What happened
CyberSN's latest jobs report puts US cybersecurity postings at 235,786 for January through September 2026. That is down 26.4 percent from 320,210 in the same period last year, and the lowest figure in four years. The data comes from JobSpikr with duplicates stripped, and every posting is sorted into a taxonomy of 45 functional roles rather than being counted by whatever title the recruiter wrote.
Inside that decline the split is sharp. AI Security Engineer demand rose 268.3 percent year over year, and Cyber Data Scientist demand rose 203.5 percent. Just under 15 percent of postings mention AI, roughly flat against last year's 15.1 percent, but the share climbed through 2026 and peaked at 20.0 percent in September. Among functions, Research references AI most at 32.7 percent, followed by Offense at 23.3 percent, GRC at 19.8 percent, and Plan at 18.9 percent.
The losses sit in analyst and mid level roles. Insider Threat Analyst postings fell 55.6 percent to 1,088. Cyber Risk Analyst fell 51.5 percent to 4,031. Penetration Tester fell 45.9 percent to 3,063, Cybersecurity Lead fell 41.0 percent to 4,688, Threat Hunter fell 40.0 percent to 1,013, and CISO and equivalent titles fell 38.9 percent to 2,832. The report notes that the CISO figure is close to 2024's 2,808 and that those postings rose 19.5 percent between the second and third quarters, so part of the drop reflects an unusually strong 2025.
GRC held up better than most of the field. It is the second most remote friendly function in the dataset at 31.2 percent of postings, just behind Sales at 32.8 percent, and it is among the functions where AI understanding is increasingly requested.
Why this is a GRC story
Resourcing is a control. A risk register that assumes quarterly access reviews, timely evidence collection, and continuous monitoring is really assuming people. When analyst hiring halves, the control does not vanish. It degrades quietly until an audit or an incident finds the gap, and the risk and insider threat roles that shrank fastest are exactly the ones producing evidence that third parties rely on.
The report's own framing is useful for boards. It describes what changed, not why, and says plainly that job titles are noisy. It also observes that director and CISO postings move with how boards are treating cyber accountability. That makes the number a signal about governance maturity, not just about hiring.
Read it as a leading indicator. A function that cannot hire analysts will lean harder on automation and managed services, which moves risk into contracts and vendor oversight. The obligation stays in the same place. The control moves to someone else's runbook, and so does the evidence.
What to watch
Watch whether the AI demand converts into controls work or stays a narrow specialist niche, and whether GRC hiring follows the accountability conversation at board level. For anyone planning a programme for next year, the constraint is worth writing down: same obligations, fewer hands, so the evidence pipeline has to be cheaper to run. These are listing counts, not employment totals, and they say nothing about intent, so treat the trend as context rather than a forecast.
Attribution: Analysis based on SecurityWeek and related public reporting. This article is original commentary, not a repost of the source material.