What happened
SANS Institute published a tracker of AI security job postings, built from an analysis of public listings in mid-September 2026, with counts and median advertised salaries for each role family. Cybersecurity Dive reported the numbers.
The largest category is AI and machine learning security engineers, with more than 850 open roles and a median advertised salary of $140,000. Employers named in the reporting include Amazon, Mastercard, PepsiCo and SpaceX. AI red team specialists account for nearly 100 postings at a median of $124,000, up 13% week on week, with Cloudflare and Lucid Motors among those hiring.
Then comes the category that reframes the story. SANS found roughly 430 postings for AI governance, risk and compliance leads, at a median salary of $146,000. That is the highest median of the three big groups, and it sits above the hands on engineering roles. JPMorgan Chase, Leidos and Aramark were among the employers looking for compliance specialists.
Smaller categories include AI security specialists at 48 postings, AI supply chain security engineers at 93, and AI SOC orchestrators at 36. Roles described as on the horizon, meaning little active hiring, include post quantum cryptography migration specialists and AI identity and deepfake defence specialists.
The non-AI figures are easy to miss and worth noticing. SANS counted more than 450 postings for IT and security compliance analysts, up 20% in a week, and 180 for identity and access management analysts, up 51%.
Why this is a GRC story
The market is pricing the policy work higher than the testing work. A median of $146,000 for governance against $124,000 for red teaming is a signal that organisations are paying for someone who can decide what is allowed, not only someone who can find what is broken. Anyone who treats GRC as the lower paid branch of security should look at these numbers before repeating it.
Most of those governance hires are writing the framework, not auditing it. SANS notes that most organisations do not have comprehensive AI policies, including access controls on their models, while knowing their staff use the technology widely. Four hundred and thirty postings against a backdrop of unwritten policy means the job on day one is design and negotiation, not checklist review. That is a harder job than it sounds and a much better one to learn.
Headcount is not a control. The same report describes shadow AI spreading through personal accounts and adversaries who finish exfiltration in hours. A governance lead without authority to pause a deployment before it ships is a documentation function.
The baseline did not shrink. Compliance analyst postings up 20% and IAM analyst postings up 51% in a single week is the quiet story. AI added a layer of work rather than replacing the control set underneath it.
What to watch
Watch the job descriptions rather than the titles. If AI governance roles start asking for engineering literacy or the ability to read an eval report, the discipline is maturing. If they stay policy only, the salary premium will erode as the frameworks get written.
Watch the horizon list as well. Post quantum migration specialists are barely being hired while governments publish migration deadlines. That gap is the shape of an unfunded mandate.
Attribution: Analysis based on Cybersecurity Dive and related public reporting. This article is original commentary, not a repost of the source material.