.13860); D3 Security SOC Rebuild Index 2026 (vendor).

    The entry-level seat moved to a different employer. In one vendor's reading of 665 US SOC postings, only 5.9 % were entry-level. The entry-level triage seats it found were at MSSPs, MDR providers, staffing firms and state government, paying $60,000 to 83,000 [D3 Security, 2026]. CrowdStrike cut 500 jobs in May 2025, and its CEO wrote that "AI flattens our hiring curve" [CSO Online, 2025]. Enterprises also stopped growing their own juniors: the share training non-security staff for security roles fell from 41 % to 29 % in one year [ISACA, 2025]. Meanwhile 63 % of AI-using security staff spend more time than before checking what the machine decided [ISC2, 2026], so for the analysts who stay, auditing the queue takes a bigger share of the day.

    What the 2026 security job ad asks for

    On company job pages, the share of security postings that name AI in the requirements section rose from 6 % in 2022-23 to 53 % in 2026 [ai-era-it-jobs study, 2026]. Across the G7, 28.5 % of cyber postings required AI skills between October 2025 and March 2026, up from 14.2 % a year earlier [AI Workforce Consortium, 2026].

    The non-AI vocabulary changed even more. We compared 148 security job pages from October 2022 to March 2023 with 914 from May to October 2026, with AI terms blanked out first. "Passion" fell from 43.9 % to 21.3 %, JavaScript from 13.5 % to 4.4 %, IDS/IPS from 12.8 % to 4.6 %. Automation rose from 36.5 % to 54.0 %, scalability from 18.9 % to 37.6 %, "ownership" from 16.9 % to 33.2 % and threat modelling from 11.5 % to 21.1 % [ai-era-it-jobs study, 2026]. Part of that is mix: senior-titled roles went from 34 % to 50 % of the security pages. Pages asking for eight or more years of experience more than doubled, from 6.8 % to 14.7 % [ai-era-it-jobs study, 2026].

    Dumbbell chart of security job-ad terms that fell and rose between 2022-23 and 2026 Share of security job pages mentioning each term, 2022-23 vs 2026 (length-adjusted), terms that moved 7 points or more. Source: ai-era-it-jobs study.

    Postings and pay split the same way. US cyber postings fell 26.4 % in January to September 2026, while postings for "AI security engineer" rose 268 % [CyberSN via ClearanceJobs, 2026]. In UK adverts the median for a cyber security analyst fell from £60,000 to £50,000 between 2024 and 2026, while the engineer median rose from £55,000 to £70,000 [IT Jobs Watch, 2026].

    Europe: regulation hires, and Poland arrives late

    In Europe the strongest new hiring driver is regulation. NIS2 had to be written into national law by October 2024, and DORA has applied to financial firms since January 2025. None of the 21 Europe-located security job pages in our 2022-23 sample named NIS2, DORA, the AI Act or ISO 42001. In 2026, 14.2 % of 120 did, against 5.0 % outside Europe [the ai-era-it-jobs report, 2026]. The samples are small, but the direction matches what recruiters report from Germany, where DORA drove most recent security hiring in banks [Barclay Simpson, 2026].

    Poland got there late. Its NIS2 law came into force on 3 April 2026, about 18 months after the EU deadline, and entity registration opened in May [Dudkowiak, 2026]. Demand was already high before that: in 2024 Poland had the second-highest share of cyber postings among the 14 countries LinkedIn tracked (3.5 %) [LinkedIn Economic Graph, 2024]. CERT Polska registered more than 100,000 incidents in 2024, up 29 % [CERT Polska, 2025]. Polish security specialists on employment contracts reported median monthly pay of PLN 10,200 as juniors, 16,900 at mid-level and 23,700 as seniors [Bulldogjob, 2025]. My expectation is that Polish compliance hiring peaks in 2027-28, after the registration deadlines.

    What this means if you are a security analyst

    1. Don't aim for tier 1 at a large enterprise. Take the MDR, MSSP or public-sector seat, or a GRC role in a firm that NIS2 or DORA now covers, and treat it as a two-year apprenticeship with a planned exit into engineering.
    2. Show what you have built. Ads now ask for automation, threat modelling and ownership. A detection rule you wrote and tested, a playbook you automated in Python or a SOAR tool, or a threat model of a real system will count for more than a third certificate.
    3. Learn to audit the machine. Ask any triage tool for its false-positive rate before you accept its throughput targets, and learn the attack surface of the AI systems your employer is deploying. US postings for AI security engineers grew 268 % in the first nine months of 2026.

    Sources

    Keep Exploring

    Backup and storage admin jobs in the AI era
    8 min read
    What's next for sysadmins and infra engineers, 2027 to 2029
    8 min read
    The sysadmin job in 2026: shrunk by cloud and VMware, not AI
    8 min read
    IT job market 2022 to 2026: openings fell, jobs held
    8 min read