US employers posted fewer cybersecurity jobs in the first nine months of 2026 than in any comparable period in the four years CyberSN has tracked, according to the recruiting firm's latest Cybersecurity Jobs Report. The firm counted 235,786 postings from January through September, down 26.4% from 320,210 in the same period of 2025 and about 4% below the 2024 figure.
The overall drop was not spread evenly. Postings for AI security engineers rose 268.3% year over year, to about 2,400, and cyber data scientist postings rose 203.5%. Governance, risk and compliance (GRC) work grew its share of postings, driven largely by demand for privacy and cybersecurity attorneys, which Help Net Security reported were the only one of the 10 largest role categories to post more listings this year than last. Defense roles' share of postings shrank, and penetration testers and CISOs saw steep declines.
The numbers matter to anyone hiring for or looking for security work: practitioners weighing where to build skills, small-business managers trying to fill one or two security seats, and contractors whose pipeline depends on client demand for specific roles.
How the Data Was Built
CyberSN's figures come from job-posting data aggregated by JobSpikr. CyberSN removed duplicate postings and mapped them to its own taxonomy of 45 functional roles across 10 categories, so demand is measured by the work described rather than by job titles. The report counts postings, not hires, filled positions or headcount, and it does not try to explain the trends it records. As SecurityWeek's coverage puts it: "This is a 'what' not 'why' report."
That caveat matters. A falling count of postings can reflect fewer open roles, but it can also reflect changes in how employers advertise, consolidate job descriptions or recruit through other channels. The report does not attribute the decline to any single cause.
The Month-by-Month Picture
According to Help Net Security's summary of the report, September 2026 was the only month of the year in which postings exceeded the corresponding 2025 figure, and only by fewer than 400 postings. SecurityWeek reported that September was also the month in which mentions of AI in job postings peaked, at 20.0%.
Across the full January-to-September period, AI was mentioned in just under 15% of postings, roughly flat against 15.1% in 2025. By function, AI mentions were most common in research roles (32.7%), followed by offense (23.3%) and GRC (19.8%).
Where Postings Grew
The two fastest-growing roles in the report are both tied to AI and data:
- AI security engineer: up 268.3% year over year, to about 2,400 postings.
- Cyber data scientist: up 203.5% year over year.
GRC's share of all postings has climbed steadily, from 9.4% in 2023 to 14.8% in 2026. Help Net Security reported that much of GRC's gain comes from privacy and cybersecurity attorneys. CyberSN CEO Deidre Diamond put the trend plainly: "Risk is the biggest conversation in the room right now."
Where Postings Fell
Defense roles, the hands-on work of monitoring, detection and response, made up 41.5% of postings in 2026, down from 47.1% in 2023. SecurityWeek listed the roles with the steepest year-over-year declines:
| Role | Change YoY | Jan–Sep 2026 postings |
|---|---|---|
| Cyber Insider Threat Analyst | -55.6% | 1,088 |
| Cyber Risk Analyst | -51.5% | 4,031 |
| Penetration Tester | -45.9% | 3,063 |
| Cybersecurity Lead | -41.0% | 4,688 |
| Threat Hunter | -40.0% | 1,013 |
| Cybersecurity Project Manager | -39.4% | 783 |
| CISO (including CSO, BSO, ISO) | -38.9% | 2,832 |
The steep fall in Cyber Risk Analyst postings is notable given that risk-related work overall gained ground. According to Help Net Security, the gains in that area came largely from legal and privacy roles, namely privacy and cybersecurity attorneys, rather than from traditional analyst positions.
The CISO Numbers
CISO postings fell 38.9% year over year, to 2,832, but that figure is nearly identical to the 2,808 CISO postings recorded in the same period of 2024. Both outlets noted that the drop partly reflects an unusually strong 2025 for CISO postings rather than a collapse in 2026. CISO postings also rose 19.5% from the second quarter to the third quarter of 2026.
Diamond suggested that the swings in leadership hiring may not be specific to security. "I believe the volatility we're seeing in security leadership hiring may have more to do with disruption across the C-suite," she said, according to Help Net Security.
What It Means for Defenders
The report describes posting volume, not the threat landscape, and nothing in it suggests organizations need less defense. But it does show where employers are currently putting their hiring money. Some practical points for different readers:
- Practitioners in defense and offense roles: With defense down to 41.5% of postings and pen tester postings nearly halved, expect more competition for each opening. The roles that grew, AI security engineering and cyber data science, reward skills that build on existing security work: securing machine-learning pipelines and model deployments, data analysis for detection, and the ability to judge AI-related risk. AI mentions were most common in research, offense and GRC postings, which shows where employers expect that knowledge.
- Hiring managers at small and midsize organizations: A softer market for defenders and testers may make it easier to fill those seats, but cutting coverage isn't the right takeaway. Before collapsing roles, list which detection, response and testing duties each position covers, and make sure the work is reassigned, contracted out or covered by a managed provider rather than dropped quietly.
- Organizations adopting AI tools: The spike in AI security engineer postings shows that peers are staffing for AI risk. If your organization is rolling out AI systems without anyone assigned to their security, name an owner, inventory the AI tools and data flows in use, and fold them into existing risk assessments and access reviews.
- GRC and privacy teams: Growth in privacy and cyber attorney postings points to rising legal and regulatory exposure. Make sure incident response plans spell out when counsel is brought in, and that privacy, legal and security teams have rehearsed together.
- Contractors and consultants: Lower in-house demand for pen testers and threat hunters could push some of that work to outside firms, or it could reflect reduced budgets overall. The report does not say which. Track your own client pipeline instead of assuming one or the other.
- Everyone reading the numbers: Treat the report as a measure of advertised demand. It does not count internal transfers, roles filled without public postings, or how many people are actually employed in security.
