What's next for cybersecurity people, 2027 to 2029

Part of a 14-post series on IT jobs in the AI era. Start with the overview: IT job market 2022 to 2026: openings fell, jobs held.

US employers had 190,650 information security analysts on the payroll in May 2025, 16.5 % more than three years earlier [BLS OEWS, 2025]. My forecast for May 2029 is 205,000 to 225,000. The same forecast says the way in will not widen: the share of UK cyber job ads open to someone with under a year of experience fell from 25 % to 17 % between 2022 and 2024, and I expect it to stay at or below 17 % [DSIT, 2025]. In our scorecard, security is the only IT family rated hardest to enter and good to be in, so the useful question is where the openings are.

Where the job stands in October 2026

US employment grew every year from 2021 to 2025 [BLS OEWS, 2025], while postings fell: US cyber postings were down 26.4 % in January to September 2026 against the same months of 2025, back to 2024 levels after a strong year [CyberSN via ClearanceJobs, 2026]. And the job ad changed: 28.5 % of cyber postings across the G7 required AI skills between October 2025 and March 2026, double the 14.2 % of a year earlier [AI Workforce Consortium, 2026].

The forecast, 2027 to 2029

These calls come from section 13 of the ai-era-it-jobs report. Each one rests on a measured trend and comes with a confidence level and a public indicator, so you can check it in 2027.

• US employment at or above 198,000 in May 2027 (high confidence). Two mechanical paths bracket it. Carrying the 2022-25 growth rate forward gives about 211,000 in 2027 and 234,000 in 2029. Spreading the BLS ten-year projection of +21 % evenly gives 198,000 and 206,000 [BLS projections; ]. My three-year call, 205,000 to 225,000 in May 2029, sits between them (medium).
• The UK under-one-year share stays at or below 17 % (high). The decline started in 2023, before AI triage tools were on sale, and nothing in the data suggests employers will reverse it.
• At least 35 % of G7 cyber postings require AI skills in the October 2026 to March 2027 window (medium).
• European GRC and AI-governance hiring peaks in 2027-28, Poland's in 2028 (medium). The AI Act's high-risk duties now start in December 2027 [Sidley, 2026], and Poland's NIS2 law only came into force in April 2026 [Dudkowiak, 2026].
• "Security engineer" outnumbers "security analyst" in UK adverts by 2029, and the analyst median stays below the engineer median (medium). In the six months to October 2026 the analyst median was £50,000 and the engineer median £70,000 [IT Jobs Watch, 2026].

Solid lines are measured, dashed lines are section 13 forecasts or labelled mechanical paths. Sources: BLS OEWS; UK DSIT 2025; AI Workforce Consortium; the ai-era-it-jobs report, section 13.

What would make this wrong: a 2027 recession would push every number down. Triage agents that publish false-positive rates and can reliably take action on alerts as well as read them would make these forecasts too mild for analysts.

Five places to aim

1. AI security engineering. US postings for "AI security engineer" rose 268 % in January to September 2026, and "cyber data scientist" 203.5 % [CyberSN via ClearanceJobs, 2026]. US cyber ads that ask for AI skills pay a median 14.9 % more [AI Workforce Consortium, 2026]. Start-ups are where these titles first appeared: on Hacker News hiring threads, AI-security employers show up from March 2024, and the first explicit "AI Security" engineer title from September 2024 [HN, 2026].
2. From analyst to builder. The UK pay gap above is the clearest signal: in 2024 the analyst median was higher than the engineer median, and by 2026 it was £20,000 lower [IT Jobs Watch, 2026]. Detection, automation and cloud security engineering are where the analyst's experience transfers.
3. GRC and AI governance in regulated European firms. None of the 21 Europe-located security job pages in our 2022-23 sample named NIS2, DORA, the AI Act or ISO 42001; in 2026, 14.2 % of 120 did [the ai-era-it-jobs report, 2026]. 47 % of ISACA respondents had helped build AI governance in 2025, up from 35 % [ISACA, 2025], and 64 % of enterprises have never run an AI incident-response exercise [ISACA, 2026], which is work nobody owns yet.
4. The managed-service seat as a way. Entry-level triage seats now sit at MSSPs, MDR providers, staffing firms and state government, at $60,000 to 83,000 [D3 Security, 2026]. Enterprises are training fewer insiders: the share training non-security staff for security roles fell from 41 % to 29 % in a year [ISACA, 2025].
5. Poland and contracting. Poland had the second-highest share of cyber postings among 14 countries in LinkedIn's 2024 data (3.5 %) [LinkedIn Economic Graph, 2024], and its NIS2 registration opened only in May 2026. Polish security specialists report a median of PLN 31,500 net a month on B2B contracts against PLN 16,900 gross on employment contracts [Bulldogjob, 2025]. The two are not like for like, but the gap is wide. Remote is shrinking, though: security posts on Hacker News saying "remote" fell from 85 % to 69 % [HN, 2026].

Left: ai-era-it-jobs report scorecard, scores 1 to 5. Right: change in US postings by title, January to September 2026 vs 2025. Sources; CyberSN via ClearanceJobs.

Skills to add, and what to stop paying for

We compared 148 security job pages from October 2022 to March 2023 with 914 from May to October 2026, with AI vocabulary blanked out first. In the next twelve months I would add what rose most: automation (36.5 % to 54.0 % of pages), threat modelling (11.5 % to 21.1 %) and zero trust (absent to 8.0 %). Detection engineering (3.4 % to 9.8 %), ISO 27001 (8.1 % to 14.5 %) and cloud security (16.9 % to 22.6 %) also rose, though by less than the 7 points this small sample can confirm [ai-era-it-jobs study, 2026].

On the AI side, the share of security pages naming AI in the requirements section went from 6 % to 53 % [ai-era-it-jobs study, 2026]. AI was the top skill need in ISC2's 2025 study (41 %) [ISC2, 2025]. In ISACA's 2026 survey, 45 % named "LLM SecOps", running security for large language models, as a skill gap, 12 points more than a year earlier [ISACA, 2026]. Prompt injection has been number one on the OWASP list of LLM risks since August 2023 [SD Times, 2023], so learn to test for it.

Stop investing in IDS/IPS as a headline skill (12.8 % to 4.6 % of pages) and JavaScript for security roles (13.5 % to 4.4 %) [ai-era-it-jobs study, 2026]. Manual web pentesting on its own is under pressure too: US penetration tester postings fell 45.9 % in 2026 [CyberSN via ClearanceJobs, 2026], and an autonomous tool, XBOW, topped HackerOne's US leaderboard in June 2025 [CSO via Slashdot, 2025]. Collecting certificates has a weaker case than it used to: CISSP's share of all US cyber postings fell from 19.2 % to 16.0 % [CyberSeek, 2025].

Change in share of security job pages, percentage points; grey band marks changes within noise. Source: ai-era-it-jobs study.

Three numbers to watch in 2027

1. BLS OEWS May 2026 release (spring 2027). Information security employment at or above 194,000 keeps the 2027 forecast on track.
2. UK DSIT cyber labour market study (2027). An under-one-year share above 17 % would mean juniors are being hired again, and my call is wrong.
3. The AI Workforce Consortium update (2027). Below 35 % of G7 cyber ads requiring AI skills would mean the AI ask has plateaued.

Your 90-day plan

• Days 1 to 30: pick a lane and rewrite the CV around it. Builder (detection, automation, cloud), AI security, or GRC. Cut IDS/IPS and generic "passion" lines; "passion" fell from 43.9 % to 21.3 % of security ads [ai-era-it-jobs study, 2026].
• Days 31 to 60: build one thing you can show. A small repository of detection rules with tests that run on every change; a threat model of an LLM application against the OWASP list; or an AI incident-response tabletop for your current employer, which probably has never run one.
• Days 61 to 90: apply where the seats are. Juniors: MDR and MSSP providers and public-sector SOCs. Mid-level and senior: AI-security start-ups and NIS2- or DORA-regulated firms in Europe, including Polish entities registering under the new law. In every interview, ask what false-positive rate the team's triage tool runs at.