Cybersecurity roles are still being opened, not withdrawn: 467 live security postings sit in the catalogue, and 395 of them score Level 1, where AI is a tool the team already uses rather than the thing the team builds. 7 score Level 4. Here is what the postings say.
The number this article rests on: 467 live security postings, of which 395 are Level 1 and 7 are Level 4. Measured September 2026.
Every posting in the catalogue is scored from its own text on a four-point scale. Level 1 means AI shows up as a tool in the workflow. Level 4 means the job is to build the AI system itself. The scale is described in full on the Levels page, and the scoring procedure on the method page. Nothing here is a forecast: a posting either asks for something or it does not, and the count is what it is on the day of measurement.
That matters for this question in particular, because the public conversation about AI and security runs on projections rather than on job ads. A projection cannot be checked. A count can. If security roles were being replaced, the catalogue would show the category shrinking and the remaining postings shifting toward building AI rather than using it. What follows is that check, split into the six questions people actually ask.
Will AI replace cybersecurity jobs?
Nothing in the catalogue reads as replacement. 467 live security postings are open, and 395 of them score Level 1, meaning AI appears as a tool the team already uses rather than the thing the team builds. 7 score Level 4, where building AI is the job. Measured September 2026.
A count of open roles is not a forecast, and it cannot rule out a change that has not reached the job ads yet. What it does rule out is the version of the story where the roles have already gone. They are posted, they are paid, and most of them describe AI the way earlier postings described cloud platforms: as something the candidate is expected to work with.
The one shift the numbers do support is in what the work asks for. A security posting that mentions AI is usually asking for someone who can evaluate a model's output, not someone who can train one. That is a change in the toolset, and the Level 1 listings are full of it.
What share of security postings treat AI as the core of the job?
Level 4 postings, where building AI systems is the work itself, account for 7 of the 467 security roles, or 1.5%. Level 1 accounts for 395, or 84.6%. The remaining 65 postings sit between the two, asking for judgement about what a model produces rather than for the model itself. Measured September 2026.
The middle band is the part worth watching. Those postings ask for more than tool use and less than model building: evaluating an AI detection system, tuning it, or being accountable for what it flags. That band is where a security career moves without becoming a machine learning career.
Compared with the catalogue as a whole, where 1,628 of 27,031 postings are Level 4, the security share sits below the market. Browse the security hub to see the split posting by posting.
Does security pay more than the rest of the market?
Security postings that publish a USD range have a median maximum of $255,000 and a median floor of $180,000, on 226 listings. That maximum sits above the catalogue-wide median maximum of $240,000, taken across 10,744 USD postings. Measured September 2026.
Only postings that print a range in USD are counted, which is 226 of the 467 security roles. The rest publish nothing, publish a non-USD figure, or publish an hourly rate. Nothing here is estimated from the ones that stay silent, and a published range is not a guaranteed offer.
Pay is the measurement that argues most directly against replacement. Employers do not raise what they are willing to print for work they expect to automate within the year. The salary line and the Level distribution tell the same story from two directions.
Is security work still remote?
48.8% of security postings are remote, against 48.7% across the whole catalogue, which puts the category level with the market on that measure. Remote status is read from the posting itself, so a hybrid role that does not say so is counted as on-site. Measured September 2026.
That figure is a floor rather than a headline. Postings that describe an office by naming a city, without using the word remote, land on the on-site side of the count even when the team works from anywhere. The number moves only when employers change what they write.
For a candidate, the practical reading is that location is rarely the binding constraint in this category. Clearance requirements and on-call rotations are, and neither of them is something a model takes over.
How does security compare with the other technical categories?
Ranked by the share of postings that score Level 4, the four technical categories of the catalogue line up as follows. Security sits below the market-wide Level 4 share of 6.0%, on 467 postings against 27,031 in the catalogue overall. Measured September 2026.
- Research: 418 live postings, 72.5% Level 4, 24.4% Level 1, 35.4% remote.
- Data: 1,043 live postings, 26.1% Level 4, 57.0% Level 1, 55.0% remote.
- Software Engineering: 7,726 live postings, 10.7% Level 4, 67.8% Level 1, 44.0% remote.
- Security: 467 live postings, 1.5% Level 4, 84.6% Level 1, 48.8% remote.
Read that table as a map of where the building happens. The categories with the highest Level 4 share are the ones staffing AI teams; the categories with the highest Level 1 share are the ones handing AI to people who already had a job. Security has consistently been in the second group, which is the whole answer to the question in the title.
There is a second reading that matters more for a career. A category can be almost entirely Level 1 and still be changing fast, because Level 1 describes what the posting asks for today, not how hard the work is. The comparison across categories is a snapshot of demand, not a ranking of difficulty.
What does an entry-level security posting look like?
6 of the 467 security postings are tagged entry level, which is 1.3% of the category. Security hires at the experienced end: across the whole catalogue, 8,739 postings are tagged senior and 3,809 lead, against 993 junior or intern. Measured September 2026.
Seniority is read from the posting text, and 6,767 postings across the catalogue say nothing about it at all. The entry-level count is therefore a lower bound, not a census of every junior opening in the market.
The shape is still clear enough to plan around. 12,548 senior or lead postings against 993 junior or intern ones means the category rewards a track record more than a certification, and the entry-level guide covers where the openings that do exist tend to sit.
Which tools do these postings name?
Across 27,031 live listings the catalogue recognises 300 distinct tools, and the three named most often are OpenAI, Claude, and Cursor. Tools are counted across every category rather than per category, so that ranking describes the whole market and not security alone. Measured September 2026.
A tool counts once per posting, when its name appears in the text. A posting can name several, and 4,813 of the 27,031 live postings name at least one. Skills a posting describes without naming a product, such as threat modelling or scripting, are not counted here at all.
The useful conclusion for a security engineer is narrow and checkable: the named tools in this market are general-purpose assistants and data platforms, not security-specific models. Learning to evaluate what a general model outputs is what the postings ask for, and each tool hub, such as Claude, lists the roles that name it.
The jobs right now
Live security postings, newest first, generated from the catalogue rather than written by hand.
