No recession, and no waiting it out: the change reshaping cybersecurity work

Part two of three, for working practitioners. As of spring 2026 there is no recession on the official data: payrolls are still growing and joblessness among technologists remains low. The fear is rational anyway, because what is reshaping cyber work is the technology cycle rather than the business cycle, and you cannot wait that out the way you waited out 2002 or 2009. Here are the three forces converging at once, what the data does and does not support, and where the next two years most plausibly lead.

The mistake is thinking you can wait this out.

It is a reasonable mistake, because every prior technology bust rewarded exactly that. The dot-com crash and the 2008 recession both passed, and the work came back roughly as it had been; the seasoned move was always patience. The first article in this series showed why patience is only half the answer this time. The cyber job market is dividing, not shrinking, with employment at or near a record and practitioner unemployment below the national rate, even as the entry tier closes to a crack. It ended on the distinction this article exists to defend: the field will recover from any ordinary downturn, as it always has, but the way into it may not, because this episode carries something the dot-com and 2008 corrections did not. A structural change that does not reverse when the business cycle turns.

That is the source of the fear running through the profession right now, and the fear is not irrational. But it is widely misdiagnosed. People are bracing for a recession. What they are living through is a transition, a reallocation of work happening underneath a still-growing economy and driven by three forces arriving at once. The difference is one of time horizon, not just severity: a recession is a cyclical dip that eventually passes and puts the old jobs back, while a transition changes the composition of the work itself and does not reverse when the cycle turns. That difference is the whole of why this feels worse than the numbers, taken alone, would suggest, and why "wait it out" is the wrong instinct.

The deeper mistake is still believing in the old bargain: train on your own, certify on your own, apply into the funnel, and wait for the market to recognize you. That bargain was sold as meritocracy. In practice it depended on an entry tier wide enough to absorb the unproven, and that tier is narrowing. The institutions that sold the bargain have been slow to admit what changed, which is part of why so many people did everything they were told and still hit a wall.

A word about the numbers, before we lean on any

This article rests partly on federal data, and that data should not be treated as scripture. The statistical agencies are strained: the numbers are shakier than they used to be, and a sitting administration fired the head of the Bureau of Labor Statistics in 2025 over a weak jobs report it called rigged, with no evidence shown. If you distrust the official figures, you are right to.

So this piece does not hang any conclusion on a single government print. The direction of travel here shows up in several different places: the federal labor series, private posting data, vendor filings, and recruiters' own books. No single source carries the argument alone. And note which way the revisions have run: mostly cutting in the direction this article worries about, showing the labor market to have been weaker than the monthly prints first suggested, not stronger.

And there is a larger separation to make before any of these numbers mean anything. "The economy is growing" is a statement about aggregate output. It is not a statement about whether the people reading this can pay their rent, and increasingly it has nothing to say about them at all. The aggregates have come apart from the lived reality, and the headlines are built to miss the gap.

Start with pay, because it is the cleanest. Through early 2026 real wages were not just lagging inflation; they were falling. In the first quarter, most measures of inflation-adjusted pay declined, and average hourly earnings for production and nonsupervisory workers, the working-class cut rather than the executive average, fell for the first time since 2022. Wage growth has trailed inflation in every month since. For a cyber professional this shows up in a specific and bitter form: the new job, when it comes, often pays less than the old one did, so that "re-employed" and "made whole" are no longer the same thing.

Then the unemployment rate, read the way the financial press reads it, is worse than incomplete. The headline rate "fell" to 4.3% in early 2026, which sounds like recovery. It was not. Employment fell by 64,000 that month and the labor force shrank by nearly 400,000; the rate dropped because people stopped being counted, not because they found work. The broader measure that includes the underemployed and the discouraged rose to 8%. Nearly five million people are working part time because they cannot find full-time work. A quarter of the unemployed have been jobless for more than six months, and there are no longer any federal emergency extensions, so when regular benefits run out, nothing replaces them. The senior practitioner who exhausted her benefits and now drives for Uber between contracts may still appear in the official story. She just appears in a category that hides what happened to her professional life.

This is the mechanism behind the disconnect. The gains of a growing economy are routing to the top while the instruments keep measuring the average, so GDP can rise in the same quarter the median worker gets poorer. For the working professional, what matters is the distance between the index and the rent, and no number that reports "expansion" reaches inside that distance. This article uses the official figures where they hold up, but it does not mistake them for the experience of the people it is written for. When the data says one thing and everyone you know says another, the burden is on the data to explain itself. In cybersecurity, that explanation begins with the difference between a field that is still growing and an on-ramp that is being dismantled.

A correction that is not a recession

Begin by clearing the ground of the worst fear, because the data does not support it. As of spring 2026 the United States is not in a recession. The April employment report showed payrolls still expanding, by 115,000 jobs, with national unemployment at 4.3%, and the Bureau of Economic Analysis's second estimate put first-quarter real GDP growth at a 1.6% annual rate. By the two markers that define a recession, output and employment, the economy was still growing. Anyone telling cyber professionals that a 2008-scale collapse is upon us is not reading the data.

And yet the labor market is plainly weaker than those headlines imply, in two ways that matter. The first is that the headline figures keep being revised down hard: a recent benchmark revision lowered the prior year's payroll level by roughly 900,000 jobs, meaning the labor market through that span was materially cooler than the monthly prints had said. The second, and the one that bears directly on this audience, is that technology did not benefit from even the modest growth. Employment in IT and computing occupations has fallen since early 2021, on the order of a hundred thousand jobs by analyses of the federal data, while the wider economy added millions. The economy is growing and technology hiring is not. What technologists face is something other than a shared downturn: a reallocation concentrated in their part of the labor market, occurring while the rest of the economy expands around them.

That is the precise shape of the thing, and it explains the disquiet. It is less the sky falling than the floor shifting, slowly, unevenly, and in a direction that does not reverse when the next quarter's GDP print comes in positive.

The first force: the state retreats

The most concrete of the three forces is the contraction of the federal government, which for decades has been both a major direct employer of security talent and one of the profession's important training grounds.

The cuts have been severe and are documented. The Cybersecurity and Infrastructure Security Agency, the government's central cyber-defense body, is set to fall from about 3,292 employees toward 2,324 under the 2026 budget, a reduction near a third, and independent reporting already describes a one-third reduction in place with a vacancy rate near 40% in key mission areas. Across the federal workforce as a whole, departures have run past 386,000. The geographic signature is unmistakable. The Washington-Arlington-Alexandria metro, the densest concentration of cyber employment in the country, lost about 103,900 jobs in the year to January 2026, the largest year-over-year employment decline of any major U.S. metro, with regional analysts attributing roughly 62,100 of those losses to federal cuts.

The effect on the labor market is double, and both halves push the same way. The federal government has stopped being the dependable absorber and training ground it was for cyber talent; even as CISA now moves to claw back a few hundred "mission critical" hires, a year of buyouts and cuts removed seats directly. The cyber-specific cut is CISA; the broader federal contraction matters because it hits the region and the institutions that have long supplied security talent, not because every departure is a security professional. With that caution in place, some of the experienced people who leave federal service enter the private market looking for work, adding pressure at the senior end rather than opening seats at the bottom. A force that hollows out a training ground while adding to the experienced end of the pool is, for a newcomer, doubly unkind.

The second force: the SOC automates the on-ramp

The second force is aimed straight at the entry tier, and it is the reason the on-ramp may not come back in its old form. Several security vendors are cutting staff while reorganizing around AI, and a few have named AI directly. Others are cutting for older reasons, including acquisition overlap. The distinction matters.

The pattern is real, though not yet clean enough to treat as a single-cause story. CrowdStrike cut about 500 roles in 2025 and tied the move, in a securities filing, to AI "flattening" its hiring curve. Arctic Wolf cut roughly 250 in May 2026 while redirecting investment toward what it calls an agentic security operations center, software that triages and responds with limited human involvement. Other large vendor reductions in the same period are harder to classify: Palo Alto's cut of roughly 500 came the day after it closed a $25 billion acquisition of CyberArk and fell on overlapping sales and back-office roles, the ordinary overlap-trimming of a merger rather than automation. And in the Arctic Wolf case, at least, the cuts appear to have fallen mostly on sales, product, and marketing, not on SOC analysts directly. So the honest reading is narrower than "AI is replacing the SOC," though it still points one way: vendors are building the agentic SOC as both a product and an operating model, and the work it is designed to absorb is procedural operations, the alert-triage analyst watching a queue and the tier-one responder running a playbook. That is the classic on-ramp, and it is the work a capable automation targets first.

The independent posting data is consistent with that reading, though it does not prove it on its own. A specialist cyber-recruiting firm, analyzing three years of its own job-posting data, found the three largest role categories, security engineer, security analyst, and DevSecOps, declining year after year, and its own chief technology officer attributed the decline to an industry-wide shift toward AI-powered security automation. A recruiter has commercial reasons to present the market as active, so an admission that automation is thinning major categories deserves attention. It is not proof, but it is not nothing. The safe inference is a measured one. Security engineering and DevSecOps are not tier-one work, so the data does not show the entry rung alone shrinking; what it shows is the largest procedural and operations-adjacent categories under pressure while governance, legal, and specialized-judgment roles rise. The forward estimates point toward redesign rather than simple disappearance: Gartner expects generative AI to remove the need for specialized education from half of entry-level cybersecurity positions by 2028, a different entry model rather than necessarily half as many entry jobs. Whatever the precise figure, the risk is no longer theoretical, and it points at the on-ramp.

The third force: the whole of technology reorganizes around AI

The third force is the largest and the least cyber-specific, which is exactly why it matters here. The entire technology sector is reorganizing itself around artificial intelligence, and security is living inside that larger event rather than experiencing one of its own.

The shape is familiar from the headlines. One of the largest social-media companies cut around 8,000 roles in May 2026; the largest technology firms are spending into the hundreds of billions of dollars a year, by analyst estimates, building AI infrastructure and recouping it in part by restructuring their workforces around the tools they are building. The most telling evidence is demographic rather than a layoff: Stanford's digital-economy group found a 16% relative decline in employment for early-career workers in the most AI-exposed occupations, and a nearly 20% fall for software developers aged 22 to 25 from their late-2022 peak, even as employment for developers over 30 in the same AI-exposed work grew. The displacement falls unevenly, concentrated at the bottom on the youngest and least experienced, the same age-and-seniority signature visible in cyber.

The lesson a cyber professional should draw is uncomfortable and clarifying at once. The pressure on the entry tier comes from the automation of procedure, and that pressure runs across all of technology, not cybersecurity alone. That is why the instinct to flee security for some safer corner of tech is suspect: general software development, the usual escape route, has been hit at least as hard, its job postings sitting below their pre-pandemic baseline while security's remain above, and there are fewer adjacent rooms to run to than the old career advice assumes. The reckoning with that fact is the third article's business.

What the next two years most plausibly hold

What comes next is a matter of odds, not prophecy. Three scenarios cover the plausible range over the next two years, and they should be held as odds, not certainties.

The base case, and the most likely at roughly even-or-better odds, is a slow grind with no recession. The economy keeps expanding modestly, aggregate cyber employment keeps rising on its long structural trend, and the division described in the first article persists or deepens. Senior, judgment-heavy, and AI-adjacent roles stay in demand. The squeeze on the entry tier does not ease, because the force squeezing it is structural rather than cyclical. If nothing breaks, this is where the present data points.

The downside case, and a serious one at perhaps a one-in-three chance, is a correction driven by the AI build-out itself. If the enormous capital spending on AI infrastructure fails to produce the returns investors expect, that spending unwinds, taking a great deal of technology hiring with it. One major forecaster's downside scenario has national unemployment reaching 6.5% by 2028. In that world the cyclical and structural pressures arrive together, and even the resilient senior tier feels it. This is not the base case, but it is too plausible to wave away.

The upside case, less likely at perhaps one in six but real, is that AI makes security cheaper to deliver and so expands the total amount of security work organizations can afford, with demand broadening faster than automation displaces, lifting even some early-career hiring, though not necessarily in the old tier-one SOC shape. It has happened in other automated fields. It cannot be ruled out here.

The one thing that does not depend on the scenario

Across all three scenarios, one conclusion holds, and it is the thing to plan around. The prudent planning assumption is that the tier-one security-operations role, the manual alert-triage seat that has been the field's principal entry point for fifteen years, does not return in its old form. In the base case it is automated steadily. In the downside it is cut and then automated. In the upside the new demand arrives at a higher rung than the one being automated. No branch of the forecast brings the old on-ramp back as it was, because the work it consisted of is being absorbed by software rather than paused by a cycle.

No fact in this series matters more for planning. It is also why the first article's distinction matters so much: a recession would put the ladder back when it passed, while this transition has sawn off the bottom rung and rebuilt it higher. The question for every practitioner, whether entering, holding on, or deciding whether to move, is therefore not "how do I wait this out," because it cannot be waited out. The question is what to do instead.

You cannot wait it out. You can navigate it.

The fear in the profession has earned a straight answer instead of reassurance. The data does not show a recession: the economy is growing and practitioner unemployment remains low. It does not show the ordinary downturn the optimists describe either. What it shows is a transition, propelled by three forces that arrived together: a state in retreat, an operations center that increasingly automates its own entry work, and a technology sector reorganizing wholesale around AI. None of the three reverses with the business cycle, which is why this feels like the ground moving rather than the weather changing. The feeling is accurate.

You cannot wait that out. You can navigate it, and the difference between those two is the entire subject of the final article. Navigation comes down to decisions: whether to stay in the field, what to do if you do, whether to hold the job you have, what to learn, and what to make of the honest possibility that the entry job some people trained for will not exist in the form they were promised.

The answer is better evidence, rather than another promise that the market will notice you eventually. If the old on-ramp was built around credentials, keyword screens, and hope, the next one has to be built around demonstrated capability: work roles, judgment, evidence, and trust. The market has plenty of people; what it lacks is proof it knows how to read.

Those decisions, answered directly, come next. Each of them turns on showing proof of what you can do, rather than waiting to be noticed.

Source notes

On the gap between aggregates and lived reality: real pay declined on most measures in Q1 2026, with average hourly earnings for production and nonsupervisory workers falling for the first time since 2022 (Hamilton Project analysis of BLS data; USAFacts, showing wage growth trailing inflation every month since April 2026). Labor underutilization: the headline U-3 rate fell in early 2026 as the labor force shrank by nearly 400,000 and participation declined, while U-6 rose to 8% (BLS, Employment Situation, 2026); ~4.9 million working part time for economic reasons; long-term unemployed at ~25% of the jobless; no active federal emergency unemployment extensions as of 2026 (U.S. Department of Labor).

On the reliability of federal data: the August 2025 firing of the BLS Commissioner after a disputed jobs report; multi-year real-terms budget cuts at BLS; and large benchmark and monthly revisions to payroll employment (BLS Current Employment Statistics, 2026). Federal figures below are used only where private data points the same way.

U.S. Bureau of Labor Statistics, Employment Situation, April 2026 (payrolls +115,000, national unemployment 4.3%); benchmark revision lowering the prior-year payroll level by roughly 900,000 (CES, 2026); U.S. Bureau of Economic Analysis, GDP, Second Estimate, First Quarter 2026 (real GDP +1.6% annual rate, revised down 0.4 point from the advance estimate).

BLS-derived analyses of IT and computing occupational employment showing decline since early 2021 (e.g., CompTIA Tech Jobs Report analysis of BLS data); U.S. BLS metropolitan-area employment (Washington-Arlington-Alexandria metro down about 103,900 jobs in the year to January 2026, the largest decline of any major U.S. metro); Metropolitan Washington Council of Governments analysis of BLS data (~62,100 federal jobs lost over the same period).

Federal workforce contraction: CISA projected to fall from 3,292 to 2,324 employees under the FY2026 budget, a reduction near a third, with independent reporting (Washington Post analysis, late 2025) describing a one-third reduction already in place and a vacancy rate near 40% in key mission areas; >386,000 federal departures across the workforce.

Security-vendor reductions: CrowdStrike (~500, 2025, citing AI that "flattens" its hiring curve); Palo Alto Networks / CyberArk (~500, the day after the $25bn acquisition closed, an overlap reduction, not automation); Arctic Wolf (~250, May 2026, redirecting investment to an agentic SOC; cuts mostly in sales, product, and marketing).

CyberSN, U.S. Cybersecurity Job Posting Data Report (year-over-year declines in the security-engineer, security-analyst, and DevSecOps categories; CTO's attribution to an industry-wide shift toward AI-powered security automation). Methodology caution: CyberSN's posting-tracking window shortened from 45 to 30 days in 2023, which overstates declines.

Broad AI restructuring: a major social-media firm (~8,000, May 2026); hyperscaler AI capital-spending estimates running into the hundreds of billions in 2026 (analyst estimates); Stanford Digital Economy Lab, Canaries in the Coal Mine? (2025): a 16% relative employment decline for early-career workers (ages 22–25) in the most AI-exposed occupations, and a nearly 20% decline for software developers aged 22–25 from their late-2022 peak, while experienced developers in AI-exposed roles grew.

Forecasts: Gartner (generative AI will remove the need for specialized education from 50% of entry-level cybersecurity positions by 2028); Deloitte US Economic Forecast downside scenario (national unemployment reaching 6.5% by 2028).

Aramis assesses cybersecurity candidates against NICE Framework Work Roles. This is the second of a three-part series, with an epilogue, on the divided job market and what to do about it; part three turns to the decisions a practitioner now has to make.

P.S. The series so far: the prologue, "Cyber's Career Chasm," is here: https://www.linkedin.com/pulse/cybers-career-chasm-project-aramis-dkuoc. Subscribe to Skill:Signal:Trust for each morning's edition, and follow Aramis on LinkedIn for the rest.