AI Is Reshaping Security Jobs, but Experienced Staff Remain Hard to Find

The SANS 2026 Cybersecurity Workforce Survey suggests AI is changing security teams without shrinking them. Nearly three-quarters of organisations said AI has influenced how their teams are built, mostly through workflow automation and less manual analysis. Relatively few reported cutting staff. Demand for specialists in new roles more than doubled over the past year, including AI security engineers, AI governance analysts and AI/ML security specialists.

Preparation for AI risk is uneven. Some 54% of respondents said they have AI security policies, and only 38% provide comprehensive AI security training. Nearly one in four organisations have no AI governance plans. Meanwhile, experienced cybersecurity professionals remain the hardest roles to fill, and senior positions take the longest. Senior leaders and managers, including CISOs, account for most hiring decisions.

Regulation is also shaping hiring. Rules such as NIS2, DORA, DoD 8140, SEC requirements and CMMC are changing priorities and increasing demand for specialist roles, though most apply to specific sectors like critical infrastructure, financial services and defence contractors. Companies are adopting frameworks such as NICE and the European Cybersecurity Skills Framework to standardise roles and skills. Certifications are growing in importance for hiring, audits, client requirements and career development. SANS Institute CEO James Lyne said organisations face real enforcement consequences if they do not adapt.