- CyberSN counted 235,786 US cybersecurity postings from January to September 2026, down 26.4% on the same months of 2025 and the lowest of four years.
- The fall is uneven. CISO postings match 2024 levels, AI Security Engineer postings rose 268.3%, and only 14.6% of all postings mention AI terms.
- Read hiring plans against the mix of roles, not the total, and check each role over several years, not one.
US employers asked for far less security talent this year, and the drop is uneven. CyberSN's Cybersecurity Jobs Report counted 235,786 US cybersecurity postings from January to September 2026. The same nine months of 2025 produced 320,210, so this year is running about a quarter lower (26.4%). In the four years the report covers, no other January to September started so slowly. All but one month fell short of its 2025 counterpart.
The lesson here is that a total hides the decisions inside it. The count says employers are asking for less. The mix says what they are still asking for, and that is where a leader should look.
What the count does and does not measure
These are postings, not jobs or people. CyberSN took US data from JobSpikr, removed duplicates, and sorted listings into a taxonomy of 45 functional roles. It did this because, in its words, "Job titles are noisy." Roles are counted by the work asked for, not the title on the listing.
SecurityWeek describes the report as a "what" not "why" study. It cannot say whether firms cut budgets, filled roles, or hired through other channels. Treat it as a record of requests.
Part of the fall is a hangover from 2025
Take leadership. CyberSN groups ads for information security officers, from chief to business level, into one CISO area. It logged 2,832 of them for the first nine months of 2026, against 4,632 a year before. That is a drop of 38.9%, and it looks like a collapse.
The three-year view says otherwise. The same months of 2024 had 2,808 postings, almost the same as 2026. In 2025, full-year CISO postings rose 44.3% on 2024 to 5,597. SecurityWeek notes that much of the decline reflects that unusually strong year. CISO postings also rose 19.5% from the second quarter to the third.
One year-on-year figure can describe a spike as easily as a slump. Other losses are steep too: Cyber Risk Analyst fell 51.5% to 4,031 and Penetration Tester fell 45.9% to 3,063. The sources do not say whether those also follow a strong 2025.
AI demand is real, but narrower than the headline
SecurityWeek reports that AI Security Engineer postings rose 268.3% and Cyber Data Scientist postings rose 203.5% over last year. Read these with care. The sources give percentages, not posting counts, so the starting size is unclear. The report also shows AI Security Engineer without adding it to totals, because it overlaps broader queries. Cyber Data Scientist had one month, May 2026, with 379 postings against a trailing median of 57. The report uses 57 in its totals.
Across all postings, AI is not spreading fast. Roughly one listing in seven names AI or machine learning, about the same as a year ago, when the share was 15.1%. The share did climb through 2026. No month since January 2025 has had a higher share than September's 20.0%.
The share is higher in some functions. Research stands at 32.7%, up 11.7 points, and Offense at 23.3%, up 4.8 points. The search covers terms such as "generative AI" and "LLM". CyberSN warns that "LLM" can also mean a law degree, so Legal postings may run slightly high.
The data fits a modest reading. AI knowledge is becoming a requirement in particular roles, not yet a baseline for every security hire. The report does not say why.
Where the volume sits
Product Security, the function built around software and delivery pipelines, has 10,082 postings per tracked role. Defense has 8,887 and GRC (governance, risk and compliance) has 6,965. DevSecOps alone carries 24,317 postings. CyberSN says these roles often read like engineering jobs with a security mandate.
Each function's slice of the total is moving too. Comparing the same nine months in each year, GRC now holds 5.4 more points of the total than in 2023, while Defense holds 5.6 fewer. CyberSN concludes that the market is changing shape, not only shrinking.
Most postings with a known company size come from firms with 1,000 or fewer employees. Of those postings, 52.6% came from firms with 1,000 or fewer, and 47.3% from firms with more than 1,000. These figures cover January to August. Company size is whichever firm JobSpikr links to the ad, so an agency hiring for a client is counted at the agency's size.
Questions to put to your team
First, which of our open roles sit in functions where postings fell sharply, and is that a market signal or just a 2025 comparison? Ask for three years of data, not one.
Second, where do we need AI security skills? Name the roles and the owner. A 268.3% rise tells you the topic is hot, not how many people exist or what they cost.
Third, do our job titles match the work? A search by title alone misses the roles that the report finds by what a posting asks for.
Fourth, does our hiring calendar fit the year? In the three prior years, August ran about 22% above the monthly average, while December ran about 26% below it.
A posting is a request, not a result. Read what the market is requesting, then check whether your own team could answer it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CyberSN.
