■ MODERATE RISK ■ Technology
AI will replace the alert-triage grind that defines entry-level security work, but not the analyst profession — mostly because the attackers have AI too, and an arms race is a jobs program.
“AI detects threats in microseconds. Your coffee-fueled log reviews were quaint.”
Our AI replacement risk score — how we score jobs
A SOC analyst's day is a queue: SIEM alerts fire, and the analyst decides which of the hundreds are noise and which one is a breach in progress. That means pivoting through logs, checking a hash against threat intel, tracing a weird PowerShell invocation back to either an admin's laziness or an intruder's foothold, writing up incidents, and tuning detection rules so tomorrow's queue is slightly less awful. Higher tiers do threat hunting, incident response, and the political work of convincing the business to patch things.
Tier-1 triage is the most automatable job in the security building, and vendors know it. AI-driven SOC platforms now correlate alerts, enrich them with context, auto-close obvious false positives, and draft incident summaries — the exact task stack of a junior analyst. Agentic tools are starting to run investigation playbooks end to end: pull the endpoint data, check the intel feeds, isolate the host, open the ticket. The entry-level rung where analysts traditionally learned the craft is being sawed off, which is the real disruption story here.
Yet the field's fundamentals point at more security work, not less. Attackers are using the same models to scale phishing, find vulnerabilities, and mutate malware, so defense volume keeps rising. Novel intrusions — the ones that matter — don't match playbooks; they need an investigator with intuition about how systems and humans fail. Someone accountable must make the 2 a.m. call to shut down production, brief executives mid-breach, and own the risk decisions auditors will later dissect. The profession has run a persistent talent shortage for years; AI is closing the gap from below while demand grows from above. Our 34 lands on: junior roles compress hard, the discipline endures.
Automatability: our editorial assessment of current and near-term AI capability
This is happening now: AI triage and agentic investigation tools are deploying across SOCs, and tier-1 analyst hiring is visibly tightening this decade. By 2030 the classic alert-queue job will be mostly machine work with humans supervising. Mid-level and senior roles — incident command, threat hunting, detection engineering — stay in demand and likely grow, because AI-armed attackers guarantee the workload. The squeeze is concentrated at the entry rung.
Yes — arguably better at the senior levels, harder at the bottom. AI is absorbing alert triage, which was the traditional entry job, so breaking in now takes more initiative: labs, certifications, detection-engineering projects. But total security work is growing because attackers use AI too. Incident response, threat hunting, and risk leadership remain deeply human and chronically understaffed.
It's replacing a tier, not a profession. Tier-1 triage — the repetitive judgment of 'real or false positive' — is exactly what current AI does well, and platforms increasingly close routine alerts autonomously. What remains human: novel intrusions that match no playbook, containment decisions with business consequences, and accountability when the auditors arrive. Analysts move up the stack or out.
Enter at a different angle. Employers still need people who can build detections, automate playbooks, and secure cloud and identity systems — skills you can demonstrate through home labs, open-source contributions, and CTFs rather than years of alert triage. Adjacent routes (IT ops, software engineering, then a security pivot) also work well. Show you can supervise the machines, not compete with them.
Detection engineering and automation (writing what the AI runs), cloud and identity security (where the breaches are), incident command (making calls under fire), and communication (translating technical risk for executives and regulators). Add familiarity with AI-specific threats — model abuse, prompt injection, AI-generated phishing — since defending AI systems is itself a growth specialty.