Are security specialties turning into engineering jobs?In detection and response, engineer titles and language asks rose.
Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
Read the full research paperDetection and response is the clearest case. In US detection and response job postings, 19% carried an engineer title in spring 2024. At US-headquartered companies in fall 2026, 50% did.
Most other specialties point the same way, with less certainty. Across all 1,038 US security postings in spring 2024, 22% asked for a programming language. Across 4,587 postings at US-headquartered companies in fall 2026, 43% did. GRC postings added automation, and privacy postings moved toward decision work instead.
These findings compare two sources: a public dataset of US postings from spring 2024, and AKA's read of company job boards in 2026. They apply best to US-headquartered companies on modern job boards, which lean toward technology, and less to government, staffing and managed-security firms.
The answer at a glance
Detection and response postings with an engineer title rose from 19% to 50%, and language asks from 18% to 48%.
Postings with an engineer title also rose in identity and access, from 41% to 65%, and where no specialty is named, from 42% to 61%.
Governance, risk and compliance (GRC) postings with an engineer title rose from 4% to 24%. Those asking for automation rose from 18% to 47%.
Vulnerability management and threat intelligence also point toward engineering, though each had few postings in 2024.
Application security (AppSec) postings that name AI terms went from almost none to 41%. A change in AppSec engineer titles is too close to call.
Architecture postings asking for a programming language rose from 10% to 25%. A change in how many are mainly about making decisions is too close to call.
Privacy postings mainly about making decisions rose from 0% to 19%. A change in engineering asks is too close to call.
In detection and response, postings where the hire mainly does the technical work went from 76% to 74%. The change is too close to call.
Source: AKA Security analysis of 1,038 US security postings from a public job-postings dataset (listed 5 to 19 April 2024) and 4,587 postings at US-headquartered companies in AKA's job-board data (open on or after 23 September 2026). The all-postings engineer title share is from the same postings and the same title rule. Specialties not shown make up the rest of the totals, so the all-postings row is not a sum of the rows above.
The numbers by specialty
Selected specialties, spring 2024 against fall 2026. Each cell is the share of that specialty's postings. "Engineer title" means the title contains engineer or developer. Postings in specialties not shown make up the rest of the totals.
| Specialty | Postings, 2024 → 2026 | Engineer title | Asks for a programming language | Asks for automation | Names a certification |
|---|---|---|---|---|---|
| Detection and response | 74 → 484 | 19% → 50% | 18% → 48% | 42% → 67% | 51% → 34% |
| Identity and access | 64 → 148 | 41% → 65% | 30% → 45% | 33% → 71% | 13% → 35% |
| Vulnerability management | 22 → 86 | 27% → 50% | 23% → 44% | 32% → 71% | 36% → 50% |
| Threat intelligence | 13 → 58 | 0% → 34% | 0% → 38% | 23% → 66% | 23% → 19% |
| No specialty named (security analyst or engineer) | 340 → 1,128 | 42% → 61% | 21% → 41% | 26% → 53% | 40% → 32% |
| GRC | 137 → 309 | 4% → 24% | 3% → 15% | 18% → 47% | 68% → 52% |
| AppSec | 85 → 730 | 81% → 87% | 62% → 64% | 59% → 63% | 28% → 19% |
| Cloud security | 31 → 173 | 68% → 78% | 35% → 52% | 45% → 75% | 19% → 30% |
| Architecture | 81 → 232 | 2% → 13% | 10% → 25% | 21% → 44% | 41% → 48% |
| Privacy | 20 → 101 | 25% → 45% | 40% → 25% | 55% → 35% | 20% → 16% |
| All security postings | 1,038 → 4,587 | 34% → 58% | 22% → 43% |
Source: AKA Security analysis of 1,038 US security postings from a public job-postings dataset (listed 5 to 19 April 2024) and 4,587 postings at US-headquartered companies in AKA's job-board data (open on or after 23 September 2026). The all-postings engineer title share is from the same postings and the same title rule. Specialties not shown make up the rest of the totals, so the all-postings row is not a sum of the rows above.
Language asks rose at most levels
Across all US security postings, the share asking for a programming language rose from 22% in spring 2024 to 43% in fall 2026. The range of likely values for that change is +17 to +26 points.
The 2026 postings lean more senior. Senior individual contributor titles were 26% of US security postings in 2024 and 47% in 2026. Held to the 2024 mix of levels, the 2026 share of US security postings asking for a language is 42%, against 43% unadjusted.
| Level | Postings, 2024 → 2026 | Asks for a programming language, 2024 → 2026 | Range of likely values, points |
|---|---|---|---|
| Executive | 39 → 245 | 8% → 16% | −4 to +18 |
| Manager | 80 → 310 | 9% → 20% | +3 to +20 |
| Senior individual contributor | 274 → 2,146 | 27% → 50% | +17 to +30 |
| Individual contributor | 645 → 1,886 | 22% → 43% | +15 to +26 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | |||
Source: AKA Security analysis of 1,038 US security postings (April 2024) and 4,587 postings at US-headquartered companies (fall 2026).
The rise is clear for manager, senior individual contributor and individual contributor titles. For executive titles, the range includes zero, so a change is too close to call.
This finding is rated Medium. Among the 74 companies with postings in both years, language asks went from 32% to 41%, and that range, −4 to +22 points, includes zero.
Detection and response postings ask for engineering
In US detection and response postings, the share with an engineer title rose from 19% in spring 2024 to 50% in fall 2026. The range of likely values is +20 to +41 points.
In the same postings, asks for a programming language rose from 18% to 48%, and asks for automation from 42% to 67%. Detection and response postings naming a certification fell from 51% to 34%.
The rise holds outside technology companies, though it is smaller there. In 2026 detection and response postings outside technology companies, engineer titles reached 39%, against 20% in 2024 postings without staffing firms and government contractors. At the same companies in both years, engineer titles went from 15% to 53%.
Language asks rose more than asks to code. Asks to code or do software engineering rose from 18% to 30% of detection and response postings. That rise is likely but borderline. The language rise was larger than the coding rise, by a range of +6 to +30 points.
Detection and response postings naming AI terms, such as LLM, generative AI, agents and prompt injection, rose from 1% to 25%.
Identity and postings with no specialty named moved the same way
In US identity and access postings, the share with an engineer title rose from 41% in spring 2024 to 65% in fall 2026. The range of likely values is +8 to +40 points. Identity postings asking for automation rose from 33% to 71%.
Identity is the one specialty here where certification asks rose, from 13% to 35% of postings.
The identity finding is rated Medium. Outside technology companies, identity engineer titles went from 42% to 55%, and the range includes zero. At the same companies, they went from 33% to 73%, and that range includes zero too.
Among postings with no specialty named, titled security analyst or engineer, the share with an engineer title rose from 42% in 2024 to 61% in 2026. The range is +13 to +27 points. Asks for automation in these postings rose from 26% to 53%.
That rise holds outside technology companies at about the same size: 41% to 59%. At the same companies, engineer titles in these postings went from 48% to 50%, so a change there is too close to call. That is why this finding is Medium.
Vulnerability management and threat intelligence point the same way
In US vulnerability management postings, the share with an engineer title went from 27% in spring 2024 to 50% in fall 2026. The range of likely values, −1 to +44 points, just includes zero. The 2024 base is 22 postings.
Vulnerability management postings asking for automation rose from 32% to 71%, a clear rise with a range of +15 to +61 points.
In US threat intelligence postings, the share with an engineer title went from 0% in 2024 to 34% in 2026. The range is +22 to +47 points, on a 2024 base of 13 postings.
Both are rated Medium on direction because each 2024 base is under 30 postings. The size of each change is rated Low, because the ranges are 45 and 25 points wide.
GRC postings ask for automation and carry engineer titles
In US GRC postings, the share with an engineer title rose from 4% in spring 2024 to 24% in fall 2026. The range of likely values is +14 to +26 points. The rise holds outside technology companies (4% to 20%) and at the same companies (0% to 27%).
GRC postings asking for automation rose from 18% to 47%. That finding is rated Medium, because at the same companies the change, 23% to 31%, is too close to call.
GRC postings asking for a programming language went from 3% to 15%. In 2026 that is well under the 43% of all security postings. GRC postings naming a certification fell from 68% to 52%.
AppSec postings added AI terms
In US AppSec postings, the share naming AI terms went from 0% in spring 2024 to 41% in fall 2026. The range of likely values is +35 to +46 points.
AppSec postings already asked for engineering in 2024. In 2024, 81% carried an engineer title and 62% asked for a programming language. In 2026 the figures were 87% and 64%, and both changes are too close to call.
AppSec postings naming a certification went from 28% to 19%. The range, −21 to +1 points, includes zero, so that change is too close to call too.
In US cloud security postings, the engineer title share went from 68% to 78%, a change too close to call. Cloud security postings asking for automation rose from 45% to 75%, a clear rise with a range of +9 to +49 points.
Architecture postings name a language more often
In US architecture postings, the share asking for a programming language rose from 10% in spring 2024 to 25% in fall 2026. The range of likely values is +5 to +25 points.
The finding is rated Medium. Outside technology companies, architecture language asks went from 12% to 18%, and that change is too close to call.
Architecture postings with deciding as the main activity went from 20% to 31%. The range, −1 to +24 points, includes zero, so the change is too close to call. In 2026, deciding was the main activity in 8% of detection and response postings and 12% of AppSec postings.
Privacy postings shift toward decision work
In US privacy postings, the share with deciding as the main activity rose from 0% in spring 2024 to 19% in fall 2026. The range of likely values is +12 to +27 points. Each of the two hosted models found a clear rise on its own.
Privacy postings naming AI policy, risk or compliance duties rose from 0% to 24%. Privacy postings where the hire mainly does the technical work fell from 90% to 65%.
For engineering, a change is too close to call. Privacy postings asking for a programming language went from 40% to 25%, and the range, −41 to +8 points, includes zero. The 2024 base is 20 postings from 18 companies.
A change in the amount of hands-on work is too close to call
Three AI models read each posting and judged whether the hire mainly does the technical work personally. The answer used is the one at least two of them agree on.
In US detection and response postings, 76% were mainly hands-on in spring 2024 and 74% in fall 2026. The range of likely values, −12 to +10 points, includes zero, so a change is too close to call.
| Specialty | Postings, 2024 → 2026 | Mainly hands-on, 2024 → 2026 | Range of likely values, points |
|---|---|---|---|
| Detection and response | 74 → 484 | 76% → 74% | −12 to +10 |
| Vulnerability management | 22 → 86 | 77% → 69% | −28 to +13 |
| Identity and access | 64 → 148 | 75% → 61% | −27 to 0 |
| No specialty named (security analyst or engineer) | 340 → 1,128 | 89% → 85% | −8 to +1 |
| GRC | 137 → 309 | 68% → 67% | −12 to +10 |
| AppSec | 85 → 730 | 85% → 79% | −13 to +3 |
| Cloud security | 31 → 173 | 90% → 77% | −25 to 0 |
| Architecture | 81 → 232 | 69% → 64% | −18 to +9 |
| Privacy | 20 → 101 | 90% → 65% | −42 to −3 |
| Each bar is a range of likely values against zero, the dashed line. A hollow bar includes zero: we can’t tell the change from no change. | |||
Source: AKA Security analysis of 1,038 US security postings (April 2024) and 4,587 postings at US-headquartered companies (fall 2026), read by three AI models.
Privacy is the only specialty in the table with a clear fall in mainly hands-on postings.
The question as asked
How are different specialties evolving, like AppSec, Security Architecture, Vuln Management, etc. I imagine those roles are shaped differently than previously. For example, are they all trending to more hands-on engineering?
Asked by Jamie Dicken
Where the data comes from
The 2024 postings come from a public job-postings dataset: 1,038 US security postings from 680 companies, listed 5 to 19 April 2024. The 2026 postings come from AKA's daily read of company job boards: 4,587 postings from 831 US-headquartered companies, open on or after 23 September 2026.
The two years match on country but not on exact definition. 2024 is US by job location, and 2026 is US by company headquarters. Both went through the same rules for title level, specialty and description terms.
A posting counts when its title passes the series' security title rules, a local model rules it a security role, and it carries a description. Only one posting per title per company counts. Job aggregators are left out in both years, as are physical security, fraud, and trust and safety roles. Staffing firms are included: 166 postings in 2024 and 145 in 2026.
Until the evening of 21 September 2026, the job-board collector skipped titles containing analyst, auditor, consultant, CISO, director, head of, specialist and "manager, security". Postings that closed before then lean toward engineer titles, so the 2026 side is limited to postings open on or after 23 September 2026.
Each range of likely values is the 95% range for the change, found by redrawing whole companies at random many times. A range that includes zero means the change cannot be told from no change.
On 1 October 2026 the daily read covered 220,747 postings, of which 15,163 were security postings, from 2,537 companies.
How this answer was stress-tested
| Test | What it found |
|---|---|
| Scope check of every posting. A local model read all 1,405 postings in 2024 and 5,196 in 2026 that pass the title rules. | It ruled 26% of 2024 postings and 12% of 2026 postings not security roles, such as financial auditors, physical security, alarm installers and lawyers. With them removed, 2024 detection and response automation asks went from 28% to 42%. |
| Title rules against a separate model. 192 titles labelled blind across both years. | Level agreement at a kappa of 0.975, specialty agreement at 0.76. |
| Description length. 2026 descriptions are 60% longer. | Every language comparison was repeated on postings of 3,000 to 6,000 characters. Across all security postings, language asks went from 25% to 41%, the same direction and 5 points smaller. |
| Same companies. The 74 companies with postings in both years. | Language asks across all postings went from 32% to 41%, a change too close to call. GRC and detection and response engineer titles rose here too. |
| Staffing firms and government contractors removed. Left out of both years. | Language asks across all postings went from 22% to 44%, the same direction and about the same size. |
| Outside technology companies. 2026 postings outside technology companies against 2024 without staffing firms and government contractors. | Detection and response and GRC engineer titles rose, smaller by 12 and 4 points. Identity engineer titles and architecture language asks show no clear change. |
| Held to the 2024 level mix. | The 2026 share asking for a language is 42%, against 43% unadjusted. |
| Two hosted models on both years. Each read all 5,625 postings. | They agree with each other on hands-on work at a kappa of 0.74, main activity at 0.79 and people management at 0.93. Each one alone finds no clear change in detection and response hands-on work. |
| Local model against the hosted models. The same labeller on both years. | Agreement on hands-on work is 0.56 and 0.63, on main activity 0.68 and 0.68, and on people management 0.76 and 0.77. |
What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| A second 2026 sample collected the way the 2024 one was | Whether the difference between the two data sources drives the change | |
| Licensed longitudinal postings data | Year-by-year specialty shares from 2019, with seasonality | |
| A re-read of the same collection in three to six months | A direct trend under stable collection | |
| A practitioner read of 100 specialty postings |
Other formats
The same findings and figures, laid out as a research paper with numbered sections, references and a citation.
Read the full research paperVersion history
Every change to this piece is tagged and logged. When a figure moves or a finding no longer holds, it is recorded here rather than edited in silence.
- The rise in postings asking for a programming language, from 22% to 43%, moved from the glance into the body.
- The architecture row's representativeness is split: Medium for language asks, Low for decision work (was Low for both).
- The summary is now the overall rise in postings asking for a programming language, from 22% to 43%.
- The industries counted as outside technology were listed differently across pieces. They now match everywhere, and telecommunications counts as technology. Only test results moved. No answer or rating changed.
- Are security specialties turning into engineering jobs? Figures as of 1 October 2026, some tests 23 September.
Corrections
Received. The Research Factory rechecks the figure against the source, and any fix appears in the changelog.
The rating scales and the standard checks are the same for every piece. How the research is made.
Ask the Research Factory a question.
This is not a live chat. Accepted questions become new pieces, published in a later release.
- 01 You ask, with the decision it would inform You queued
- 02 We check job postings can answer it Our team queued
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued
- 01 You ask, with the decision it would inform You done
- 02 We check job postings can answer it Our team next
- 03 Approved questions join the reader queue Our team queued
- 04 Agents write the analysis, ratings and piece Research Factory queued
- 05 Every answer runs our standard controls Our controls queued
- 06 Published and tagged, credited if you want Research Factory queued