Will AI Steal My Job? · Role analysis

Cybersecurity
Analyst

O*NET 15-1212.00 ESCO: Information security analysts

Changing

Cybersecurity analysts protect organisations' computer systems, networks, and data from threats, attacks, and breaches. They monitor security systems, investigate incidents, conduct vulnerability assessments, implement security controls, and respond to active threats — working at the intersection of technical expertise and adversarial thinking to keep organisations secure.

Section 01

Task Map

Task	AI impact	Why
Monitor security alerts and triage incidents	🟡 Changing	SIEM platforms and AI-powered security tools auto-correlate and prioritise alerts, dramatically reducing noise. But deciding which alerts represent genuine threats requires human judgment about context and attacker intent.
Conduct vulnerability assessments and penetration testing	🟡 Changing	Automated scanning tools find known vulnerabilities quickly, but understanding their exploitability in a specific environment and chaining vulnerabilities creatively to demonstrate real risk requires skilled human attackers.
Investigate security incidents and analyse forensic evidence	🟡 Changing	AI assists with log analysis and pattern recognition, but reconstructing an attacker's path through a network, understanding their objectives, and preserving forensic integrity requires experienced analyst judgment.
Write security reports and document findings	🟡 Changing	AI tools draft technical report sections well, but the judgment about what findings matter most, how to present risk to different audiences, and what remediation to recommend requires professional experience.
Manage and configure security tools and platforms	🟡 Changing	Security orchestration platforms automate many configuration tasks, but tuning detection rules, managing exceptions, and integrating new data sources into complex environments requires deep technical expertise.
Develop and maintain security policies and frameworks	🟡 Changing	AI can draft policy text and map controls to frameworks, but designing security governance that fits the organisation's risk appetite, culture, and regulatory obligations requires business and legal understanding.
Respond to live security incidents and coordinate containment	🟢 Safe	Incident response under pressure — containing an active breach, communicating with leadership, coordinating remediation across teams, and making real-time risk decisions — is irreducibly human crisis management work.
Conduct security awareness training and advise stakeholders	🟢 Safe	Building a security culture — persuading colleagues, training non-technical staff, and advising executives on security risk — requires human communication, trust, and the ability to translate technical threat into business consequence.

Section 02

What Stays Human

Adversarial thinking and threat intelligence Effective security requires thinking like an attacker — anticipating novel attack paths, understanding attacker motivation, and recognising when normal activity is actually malicious. This creative, adversarial reasoning is a human skill that automated tools can assist but cannot replicate.
Incident command and crisis decision-making When an organisation is under active attack, someone must make fast decisions under incomplete information — what to isolate, what to preserve, when to escalate, and how to communicate. This is high-stakes leadership under pressure that demands human accountability.
Security culture and stakeholder trust The security professional who earns the trust of colleagues, explains risk to boards, and builds an organisation's security culture is providing influence and leadership that no automated system can deliver. Security is ultimately a people problem as much as a technical one.

Section 03

What to Do Next

Develop offensive security skills alongside defensive ones. Penetration testers and red team professionals who can actively find and exploit vulnerabilities — rather than just monitor for them — command significantly higher salaries and are in strong demand. OSCP (Offensive Security Certified Professional) is the industry benchmark certification for this specialisation.
Build cloud security expertise. As organisations move to cloud, cloud security engineering (securing AWS, Azure, and GCP environments) is the fastest-growing security specialism. AWS Security Specialty, Azure Security Engineer (AZ-500), and the CCSP are high-value credentials that complement traditional security skills.
Specialise in AI security — both securing AI systems and using AI as a security tool. Understanding how to detect AI-powered attacks (deepfakes, AI-generated phishing), secure LLM applications, and use AI tools to accelerate threat hunting puts you at the frontier of the security field. This intersection is genuinely new territory with significant career advantage.

Sources: O*NET Online (onetonline.org) · ESCO (esco.ec.europa.eu) · All task data cross-referenced against O*NET occupation profiles. This analysis uses task-level exposure, not occupation-level prediction.

CybersecurityAnalyst

Task Map

What Stays Human

What to Do Next

Cybersecurity
Analyst