Stay or go, what to learn, what to prove: five direct answers for cybersecurity practitioners

Part three of three, for working practitioners. Direct answers to the five questions the field's cheerful advice keeps avoiding: stay or go, hold the job or look, what to learn when half the work is being commoditized, and whether, for some, the thing they invested in is ending. One principle ties the answers together, and it decides which side of the divide a career lands on.

The first two articles in this series argued that the cybersecurity job market is dividing rather than collapsing, and that the division is driven by a structural transition rather than the business cycle, one that cannot be waited out. They ended on a turn: the old bargain, train and certify and wait to be recognized, has broken, and the new one will be built on proof. This is the payoff: what to do, and what to prove.

It is also the hardest to write, because the subject has moved from data to decisions, and real people are making them right now under real fear. A great deal of the advice circulating in the field is a disservice to those people: it answers every question with "learn AI and upskill," which is true, useless on its own, and faintly insulting to someone who has just sent out a hundred applications. The five questions below deserve direct answers. Here they are. And the answers rest on a single principle, worth stating at the top because it is the tool that makes all five cohere and outlasts any specific instruction.

The principle that decides everything

AI commoditizes codified procedure: the how-to that is written down, repeatable, and gradeable. It also cheapens many inputs to judgment, the summarizing, the option-generating, the pattern-spotting, the first-draft risk language. What it does not commoditize is accountable judgment under uncertainty: the human act of deciding in context, bearing the consequence, and being trusted to do it again. That distinction is where the career divide now runs.

The posting data drawn on throughout this series is that principle rendered as a chart. The roles under the most pressure are the ones with the highest procedural content: operate the tool, watch the queue, run the playbook, write the boilerplate. The roles with the clearest tailwind are the ones where judgment and accountability are hardest to remove. In one specialist recruiter's three-year dataset, the single fastest-rising role of all, up more than 40% in a year, was the cybersecurity and privacy attorney, and the firm attributed the surge to regulatory pressure: breach-disclosure rules and expanded enforcement creating demand for people who can be held responsible. That points at the deepest form of the principle. You cannot depose a language model. You cannot put it on a witness stand. You cannot make it answer to a regulator or a board; you can only make a person or institution answer for how it was used. Accountability is structurally human, because the entire purpose of accountability is that a human bears it. Regulation manufactures demand for accountable humans faster than any technology can automate it away, which is why the governance and legal end of security is the part growing most reliably while the manual-operations end is the part being absorbed.

Hold that principle in mind, and the five decisions become clearer.

Decision one: stay in cybersecurity, or leave it

If you already have a foothold, stay and move. If you do not, stop trying to enter through the door that is closing. Either way, stop treating "cybersecurity" as one thing, because the answer is different for the half that is rising and the half being automated. The right instruction is narrower than "double down on cyber": double down on the part of cyber that requires irreducible human judgment, and get out of the part that does not. For most people who already have a foothold and some room to maneuver, that means staying in the field and moving within it rather than leaving.

The reason not to flee the field altogether is the finding from the second article: the usual escape route, general software development, is not obviously safer, since its youngest workers are seeing employment fall while security postings remain above their pre-pandemic baseline. Leaving cyber for general software work can mean running toward the fire, not away from it. The automation pressure is a procedure problem that runs across technology, not cybersecurity alone. Cyber, with its regulatory tailwind and its permanent, adapting adversary, is among the better-defended places in technology to be standing, provided you are standing in the right part of it.

Decision two: for those who stay, what to do

Move up the value chain, deliberately and now, toward the work the rising roles describe. In practice that means becoming one of four things: the person who translates technical risk into a decision an executive can make and answer for; the person who works at the governance and regulatory layer where the law requires a human; the person who does the deep, novel-context analysis a model cannot be trusted to close, such as threat intelligence, malware reverse-engineering, incident command under live pressure, and adversarial testing; or the engineer who builds the detections and supervises the automation rather than being the operator the automation replaces. Some of those paths are visible in the posting data, others follow from the direction of the technology. The common feature is the work rather than the job title: judgment, accountability, deep analysis, and the engineering of the systems that absorb procedural operations. The operator seat in the middle, the manual triage and manual checklists and manual testing, is the role the data shows falling, and it is not where to invest another decade.

And then do the thing that matters more than any other right now: build the network and the standing. When postings fall, the job increasingly comes through the room, not the applicant-tracking system. The practitioner who is known, trusted, and visible re-enters from strength; the one who is only a resume re-enters at the back of a very long queue. This is not soft advice. In a contracting-posting market it is the highest-leverage move a person can make, and the labor market is now enforcing it whether or not anyone likes it.

Decision three: hold the job you have, even a bad one?

Default to staying, with one sharp exception, and do not resign into this market without the next thing signed unless staying has become the greater risk.

A held job is worth more in a slow-hiring market than in a hot one. Response rates are low, hiring cycles are long, and the cushion under a voluntary departure is thin. The burden of proof sits with leaving, not staying. For most people in an unpleasant but stable job, the move is to stay employed while improving from within, taking on the higher-tier work above and building the portfolio and the network, so that the next step is chosen rather than forced.

The exception is decisive, and it has to be said plainly: holding a job is not the same as being safe if the job itself is in the tier being automated. A manual-operations seat or checklist-compliance role at a company restructuring around AI is not a refuge from the transition. It is where the transition arrives first, and standing still on it is its own risk. If that is the seat, staying does not mean staying passive. It means staying employed while you move: using the paycheck and the standing to climb to higher ground before the floor goes. Do not mistake current employment for security when the role is precisely the one being absorbed.

Is it a bad time to look? It is a bad time to look casually, since speculative, apply-to-everything searching will mostly meet silence and is corrosive to morale. It is a reasonable time to look strategically: if the move is up a tier, or off a melting role, a targeted search led by demonstrated capability and warm introductions can work even now. The distinction is the whole of it. Hunt with intent and proof, not with volume.

Decision four: what to learn, practice, and show

Set aside "learn AI," which is true and insufficient, and use a sharper rule that follows directly from the principle: learn toward judgment and accountability, away from procedure. The data is that rule made visible: the procedural roles are falling, the judgment-and-governance roles are rising, and the same two faculties that drive the cyber risers, risk assessment and regulatory compliance, turn up independently near the top of the broadest cross-economy ranking of fastest-growing professional skills there is.

What to learn: risk judgment and its translation into business decisions; regulatory and governance fluency, where the market is visibly paying; the security of AI systems themselves, meaning adversarial machine learning, prompt injection, and model and data-pipeline governance, which is both the most-demanded new skill and an attack surface AI itself creates; detection engineering and the supervision of security automation, the safe side of the very trend threatening the operator; and deep specialized analysis where the stakes are high and the context is novel.

What to practice is the work itself, on real and messy problems, producing something you can show: a demonstration, not another certificate. One detection you built and can explain. One access-control test run end to end. One AI red-team case documented. One written risk decision a chief financial officer could act on. Practice the judgment, not the exam.

What to show, and how, is where this matters most, because AI has quietly demoted the credential as a standalone signal. As models get better at producing exam-shaped answers, many certificates weaken as standalone signals: they still have value, especially as filters and thresholds, but too often they attest to knowledge of procedure, the commoditized thing, rather than the judgment employers now need proved. The scarce and legible signal is proof that you can do the judgment work. Show it three ways: by writing and teaching in public, which signals judgment and builds the network in a single motion; by documented real work; and by demonstrated capability measured against the specific roles that are growing rather than the crowded ones most newcomers chase. The meta-instruction is one sentence worth giving anyone who asks: stop asking which tool or certificate to collect, and start asking what a human can be held accountable for that a machine cannot, then learn toward that.

Decision five: is it over, for some?

Here is the answer the field's cheerleaders will not give, and the one this audience most needs precisely because it is uncomfortable. For a meaningful number of people, the specific thing they invested in is contracting, and no amount of "cyber is recession-proof" rhetoric changes that. If a person's market value has been built almost entirely on executing codified procedure, the manual operations, manual triage, manual testing, boilerplate coding, and checklist compliance, then the market for that value is shrinking, and telling them otherwise is a kindness that is really a cruelty, because it leaves them unprepared. That part of the fear is true. It should be named, not soothed.

But "Cybersecurity is ending" is the wrong sentence, and the difference is not academic. What is ending is procedure-execution as a standalone career, not the field and not even cybersecurity, a function being automated across every field at once, in law, in accounting, in customer support, in coding. The worker most at risk in white-collar technology work is defined less by industry than by function: the procedure-executor whose output can be specified, checked, and reproduced. For someone who invested years in this field, the consequence is that the investment is now insufficient on its own, not that it is lost. It requires a second investment, the deliberate climb described in decisions two and four, to stay valuable. For those willing and able to make that climb, the first investment is a foundation, not a stranded asset. For those unwilling or unable, this is a real and painful disruption, and pretending it is merely a passing dip is the false comfort that gets people hurt.

So the answer is neither "everyone is fine" nor "it is over." It is that the field is not ending, though a particular kind of work within it is, and the people whose careers rest on that kind of work face a real choice between climbing and being displaced. The most useful thing anyone can do for them, the thing that separates honest counsel from cheerleading, is to say that plainly and then point at the higher ground, rather than insist the water is not rising.

A disclosure, and where this leaves the tool-builders

Aramis has a commercial interest in this argument. We build a role-based capability-assessment instrument. Discount accordingly. Then look at the market anyway.

The market is shifting its currency from credentials to demonstrated capability, for the reason in decision four: AI has hollowed out the credential as a signal, and proof of judgment is now the scarce thing. There is a revealing gap underneath the rhetoric here. Around 85% of employers say they hire on skills rather than degrees; in a study of 2014 to 2023 hiring, published in 2024, Harvard Business School and the Burning Glass Institute found that when firms actually dropped degree requirements, fewer than one hire in 700 was affected. Skills-first hiring is nearly universal as talk and nearly absent as practice, and the reason is that almost no one has the instrument to execute it, a defensible, role-specific way to measure capability behind the resume. What the market lacks is proof of capability it knows how to read.

A capability assessment against defined work roles is one attempt at that instrument; it is not the only conceivable one. A reader should discount for our interest. The practical point remains testable without taking Aramis on faith: in a market that no longer trusts the credential, the move is to acquire and show proof of capability against the roles that are growing, by whatever honest means.

Climb, or be displaced

This series began with a contradiction, a field that shouts "shortage" while its newcomers hear silence, and it ends with the resolution. The shortage and the silence are the same divided market. The division is a transition that will not pass, not a recession that will. And the transition rewards exactly one thing: the work a human can be held accountable for that a machine cannot.

To the practitioner reading this while out of work, or holding a job and afraid of what is coming: the ground really is moving, and the people telling you it is not are not worth listening to. But the field is not ending. One kind of work within it is, and the instruction, the only honest one, is to climb: off the procedural rung that is being automated, toward the judgment, the accountability, the deep analysis, and the trust that are not. That climb is hard, and for some it will be the hardest professional thing they have done. It is also possible, and it is more possible for someone who can see the shape of the change clearly than for someone who cannot. Seeing it clearly was the entire purpose of these three articles. What to do with it is now a decision, and the decision belongs to the reader. The old bargain was patience. The new one is proof. Start building it tomorrow.

Source notes

CyberSN, U.S. Cybersecurity Job Posting Data Report, 2022–2024 (2025): the cybersecurity/privacy attorney as the fastest-rising role (≈+40.7% year-over-year), with leadership attributing it to regulatory pressure (SEC breach reporting, FTC enforcement); the broad split between falling operator roles and rising judgment/governance roles. Methodology caution carried from part two: the posting-tracking window shortened from 45 to 30 days in July 2023, overstating declines and understating increases.

LinkedIn Economic Graph, Skills on the Rise 2025 (regulatory compliance and risk assessment among the fastest-growing cross-economy professional skills) and Skills-First: Reimagining the Labor Market (88% of hirers acknowledge screening out skilled candidates for lacking conventional credentials; technical and AI roles gain most under skills-based search).

Skills-based-hiring say-do gap: Harvard Business School & The Burning Glass Institute (fewer than 1 in 700 actual hires affected by degree-requirement removal despite ~85% of employers claiming skills-first hiring; skills-based selection markedly more predictive of performance than credential-based selection).

Labor-market and AI context carried from parts one and two: U.S. BLS (occupation at record employment; practitioner unemployment below the national 4.3%; ~29% projected occupational growth to 2034); Indeed Hiring Lab (security postings above their pre-pandemic baseline while software postings sit below); Stanford Digital Economy Lab (a 16% relative employment decline for early-career workers in the most AI-exposed occupations; developers aged 22–25 down ~20% from their late-2022 peak). Full citations appear in the source notes to parts one and two.

Aramis assesses cybersecurity candidates against NICE Framework Work Roles. This is the third article in the series on the divided cybersecurity job market and what to do about it. An epilogue, "The Horizon," looks at where the field goes from here.

P.S. The series so far: the prologue, "Cyber's Career Chasm," is here: https://www.linkedin.com/pulse/cybers-career-chasm-project-aramis-dkuoc. Subscribe to Skill:Signal:Trust for each morning's edition, and follow Aramis on LinkedIn.