Are Security Specialties Turning Into Engineering Jobs? In Detection and Response, Engineer Titles and Language Asks Rose
Abstract
US security job postings, spring 2024 against fall 2026: detection and response postings moved toward engineer titles and programming languages. GRC added automation. Privacy moved toward decision work.
*Written entirely by agents in the Research Factory, within guardrails and controls set by our team. Figures as of 1 October 2026.
1Introduction
Detection and response is the clearest case. In US detection and response job postings, 19% carried an engineer title in spring 2024. At US-headquartered companies in fall 2026, 50% did.
Most other specialties point the same way, with less certainty. Across all 1,038 US security postings in spring 2024, 22% asked for a programming language. Across 4,587 postings at US-headquartered companies in fall 2026, 44% did. GRC postings added automation, and privacy postings moved toward decision work instead.
These findings compare two sources: a public dataset of US postings from spring 2024, and AKA's read of company job boards in 2026. They apply best to US-headquartered companies on modern job boards, which lean toward technology, and less to government, staffing and managed-security firms.
2The answer at a glance
| Finding | Confidence | Representativeness |
|---|---|---|
| Detection and response postings with an engineer title rose from 19% to 50%, and language asks from 18% to 48%. | High. The rise holds at the 74 companies that posted security jobs in both years, so it is not just new companies in the data. It holds with tech companies left out too. That matters because the 2026 data leans toward tech. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
| Postings with an engineer title also rose in identity and access, from 41% to 65%, and where no specialty is named, from 42% to 61%. | Medium. Clear across all postings. At the 74 companies that posted in both years, there are too few of these postings to be sure, so new companies in the data could explain part of it. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
| Governance, risk and compliance (GRC) postings with an engineer title rose from 4% to 24%. Those asking for automation rose from 18% to 47%. | High for engineer titles: holds at the 74 companies that posted in both years, and with tech companies left out. Medium for automation: at those 74 companies, too few postings to be sure. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
| Vulnerability management and threat intelligence also point toward engineering, though each had few postings in 2024. | Medium that both move toward engineering. Low on how far: only 22 and 13 postings in 2024, so the size of the change could be far off. Needs a larger 2024 sample. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
| Application security (AppSec) postings that name AI terms went from almost none to 41%. A change in AppSec engineer titles is too close to call. | High for AI terms: a rise from almost none is too large to be chance in which postings we read. Low for engineer titles: already 81% in 2024, and the change is too small to be sure. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
| Architecture postings asking for a programming language rose from 10% to 25%. A change in how many are mainly about making decisions is too close to call. | Medium for programming languages: clear overall, but not with tech companies left out, so tech companies may drive it. Low for making decisions: too close to be sure. Needs a larger sample. | Medium for programming languages: best fit is US employers that lean toward tech. Low for making decisions: part of the move comes from which companies are in each year's data. |
| Privacy postings mainly about making decisions rose from 0% to 19%. A change in engineering asks is too close to call. | Medium for making decisions: a clear rise, but from only 20 postings in 2024. Low for engineering asks: 20 postings in 2024 are too few to tell. Needs a larger 2024 sample. | Low. One specialty with only 20 postings in 2024, too few to speak for privacy roles broadly. |
| In detection and response, postings where the hire mainly does the technical work went from 76% to 74%. The change is too close to call. | Low. The share could have moved by up to 12 points either way, too wide to call. Needs a larger sample. | Medium. Best fit: US employers that lean toward tech. Less certain for government, staffing and managed-security firms. |
3The numbers by specialty
Selected specialties, spring 2024 against fall 2026. Each cell is the share of that specialty's postings. "Engineer title" means the title contains engineer or developer. Postings in specialties not shown make up the rest of the totals.
| Specialty | Postings, 2024 → 2026 | Engineer title | Asks for a programming language | Asks for automation | Names a certification |
|---|---|---|---|---|---|
| Detection and response | 74 → 484 | 19% → 50% | 18% → 48% | 42% → 67% | 51% → 36% |
| Identity and access | 64 → 148 | 41% → 65% | 30% → 45% | 33% → 71% | 13% → 36% |
| Vulnerability management | 22 → 86 | 27% → 50% | 23% → 44% | 32% → 71% | 36% → 51% |
| Threat intelligence | 13 → 58 | 0% → 34% | 0% → 38% | 23% → 66% | 23% → 22% |
| No specialty named (security analyst or engineer) | 340 → 1,128 | 42% → 61% | 21% → 42% | 26% → 53% | 40% → 33% |
| GRC | 137 → 309 | 4% → 24% | 3% → 15% | 18% → 47% | 68% → 53% |
| AppSec | 85 → 730 | 81% → 87% | 62% → 65% | 59% → 63% | 28% → 19% |
| Cloud security | 31 → 173 | 68% → 78% | 35% → 52% | 45% → 75% | 19% → 30% |
| Architecture | 81 → 232 | 2% → 13% | 10% → 25% | 21% → 44% | 41% → 48% |
| Privacy | 20 → 101 | 25% → 45% | 40% → 25% | 55% → 35% | 20% → 16% |
| All security postings | 1,038 → 4,587 | 34% → 58% | 22% → 44% |
Source: AKA Security analysis of 1,038 US security postings from a public job-postings dataset (listed 5 to 19 April 2024) and 4,587 postings at US-headquartered companies in AKA's job-board data (open on or after 23 September 2026). The all-postings engineer title share is from the same postings and the same title rule. Specialties not shown make up the rest of the totals, so the all-postings row is not a sum of the rows above.
4Language asks rose at most levels
Across all US security postings, the share asking for a programming language rose from 22% in spring 2024 to 44% in fall 2026. The range of likely values for that change is +18 to +26 points.
The 2026 postings lean more senior. Senior individual contributor titles were 26% of US security postings in 2024 and 47% in 2026. Held to the 2024 mix of levels, the 2026 share of US security postings asking for a language is 42%, against 44% unadjusted.
| Level | Postings, 2024 → 2026 | Asks for a programming language, 2024 → 2026 | Range of likely values, points |
|---|---|---|---|
| Executive | 39 → 245 | 8% → 16% | −4 to +18 |
| Manager | 80 → 310 | 9% → 20% | +3 to +20 |
| Senior individual contributor | 274 → 2,146 | 27% → 51% | +17 to +30 |
| Individual contributor | 645 → 1,886 | 22% → 43% | +16 to +26 |
Source: AKA Security analysis of 1,038 US security postings (April 2024) and 4,587 postings at US-headquartered companies (fall 2026).
Bars show each range of likely values against zero (dashed). Solid: the whole range is above or below zero. Grey: it ends at zero. Hollow: it includes zero.
The rise is clear for manager, senior individual contributor and individual contributor titles. For executive titles, the range includes zero, so a change is too close to call.
This finding is rated Medium. Among the 74 companies with postings in both years, language asks went from 32% to 42%, and that range, −4 to +23 points, includes zero.
5Detection and response postings ask for engineering
In US detection and response postings, the share with an engineer title rose from 19% in spring 2024 to 50% in fall 2026. The range of likely values is +20 to +41 points.
In the same postings, asks for a programming language rose from 18% to 48%, and asks for automation from 42% to 67%. Detection and response postings naming a certification fell from 51% to 36%.
The rise holds outside technology companies, though it is smaller there. In 2026 detection and response postings outside technology companies, engineer titles reached 39%, against 20% in 2024 postings without staffing firms and government contractors. At the same companies in both years, engineer titles went from 15% to 53%.
Language asks rose more than asks to code. Asks to code or do software engineering rose from 18% to 30% of detection and response postings. That rise is likely but borderline. The language rise was larger than the coding rise, by a range of +6 to +30 points.
Detection and response postings naming AI terms, such as LLM, generative AI, agents and prompt injection, rose from 1% to 25%.
6Identity and postings with no specialty named moved the same way
In US identity and access postings, the share with an engineer title rose from 41% in spring 2024 to 65% in fall 2026. The range of likely values is +8 to +40 points. Identity postings asking for automation rose from 33% to 71%.
Identity is the one specialty here where certification asks rose, from 13% to 36% of postings.
The identity finding is rated Medium. Outside technology companies, identity engineer titles went from 42% to 55%, and the range includes zero. At the same companies, they went from 33% to 73%, and that range includes zero too.
Among postings with no specialty named, titled security analyst or engineer, the share with an engineer title rose from 42% in 2024 to 61% in 2026. The range is +13 to +27 points. Asks for automation in these postings rose from 26% to 53%.
That rise holds outside technology companies at about the same size: 41% to 59%. At the same companies, engineer titles in these postings went from 48% to 50%, so a change there is too close to call. That is why this finding is Medium.
7Vulnerability management and threat intelligence point the same way
In US vulnerability management postings, the share with an engineer title went from 27% in spring 2024 to 50% in fall 2026. The range of likely values, −1 to +44 points, just includes zero. The 2024 base is 22 postings.
Vulnerability management postings asking for automation rose from 32% to 71%, a clear rise with a range of +15 to +61 points.
In US threat intelligence postings, the share with an engineer title went from 0% in 2024 to 34% in 2026. The range is +22 to +47 points, on a 2024 base of 13 postings.
Both are rated Medium on direction because each 2024 base is under 30 postings. The size of each change is rated Low, because the ranges are 45 and 25 points wide.
8GRC postings ask for automation and carry engineer titles
In US GRC postings, the share with an engineer title rose from 4% in spring 2024 to 24% in fall 2026. The range of likely values is +14 to +26 points. The rise holds outside technology companies (4% to 20%) and at the same companies (0% to 27%).
GRC postings asking for automation rose from 18% to 47%. That finding is rated Medium, because at the same companies the change, 23% to 31%, is too close to call.
GRC postings asking for a programming language went from 3% to 15%. In 2026 that is well under the 44% of all security postings. GRC postings naming a certification fell from 68% to 53%.
9AppSec postings added AI terms
In US AppSec postings, the share naming AI terms went from 0% in spring 2024 to 41% in fall 2026. The range of likely values is +35 to +46 points.
AppSec postings already asked for engineering in 2024. In 2024, 81% carried an engineer title and 62% asked for a programming language. In 2026 the figures were 87% and 65%, and both changes are too close to call.
AppSec postings naming a certification went from 28% to 19%. The range, −20 to +2 points, includes zero, so that change is too close to call too.
In US cloud security postings, the engineer title share went from 68% to 78%, a change too close to call. Cloud security postings asking for automation rose from 45% to 75%, a clear rise with a range of +9 to +49 points.
10Architecture postings name a language more often
In US architecture postings, the share asking for a programming language rose from 10% in spring 2024 to 25% in fall 2026. The range of likely values is +5 to +25 points.
The finding is rated Medium. Outside technology companies, architecture language asks went from 12% to 19%, and that change is too close to call.
Architecture postings with deciding as the main activity went from 20% to 31%. The range, −1 to +24 points, includes zero, so the change is too close to call. In 2026, deciding was the main activity in 8% of detection and response postings and 12% of AppSec postings.
11Privacy postings shift toward decision work
In US privacy postings, the share with deciding as the main activity rose from 0% in spring 2024 to 19% in fall 2026. The range of likely values is +12 to +27 points. Each of the two hosted models found a clear rise on its own.
Privacy postings naming AI policy, risk or compliance duties rose from 0% to 24%. Privacy postings where the hire mainly does the technical work fell from 90% to 65%.
For engineering, a change is too close to call. Privacy postings asking for a programming language went from 40% to 25%, and the range, −41 to +8 points, includes zero. The 2024 base is 20 postings from 18 companies.
12A change in the amount of hands-on work is too close to call
Three AI models read each posting and judged whether the hire mainly does the technical work personally. The answer used is the one at least two of them agree on.
In US detection and response postings, 76% were mainly hands-on in spring 2024 and 74% in fall 2026. The range of likely values, −12 to +10 points, includes zero, so a change is too close to call.
| Specialty | Postings, 2024 → 2026 | Mainly hands-on, 2024 → 2026 | Range of likely values, points |
|---|---|---|---|
| Detection and response | 74 → 484 | 76% → 74% | −12 to +10 |
| Vulnerability management | 22 → 86 | 77% → 69% | −28 to +13 |
| Identity and access | 64 → 148 | 75% → 61% | −27 to 0 |
| No specialty named (security analyst or engineer) | 340 → 1,128 | 89% → 85% | −8 to +1 |
| GRC | 137 → 309 | 68% → 67% | −12 to +10 |
| AppSec | 85 → 730 | 85% → 79% | −13 to +3 |
| Cloud security | 31 → 173 | 90% → 77% | −25 to 0 |
| Architecture | 81 → 232 | 69% → 64% | −18 to +9 |
| Privacy | 20 → 101 | 90% → 65% | −42 to −3 |
Source: AKA Security analysis of 1,038 US security postings (April 2024) and 4,587 postings at US-headquartered companies (fall 2026), read by three AI models.
Bars show each range of likely values against zero (dashed). Solid: the whole range is above or below zero. Grey: it ends at zero. Hollow: it includes zero.
Privacy is the only specialty in the table with a clear fall in mainly hands-on postings.
13Where the data comes from
The 2024 postings come from a public job-postings dataset: 1,038 US security postings from 680 companies, listed 5 to 19 April 2024. The 2026 postings come from AKA's daily read of company job boards: 4,587 postings from 831 US-headquartered companies, open on or after 23 September 2026.
The two years match on country but not on exact definition. 2024 is US by job location, and 2026 is US by company headquarters. Both went through the same rules for title level, specialty and description terms.
A posting counts when its title passes the series' security title rules, a local model rules it a security role, and it carries a description. Only one posting per title per company counts. Job aggregators are left out in both years, as are physical security, fraud, and trust and safety roles. Staffing firms are included: 166 postings in 2024 and 145 in 2026.
Until the evening of 21 September 2026, the job-board collector skipped titles containing analyst, auditor, consultant, CISO, director, head of, specialist and "manager, security". Postings that closed before then lean toward engineer titles, so the 2026 side is limited to postings open on or after 23 September 2026.
Each range of likely values is the 95% range for the change, found by redrawing whole companies at random many times. A range that includes zero means the change cannot be told from no change.
On 1 October 2026 the daily read covered 220,747 postings, of which 15,163 were security postings, from 2,537 companies.
14How this answer was stress-tested
| Test | What it found |
|---|---|
| Scope check of every posting. A local model read all 1,405 postings in 2024 and 5,196 in 2026 that pass the title rules. | It ruled 26% of 2024 postings and 12% of 2026 postings not security roles, such as financial auditors, physical security, alarm installers and lawyers. With them removed, 2024 detection and response automation asks went from 28% to 42%. |
| Title rules against a separate model. 192 titles labelled blind across both years. | Level agreement at a kappa of 0.975, specialty agreement at 0.76. |
| Description length. 2026 descriptions are 60% longer. | Every language comparison was repeated on postings of 3,000 to 6,000 characters. Across all security postings, language asks went from 25% to 41%, the same direction and 5 points smaller. |
| Same companies. The 74 companies with postings in both years. | Language asks across all postings went from 32% to 42%, a change too close to call. GRC and detection and response engineer titles rose here too. |
| Staffing firms and government contractors removed. Left out of both years. | Language asks across all postings went from 22% to 45%, the same direction and about the same size. |
| Outside technology companies. 2026 postings outside technology companies against 2024 without staffing firms and government contractors. | Detection and response and GRC engineer titles rose, smaller by 12 and 4 points. Identity engineer titles and architecture language asks show no clear change. |
| Held to the 2024 level mix. | The 2026 share asking for a language is 42%, against 44% unadjusted. |
| Two hosted models on both years. Each read all 5,625 postings. | They agree with each other on hands-on work at a kappa of 0.74, main activity at 0.79 and people management at 0.93. Each one alone finds no clear change in detection and response hands-on work. |
| Local model against the hosted models. The same labeller on both years. | Agreement on hands-on work is 0.56 and 0.63, on main activity 0.68 and 0.68, and on people management 0.76 and 0.77. |
15What would strengthen this answer
| Test | What it would settle | Why it has not run |
|---|---|---|
| A second 2026 sample collected the way the 2024 one was | Whether the difference between the two data sources drives the change | |
| Licensed longitudinal postings data | Year-by-year specialty shares from 2019, with seasonality | |
| A re-read of the same collection in three to six months | A direct trend under stable collection | |
| A practitioner read of 100 specialty postings |
Acknowledgements
Question asked by Jamie Dicken.
References
- [1]AKA Security Research Factory. Security Hiring Research: What Job Postings Say About Security Work. AKA Security, 2026. akasecurity.io/research/security-hiring-research
Cite as
@techreport{aka-rz-2026-01,
title = {Are Security Specialties Turning Into Engineering Jobs? In Detection and Response, Engineer Titles and Language Asks Rose},
author = {{AKA Security Research Factory}},
institution = {AKA Security},
type = {Research report},
number = {AKA-RZ:2610.01v1},
version = {1.1.3},
year = {2026},
month = oct,
url = {https://akasecurity.io/research/security-specialties-engineering-jobs}
}