AI skills now in 28.5% of security job ads, and the SOC job family is being quietly rewritten

The AI Workforce Consortium reported on August 20 that 28.5% of cybersecurity job postings across G7 countries between October 2025 and March 2026 asked for AI skills, up from 14.2% in the same six-month window a year earlier ^[1][2][3]. Job ads are where organisational design gets written down before anyone announces a restructure, so this is less a story about tooling than about who is expected to make decisions on a security team next year.

The report, which draws on data from recruitment firms Cornerstone and Indeed, describes an "agentic skill stack" becoming the baseline for high-volume roles including security engineering, cloud security, and detection and response engineering ^[1][4]. The mechanism it describes for the SOC is specific: AI systems absorb alert triage, threat intelligence correlation and standard decision-tree workflows, and the tier-one analyst moves from doing that work to supervising the systems that do it ^[5][6]. What is left for the human is validating outputs, assessing risk and judging whether a decision is sound ^[7]. Security engineers and SOC analysts remain the most in-demand positions ^[8], so this is a rewrite of the job family rather than a deletion of it.

The soft-skill numbers are the part to read carefully. The consortium logs ethical reasoning up 533% year over year, systems thinking up 251% and stakeholder engagement up 125% in postings ^[9]. As the secondary coverage notes, those skills are rising from a small base ^[10], which is what a 533% increase off almost nothing looks like.

The pipeline arithmetic is where consequence bites. Overall cybersecurity demand across the G7 rose 9.5% for the six months ending March 2026 ^[11], but senior-titled postings grew 65% while junior-titled postings grew 5.9% ^[12] - senior demand growing roughly eleven times faster than junior demand ^[13]. In a Cisco survey in May 2026, security leaders named the hardest competencies to find in entry-level candidates as hands-on experience with AI agents (49%), technical cybersecurity depth (48%) and human-centric professional skills (45%) ^[14]. That is an employer asking for supervisory judgment from people who have not yet been given the repetitive work that historically produced it. The report's own recommendation is experiential: lab exercises where students audit and critically evaluate AI-agent output, plus more internships and apprenticeships ^[15].

Provenance matters here. The consortium was founded in 2024 by Cisco alongside Accenture, Cornerstone, Eightfold AI, Google, IBM, Indeed, Intel, Microsoft and SAP ^[16], with a stated goal of upskilling 130 million people over a decade ^[17]. The demand data comes from two member firms, and the finding is that the market wants more of what members sell and teach. The direction still matches other evidence in the report: AI-powered defence is the top investment priority for 36% of leaders ^[18], the report cites a cyber-espionage campaign orchestrated using Anthropic's Claude and an autonomous ransomware operation documented by Sysdig ^[19], and the Five Eyes agencies have warned that the timeline on frontier model risk is months rather than years ^[20]. IBM's Cost of a Data Breach Report 2025 found higher breach costs at organisations with weak AI governance or significant shadow AI use ^[21].

Watch whether junior postings recover in the next six-month cut, or whether the gap widens. Watch whether "validate AI agent output" starts appearing as an assessable requirement with a rubric attached rather than a line in a job ad. And check your own escalation ladder: if triage is automated, name the person who signs off when an agent contains a host, and say what they are allowed to reverse.