Most jobs AI Doomsday tracks face a simple pressure: AI does the task faster and cheaper, so fewer people are needed to do it. Cybersecurity engineering runs the equation differently. AI is compressing some of the work, secure code review, vulnerability discovery, first-pass threat modeling, while simultaneously generating an enormous new volume of the exact problem the job exists to solve. The profession is not shrinking under automation pressure. It is being asked to keep up with a threat surface that AI itself is expanding.
The displacement risk is classified as Moderate, with a horizon toward 2034. That sits between the Low-risk trades, protected by physical presence, and the more exposed knowledge-work roles where routine tasks dominate. Security engineering has both: real automatable surface area in code scanning and exploit discovery, and a deep core of architectural judgment, threat prioritization, and adversarial reasoning that current AI systems do not reliably perform.
The distinct part of this story is what makes cybersecurity engineering different from a Cybersecurity Analyst role, which sits at a similar Moderate, Medium-term classification but for a different reason. Analysts monitor and triage, tasks AI automates well. Engineers build and defend the systems underneath, and AI is currently doing at least as much to complicate that job as it is to simplify it.
Key Points
- Cybersecurity engineers are rated Moderate risk with a displacement horizon toward 2034, distinct from the Cybersecurity Analyst role which AI automates more directly through SOC alert triage.
- A Stanford-affiliated empirical study found that roughly 40% of code generated by GitHub Copilot in real projects contained exploitable security vulnerabilities, creating new remediation work rather than reducing it.
- Agentic AI penetration testing has moved from experimental to competitive: XBOW, an autonomous pentesting platform, reached the #1 ranking on HackerOne ahead of roughly 100 human red teamers, submitting over 1,000 vulnerabilities.
- AI-assisted tools like Snyk DeepCode AI and GitHub Copilot Autofix are cutting remediation time for known vulnerability classes, but validating and chaining complex, business-logic-level exploits still requires an engineer.
- (ISC)²'s 2025 workforce study found 59% of security professionals report critical or significant skills shortages, with application security and risk assessment, core engineering competencies, among the most acute gaps.
What a Cybersecurity Engineer Actually Does
The role sits upstream of incident response. Where a security analyst monitors systems that are already running, an engineer designs, builds, and hardens the systems in the first place: secure architecture, access control models, encryption strategy, network segmentation, and the security review of code before it ships. Engineers write threat models that anticipate how a system could be attacked before it exists in production, conduct penetration tests against their own infrastructure, and build the tooling that lets smaller teams defend larger attack surfaces.
It is, structurally, a design and construction job wearing a defensive posture. The output is not a report on what went wrong. It is a system built so that less goes wrong in the first place, and a documented, tested plan for the parts that will eventually fail anyway.
What AI Is Already Doing
On the defensive side, AI-assisted code scanning has become genuinely useful. Snyk's DeepCode AI scans across 19-plus languages using a model trained on more than 25 million data-flow cases, and its automated fixes reportedly cut remediation time by roughly 84% at comparable accuracy. GitHub's Copilot Autofix, during its beta, let developers resolve flagged security alerts more than three times faster by surfacing a suggested fix directly inside the pull request. Semgrep AI pairs deterministic static analysis with AI-driven review for the harder class of business-logic vulnerabilities that pattern-matching alone tends to miss.
On the offensive side, agentic AI has moved from research demo to production tool faster than almost anyone in the field expected. XBOW, an autonomous penetration-testing platform, reached the number one ranking on HackerOne's leaderboard, ahead of roughly 100 human red teamers, after submitting more than 1,000 vulnerabilities, including 54 rated critical. The platform raised $75 million in funding on the strength of that result and is now deployed at major banks and technology firms. It does not replace a penetration tester's judgment. It replaces the exhaustive, parallel search across an attack surface that used to take a human team weeks.
THE VIBE-CODING PROBLEM
A peer-reviewed empirical study of Copilot-generated code found that roughly 40% of the programs it produced across real GitHub projects contained security vulnerabilities, SQL injection through string concatenation, hardcoded credentials, unsafe deserialization, at higher rates in some languages than others. AI is not just automating the search for vulnerabilities. In the same organizations, it is quietly generating new ones faster than most teams can review them.
That inversion is closely connected to what we covered in our look at AI code generation leaking API keys and secrets: the same tools accelerating development are introducing failure modes that did not exist when code was written, reviewed, and shipped more slowly by hand. Someone has to find and fix what the AI wrote, and increasingly, that someone is using AI to do it. Not every AI-assisted vulnerability discovery story is about weaponized code, either. Claude Code recently surfaced a Linux kernel vulnerability that had gone undetected for 23 years, a reminder that the same pattern-matching capability cuts both ways.
Where Engineering Judgment Still Holds
The Moderate classification, rather than Low or High, reflects a genuine split in the job. Vulnerability discovery at scale, the exhaustive, repetitive search across a large attack surface, is exactly the kind of structured, high-volume task that AI performs well, and XBOW's HackerOne result proves it at a level that would have sounded implausible three years ago.
But architecture is a different problem. Deciding how a system should be segmented, which trust boundaries actually matter for a specific business, how to weigh a security control against the cost it imposes on legitimate users, and how to chain a set of individually low-severity findings into a realistic attack path, these require a model of the organization, not just the code. OWASP's threat-modeling frameworks for agentic and multi-agent systems exist precisely because this judgment does not yet transfer cleanly to automated tools, even as those same tools get better at the mechanical parts of the search.
The Labor Market Reality
The U.S. Bureau of Labor Statistics projects employment for information security analysts, the closest official category to this role, to grow 29% from 2024 to 2034, one of the fastest growth rates the agency tracks, adding roughly 16,000 openings a year. (ISC)²'s 2025 Cybersecurity Workforce Study, surveying more than 16,000 professionals, found 59% reporting critical or significant skills shortages, up sharply from 44% the year before, with application security and risk assessment, core engineering disciplines, named among the most acute gaps. Notably, the study's framing has shifted from a raw headcount deficit toward a skills deficit: the constraint is not open positions, it is qualified engineers to fill them.
Gartner's own forecast anticipates AI driving roughly half of cybersecurity incident-response effort by 2028, up from about 5% in 2024, but frames it explicitly as augmentation of analyst-tier work, not replacement of engineering roles. The firm's guidance to CISOs on redesigning security jobs for the AI era anticipates new titles emerging, AI security engineer, AI governance and threat analysis, rather than the engineering function shrinking.
How to Use AI as a Cybersecurity Engineer Now
The engineers getting the most out of these tools are not treating AI output as trusted by default in either direction, offense or defense.
For code review: tools like Snyk DeepCode AI and Copilot Autofix are a fast first pass, not a sign-off. Given that AI-generated code itself carries an elevated vulnerability rate, the review discipline has to get stricter, not looser, as more of the codebase is AI-authored.
For offensive testing: agentic platforms like XBOW are genuinely useful for exhaustive discovery across a large attack surface. The engineering value add moves toward triaging what they find, validating exploitability, and deciding what actually matters to the business, rather than running the scan by hand.
For architecture and threat modeling: use AI to draft an initial STRIDE-style model or enumerate attack surface faster, then apply the organizational context, what this system actually protects, who can realistically attack it, what a breach actually costs, that no current model reliably supplies on its own.
What I Think
The 2034 horizon feels reasonable to me, maybe even generous to the optimists. What makes this profession genuinely different from most on this list is that the automation pressure and the demand growth are coming from the same source at the same time. Most jobs AI threatens are being automated by a technology that has no other effect on their workload. AI is automating pieces of cybersecurity engineering while also expanding the total amount of code, infrastructure, and attack surface the profession has to defend, at a pace that outstrips the automation gains.
What concerns me is not that this job disappears. It is that the skills gap (ISC)² documents, 59% of the field reporting shortages in exactly the engineering disciplines that resist automation, means the organizations most exposed to AI-generated vulnerabilities are also the ones least likely to have the senior engineering judgment on staff to catch them. The tools are getting better on both sides of this fight. The people capable of using them well remain the actual bottleneck, and that bottleneck is not closing at the same rate the code is being written.
Cybersecurity engineering is not a job AI is quietly eliminating. It is a job AI is quietly making bigger, faster than the workforce trained to do it is growing.
"AI can write the code in seconds and find the exploit in minutes. It still takes an engineer to decide which of the thousand things it just found is the one that will actually get the company breached."