Cybersecurity careers today need rethinking.
In one aspect, cybersecurity can be considered as a Tom and Jerry episode, with attackers perpetually plotting like Tom and defenders (mostly) staying ahead like Jerry. In this cat and mouse game, attackers evolve their methods, forcing defenders to respond, and both sides use increasingly sophisticated tools. In recent years, artificial intelligence (AI) has altered this dynamic, boosting the capabilities on both sides.
For those early in their cybersecurity careers, it can be daunting to navigate these new waters. A cybersecurity career trajectory is rarely linear, and you likely will stumble upon many roles along the way.
Take my journey as an example: I started as a software developer, moved into ethical hacking, and later worked as an application security consultant. Eventually, I specialized in cloud security at AWS and grew into a security leader and architect role. While working at Amazon provided valuable experiences, it was the mix of diverse roles – some planned, others by chance – and continuous learning that truly shaped my path.
If you’re just starting out or planning to switch to cybersecurity, this blog post will share insights on how to pursue or upgrade a cybersecurity career in the age of AI.
AI as a Force Multiplier
But first, let’s get on the same page with the AI vs. humans debate.
AI excels at doing the tedious work of data analysis, which is invaluable in cybersecurity, where detecting a malicious pattern among billions of daily network events is a fundamental challenge. However, human oversight remains essential, as AI can produce false positives, miss new tactics, hallucinate, show bias, or create privacy risks – to name a few issues.
As a result, the cybersecurity careers of tomorrow will require professionals who not only understand how to leverage AI but can also interpret their outputs and apply human intuition where it matters most.
Cybersecurity Careers 2.0
Here are some common cybersecurity roles and how to re-think them, keeping AI in mind.
BUILD: Security Engineers and Architects
Engineers build; architects design. AI accelerates many aspects of security engineering with LLM code generation capabilities. In practice, a security architect defines and designs how systems are fortified, and engineers roll out those defenses at scale.
Skilling up with AI:
- Understand AI/ML concepts, including supervised and unsupervised learning, neural networks and natural language processing.
- Practice system design and threat modeling of AI architectures and applications.
- Learn in depth about AI related risks like OWASP Top 10 for LLMs.
- For engineers, become proficient with AI-specific libraries like TensorFlow or PyTorch.
OPERATE: SecOps and Governance
Governance sets the security policies that shape an organization’s risk posture, while Security Operations (SecOps) executes them. AI augments these capabilities by automating repetitive tasks and identifying abuse patterns across vast data. Imagine a system that sends over endless lines of data and flags suspicious anomalies for your team to review. Human judgment is still critical, but AI’s supercharged assistance is helpful.
Skilling up with AI:
- Become proficient in scripting (like Bash, Powershell, and Python).
- Learn to query and analyze large datasets (Big Data and SQL).
- Familiarity with a log analysis tools like Elastic Stack (ELK).
ASSESS: Risk and Compliance Specialist
No business wants to get slapped with fines or lawsuits. Risk management identifies and addresses technical and operational threats, while compliance ensures adherence to legal frameworks like GDPR and HIPAA. AI accelerates risk detection and compliance monitoring, helping organizations navigate regulatory requirements while maintaining strong security posture.
Skilling up with AI:
- Stay in the know with frameworks like NIST AI Risk Management Framework (RMF) 1.0, ISO 42001, and HITRUST AI RMF.
- Run tabletop exercises to practice mapping business and compliance goals with AI risk scenarios.
- Learn about the basics of AI-related risks.
ASSESS: AI Privacy Specialist
Privacy specialists ensure data is collected, stored and processed ethically and lawfully. AI poses both an opportunity—through automated data classification or anonymization—and a compliance headache when it comes to large-scale data processing or potential bias in algorithms.
Skilling up with AI:
- Have a deep understanding of privacy principles like transparency, data minimization and purpose limitation.
- Learn about differential privacy, federated learning or homomorphic encryption. These approaches let you extract insights from data without compromising personal information.
RESPOND: Incident Responders and Digital Forensic expert
Security incident responders are the digital firefighters: investigating, containing and remediating breaches. AI tools provide rapid alerts, and human expertise drives urgent decisions and coordination. Digital forensics focuses on post-incident investigations, preserving evidence, reconstructing timelines and ensuring a solid chain of custody.
Skilling up with AI:
- Learn how AI automates triage, threat prioritization and remediation.
- Deploy behavioral analytics to detect insider threats or advanced persistent threats (APTs).
- Automate repetitive tasks like alert triage, ticket generation and resource allocation.
ATTACK: Ethical Hacker (Red, Blue and Purple Teams)
Red Teams emulate real attackers; Blue Teams fortify defenses; Purple Teams encourage collaboration between the two. AI can automate vulnerability scanning for the Red side and ramp up threat detection for the Blue side. But the creative and adaptive thinking of an ethical hacker remains essential since AI alone can’t replicate human ingenuity (and luck!) that identifies novel issues.
Skilling up with AI:
- Understand AI/ML concepts, including supervised and unsupervised learning, neural networks, and natural language processing.
- Learn in depth about AI-related risks like OWASP Top 10 for LLMs
- Practice the art of prompt injection and bypassing input validation controls in LLMs.
Skating to Where the Puck is Going
Ice hockey legend Wayne Gretzky famously said, “I skate to where the puck is going to be, not where it has been.” The same applies to cybersecurity in the age of AI. It’s not enough to rely on old methods; you have to anticipate how AI will reshape threats, tools and industry trends. By building a deep understanding of AI and integrating it into your chosen specialty, you’ll stay ahead.
Coming back to our Tom & Jerry analogy, Tom (the attacker) has loaded his arsenal with AI – now it is your turn to defend, Jerry!
Editor’s note: Explore ISACA’s AI training resources here:
Author’s note: The views, opinions, and conclusions expressed in this post are solely those of the author and do not reflect the views or policies of any current or former employer.
About the author: Aditya Patel is a cybersecurity leader and architect (currently at AWS) with 15+ years of experience in information security, cloud architecture, and machine learning, specializes in secure, scalable solutions with a focus on AI safety, LLM security, and compliance. With a master’s in cybersecurity from Johns Hopkins and a bachelor's in computer science from India, he has contributed to security research and shares insights through public speaking and his blog (secwale.com). Linkedin: https://www.linkedin.com/in/adityarpatel/
