The SOC isn’t shrinking. It’s being rebuilt.
We read more than 1,000 security job postings in full. This is the SOC your peers are staffing.
The biggest job in the SOC is building the SOC
Security operations engineers are the largest role family in the dataset: 134 postings, one in five. The classic queue seat, the SOC analyst, is fourth at 10%. It is also the least AI-touched and lowest-paid family in the dataset, with a hands-on AI ask in just 9% of its postings against 42% in automation engineering.
Now light up everyone who builds
Add up the engineering families: SecOps, detection, automation, AI security, and architecture. Together they are 247 postings, 37% of the dataset. Leadership is another 14%. The market is paying people to construct automated operations and to run the rebuild.
Roughly three builders for every analyst
247 engineering-family postings against 68 analyst postings. For every seat watching the queue, security teams are hiring about three people to shrink it.
One posting in four asks for hands-on AI
Each square is 1% of postings. 22.7% carry an active AI or automation requirement. 67% contain no AI language of any kind, in 2026, at the peak of the AI SOC news cycle. The market is barbelled, with remarkably little middle.
One in nine is already agentic-era
76 postings describe building, operating, or validating AI-driven security operations. The employers include AstraZeneca, Eaton, Peloton and Raymond James. Pharma, industrial manufacturing, wealth management, dental insurance, e-commerce. The 2026 SANS SOC Survey calls this an anticipated role. The postings say it is here.
Money is flowing up the build stack
Median advertised pay runs $125k for the analyst seat, $142k to $161k for the engineers who build what replaces the queue, and $180k for the leaders running the rebuild. The market pays a premium of roughly $17k to $36k to move from watching to building.
The platforms just entered the labor market
Seven of 665 postings name an AI SOC or AI-automation platform in their requirements, about 1%. A number that small dates the exact moment a category entered the hiring record. Torq appears three times, once in a role titled “Sr. TORQ/SOAR Engineer”. Prophet, Dropzone, Microsoft Security Copilot and D3 appear once each. If the pattern holds, platform experience becomes a requirement line the way SIEM names are today.
The median posting names eight tools
77% of postings name five or more tools. 18% explicitly require fluency across two or more core SIEM/EDR platforms. Whatever consolidation vendors promise, the hiring record shows teams paying for humans who can move across sprawling stacks.
The way in is down to a crack
Entry-level roles are 39 postings, 5.9% of the dataset. The enterprise entry job is migrating to the engineer track, and the zero-experience triage seat survives mainly at MSSPs and MDR providers, often on overnight shifts, $60k to $83k and near $32 an hour at the national junior average.
“A company selling the autonomous SOC runs a tiered human analyst organization to validate its agents.” The labor market’s most honest finding. Full story in the SOC Rebuild Index.
Read the job postings, not the predictions
Get the SOC Rebuild Index: 2026 Edition. Every figure, the methodology, the pay gradient, and the agentic-era job descriptions arriving well beyond Silicon Valley.
- The seven questions to ask of any AI SOC platform, or of your own staffing plan
- The full role-mix and compensation data, coded from 665 in-scope US postings
- The agentic-era job descriptions at mainstream enterprises, quoted
- Every stat, verified and ready for your board deck
View the data behind these charts
| Measure | Value |
|---|---|
| Role family share: SecOps engineer / IR / leadership / analyst | 20% / 16% / 14% / 10% |
| Engineering-family postings vs SOC analyst postings | 247 vs 68 (~3:1) |
| AI ask: agentic-era / hands-on required / preferred / none | 11.4% / 22.7% total hands-on / 10% / 67% |
| Pay gradient (median midpoints): analyst / SecOps / hunter-responder / automation / detection / architect / leadership | $125k / $142k / $148k–$151k / $152k / $161k / $175k / $180k |
| AI ask by family: automation eng. / detection eng. / incident response / triage analyst | 42% / 31% / 17% / 9% |
| AI security engineer postings, a title family new in 18 months | 25 |
| Postings naming an AI SOC platform | 7 of 665 (1%) |
| Tools per posting: median / naming 5+ / naming 8+ / requiring 2+ SIEM-EDR | 8 / 77% / 55% / 18% |
| Threat hunting: listed duty / staffed title | 38% / 8% |
| Detections-as-code: all postings / SOC analyst postings | 31% / 46% |
| Entry-level postings | 39 (5.9%) |
Scope. US postings only, collected August 2026, deduplicated, read in full and coded against a fixed rubric. Out of scope: SOC 2 compliance and GRC, physical security operations centers, IT and SRE incident response, legal breach response, and intelligence-community analysis. Posting share is not headcount share, and pay medians reflect only the postings that disclose ranges. Full methodology and limitations in the Index.
Every figure above, plus the rest of the coded set, the methodology, and quoted job descriptions. Get the SOC Rebuild Index.