October 18, 2026 · CertCrack Blog

Cybersecurity Jobs Down 26% — But AI Security Demand Is Up 268%

New data on the US cybersecurity job market tells two stories at once. The overall market just posted its worst nine months in four years — but one corner of it is exploding. If you're planning a certification path, the distinction matters more than the headline.

The numbers

The CyberSN Cybersecurity Jobs Report (data pulled October 7, 2026, from deduplicated postings mapped to 45 functional roles) found 235,786 US cybersecurity job postings from January through September 2026 — down 26.4% from 320,210 in the same period of 2025. It's a four-year low: 273,498 in 2023, 244,911 in 2024, 320,210 in 2025, and now 235,786. Eight of nine months in 2026 ran below their 2025 counterparts.

Some context before panic: 2025 was the busiest year the report has ever tracked, so part of the drop is a base effect — 2026 sits only about 4% below 2024. And these numbers count postings, not people: they measure employer intent, not layoffs or unemployment.

The roles contracting hardest tell their own story: Insider Threat Analyst postings down 55.6%, Cyber Risk Analyst down 51.5%, Penetration Tester down 45.9%, Threat Hunter down 40%, CISO down 38.9%. Traditional security hiring is slowing across the board.

The other story: AI security is exploding

Buried in the same report is the counter-trend:

• AI Security Engineer: up 268.3% (2,409 postings, Jan–Sep 2026 vs. the same period in 2025)
• Cyber Data Scientist: up 203.5% (1,493 postings)
• AI/ML terms now appear in 14.6% of all postings — and the trend is accelerating, peaking at 20.0% in September 2026, the highest monthly share since January 2025.

One methodological note: CyberSN treats AI Security Engineer as an overlapping signal within listings rather than a fully separate job count, so handle the 268% as directionally explosive rather than exact. The direction, though, is unambiguous.

As SecurityWeek concluded: "an AI security specialist may be in luck. Budding CISOs may need to be patient."

Anthropic's own data: the junior squeeze is real

The same week, Anthropic published an internal research report — "How employment is changing at Anthropic" — that reads like a case study in what AI is doing to tech hiring. The numbers, from the company's own employment and AI-usage records:

• By August 2026, interactive agent hours ran ~6x the hours of the human employees directing them. Agent work passed human work back in March.
• The junior share of technical hires fell from 27% to 9%. Junior technical employees overall dropped from 21% to 14%.
• Commits per engineer are ~5x their level six months earlier.
• Crucially, in a comparison of 192 engineers who adopted coding agents versus 74 who hadn't, adopters' output rose sharply with no difference in how often agent-written code was later reverted compared to human-written code.

Two caveats: it's a single company reporting on itself (and one that benefits from looking like a "leading indicator"), and Anthropic tripled in size during this period — so junior *shares* falling doesn't necessarily mean fewer junior *people*. But the direction matches the CyberSN data: CyberSN infers only 9.5% of cybersecurity postings as entry-level.

An Anthropic employee put it plainly: "I think we've already moved past the point of Claude augmenting away the really entry-level admin type role." Another described the shift: "that 20% that was strategic becomes 90% of the job."

What this means for your certification path

Here's the honest read for anyone studying for IT certs right now:

1. The entry-level squeeze is real, documented from two independent angles. Generic "break into cybersecurity" advice from 2023 doesn't account for a market where pen tester postings are down 46% and junior hiring shares are collapsing. You need a sharper plan than "get Security+ and apply everywhere."
2. AI security is the opportunity. +268% demand, AI terms in 1 in 5 postings and rising. The winning move isn't to avoid AI — it's to specialize in securing it. That's exactly what the AWS Certified AI Practitioner (AIF-C01) and AI-flavored cloud skills target.
3. Depth beats breadth at the junior level. Analyst Kayne McGladrey's summary of the market: "It has gotten choosier, rewarding people who can already do the work and shutting out the ones who can't yet." Certifications still open doors — but pair them with demonstrable hands-on skill, because employers are filtering harder.
4. The contract route is underrated. 9.2% of postings are contract roles, and CyberSN notes "a contract posting can be a way to try a function first." For breaking in during a squeeze, contracts and internships are the side door.

The market hasn't closed. It has gotten choosier — and it's telling you exactly what it wants: people who can work with AI systems and secure them. Build toward that, and the 26% headline matters a lot less than the 268% one.

Sources

• SecurityWeek: US cybersecurity job postings fall 26% as AI security engineer demand soars
• CyberSN: Cybersecurity Jobs Report
• TechCrunch: Anthropic says its workforce has become less junior
• AI Weekly: Anthropic report — junior technical hires fell from 27% to 9%
• Kayne McGladrey: 2026 is shaping up to be the worst year to look for a cybersecurity job in four years