The SOC Analyst Job Didn't Disappear. It Split in Two.
November 6, 2026
Jillian, CMO— AI-assisted and reviewed prior to publication.
Two postings can carry the identical title, "SOC Analyst," and describe almost nothing in common. One wants someone to watch a queue and escalate alerts. The other wants someone who can audit an AI agent's reasoning, tune a detection pipeline, and explain why the model missed something. A recent analysis of roughly 1,000 security operations job postings found hands-on AI requirements in just 9% of triage-centered analyst roles, against 42% in automation engineering and 31% in detection engineering. That gap is the story, and it's wider than most candidates realize.
Why Do SOC Analyst Postings Look So Different From Each Other Now?
Because the title now covers two jobs with different futures. Where the traditional triage analyst role survives, researchers found it is the smallest, lowest-paid, and least automated family in the current hiring data, while the postings that explicitly ask candidates to build, operate, or validate AI-driven operations are growing. The U.S. Bureau of Labor Statistics still projects strong overall demand, with information security analyst employment expected to grow 28.5 percent from 2024 to 2034, the fifth-fastest growing occupation tracked. Headcount isn't the issue. Which version of the job gets funded is.
That distinction matters for anyone choosing where to put study hours. A candidate who prepares only for queue management and alert escalation is training for the half of the market that's shrinking relative to the rest, even as the overall occupation keeps growing. A candidate who can also speak to AI oversight is training for the half that pays more and is expanding faster.
What Actually Separates the Triage Track From the Builder Track?
The difference isn't tool knowledge, it's judgment under automation. Industry-wide, job postings requiring AI skills in cybersecurity roles roughly doubled between early 2025 and early 2026, from 14.2 percent to 28.5 percent of G7 postings, according to research from the Cisco-founded AI Workforce Consortium. The same research found that among postings already tagged as agentic AI security roles, the most commonly requested capabilities were Python automation, prompt and context engineering, AI and machine learning model security, and agent orchestration.
That's the builder side. The triage side still leans on fundamentals. Here's a rough comparison of what each track actually asks for in practice:
| Track | What the posting asks for | Direction of pay and demand |
|---|---|---|
| Triage-centered analyst | SIEM monitoring, alert escalation, basic networking | Smallest and lowest-paid segment, least AI-touched |
| Automation and detection engineering | Building detections, orchestration, AI pipeline validation | Fastest-growing AI requirement, highest pay premium |
The builder track isn't asking people to become data scientists. It's asking them to supervise, question, and correct what an AI system produces. ISC2's new CEO put it plainly in a recent interview, describing the shift as moving cybersecurity work toward validation, oversight, and governance rather than eliminating the need for human expertise. That's a different skill than knowing which button to click in a SIEM.
Is "AI Verification" Really the New Resume Keyword?
Yes, and it's more specific than generic "AI skills." The actual capability employers are probing for is whether a candidate can read an AI-generated investigation, identify what the model assumed or missed, and decide what to do about it. ISC2's 2025 Cybersecurity Workforce Study found that 41 percent of respondents cited AI as the single most pressing skill need, ahead of cloud security at 36 percent, for the second year running. The same study found that cybersecurity professionals are largely optimistic about this, with 73 percent believing AI will create more specialized cybersecurity skills and 72 percent expecting it to require more strategic roles.
What does that look like in an actual interview? Less recitation of port numbers and protocol stacks, more "here's an AI-generated investigation, tell us what's wrong with it." That shift rewards people who've practiced reading AI output critically rather than people who've memorized a tool's menu structure. It also means a resume heavy on certifications that only prove rote technical knowledge won't carry the same weight it used to. A credential that demonstrates you understand how AI models reason, where they fail, and how to govern their use carries more signal now than another SIEM badge.
This is also where the pay gap shows up concretely. Separate hiring analysis has found that postings explicitly requiring AI or machine learning skills pay a measurable premium over otherwise similar roles without that requirement, reinforcing that this isn't a soft preference employers list and then ignore when they extend an offer.
How Do You Prove This Skill Before You've Used It on the Job?
You build it through structured practice with AI security concepts, not by waiting for an employer to hand you the responsibility. This is the gap most candidates hit: the skill employers want is judgment about AI systems, but entry-level roles rarely include supervised practice with that judgment. ISC2's workforce data found that 44 percent of organizations are already reconsidering the types of roles and skills needed to support AI security tool adoption, which means the job descriptions are changing faster than most training pipelines.
That's the gap a credential like CompTIA's SecAI+ certification is built to close. It's designed around the practical work of securing and governing AI systems rather than building them, which lines up closely with what the hiring data shows employers actually screening for: can you spot a flawed model output, understand where an AI tool's blind spots sit, and apply sound judgment to its recommendations instead of accepting them at face value. If you're deciding where to spend the next few months of study time, that's a more defensible bet than adding another generalist credential to a resume that already has three.
It helps to look at this as a portfolio decision rather than a single-certification decision. Pairing foundational security knowledge with demonstrated AI governance literacy is what separates candidates who get interviews for the builder-track postings from those who only qualify for the shrinking triage-track ones. If you want a clearer picture of how different certification paths stack together for this kind of transition, the curriculum overview and FAQ on Forge University's resources page walks through how to sequence that study plan. If you're ready to start now rather than keep reading about it, you can start training and begin building the specific evidence employers are asking to see in interviews.
The Practical Takeaway
None of this means the entry-level SOC job is gone. It means the version of it that only involves watching a queue is worth less than it used to be, and the version that involves judgment over automated output is worth more. The job posting will usually tell you which one you're looking at if you read past the title. Look for language about validating AI output, tuning detections, or operating orchestration tools, and treat its absence as a signal too. A posting that only describes escalation procedures and shift coverage is describing the track that's shrinking in relative value, even while the broader occupation keeps adding jobs.
The honest advice for anyone early in this field is to stop treating "AI skills" as a bullet point to add after everything else and start treating AI governance and verification as a core competency to build alongside the fundamentals. The data from the last year of hiring activity backs that up consistently, across multiple independent studies and job-posting analyses. The title on your next offer letter might still say "SOC Analyst." What determines the salary and the career trajectory behind that title is increasingly which half of the job you can actually do.