Future History
Role profile

Information Security Engineers

What the work involves today, which AI tools are picking up which tasks, where the human edge still is, and the natural directions this role can grow. Every datapoint below is cited.

What's changing in your day

Three parts of your work where AI is already doing real lifting, and what stays yours.

AI is sitting alongside you hereManage vulnerability remediation programs — using AI-powered exposure management platforms (Microsoft Defender CSPM, Tenable One ExposureAI) to prioritize findings by real-world exploitability and attack-path impact, then coordinating fix ownership across engineering teams and tracking remediation SLAs against compliance requirements.

Manage vulnerability remediation programs — using AI-powered exposure management platforms (Microsoft Defender CSPM, Tenable One ExposureAI) to prioritize findings by real-world exploitability and attack-path impact, then coordinating fix ownership across engineering teams and tracking remediation SLAs against compliance requirements.[13],[14],[2]

Tools picking this up
Where your edge is

Own the remediation prioritization logic, not just the tool output: AI exposure management platforms rank findings by CVSS + threat intelligence, but deciding which critical vulnerability to defer during a code freeze, which finding to accept with a compensating control, and how to communicate residual risk to the board requires human judgment with regulatory and business accountability.

AI is sitting alongside you hereEmbed application security (AppSec) controls into CI/CD pipelines — configuring Snyk AI and GitHub Advanced Security with Copilot Autofix to scan every pull request for SAST, SCA, secrets, and IaC vulnerabilities at PR time, reviewing AI-generated remediation suggestions, and owning the security gate policy that determines which findings block deployments.

Embed application security (AppSec) controls into CI/CD pipelines — configuring Snyk AI and GitHub Advanced Security with Copilot Autofix to scan every pull request for SAST, SCA, secrets, and IaC vulnerabilities at PR time, reviewing AI-generated remediation suggestions, and owning the security gate policy that determines which findings block deployments.[4],[3],[10]

Tools picking this up
Where your edge is

Own the security gate architecture, not just the tool configuration: define which finding severities block deployment vs. require tracked exemptions, build the false-positive triage process, and develop the developer education program that reduces the upstream defect rate. Copilot Autofix handles ~two-thirds of fix suggestions autonomously; your value is in setting the policies and reviewing the edge cases it cannot resolve.

AI is sitting alongside you hereDefine and enforce security baselines across infrastructure and software supply chain — specifying hardening standards (CIS Benchmarks, NIST SP 800-53), reviewing IaC modules for security compliance using AI-assisted policy scanners (Checkov, tfsec, Semgrep), and maintaining SBOM inventories to track third-party dependency risk in production systems.

Define and enforce security baselines across infrastructure and software supply chain — specifying hardening standards (CIS Benchmarks, NIST SP 800-53), reviewing IaC modules for security compliance using AI-assisted policy scanners (Checkov, tfsec, Semgrep), and maintaining SBOM inventories to track third-party dependency risk in production systems.[15],[16],[1]

Tools picking this up
Where your edge is

Own the policy architecture behind the scanner: define which CIS controls are mandatory vs. compensable in your environment, build the exception-tracking workflow, and maintain the SBOM strategy. AI tools scan accurately against known baselines; the baseline itself — what counts as acceptable risk for your organization — is a human policy decision with audit and compliance implications.

Where this role is heading

Natural next steps for someone with your foundation: not exits, evolutions.

A direction you could grow

Computer and Information Systems Managers

Senior security engineers who accumulate cross-functional incident command experience, vendor management authority, and the ability to communicate security risk in business language are well-positioned for security management and CISO-track roles. BLS projects +15% growth for Computer and Information Systems Managers through 2034 with median wages of $171,200. The 2026 market specifically demands security managers who can set AI-tool adoption strategy (CrowdStrike Charlotte AI, Cortex XSIAM, Security Copilot) and govern the organization's growing AI-security surface — skills that emerge directly from a security engineering background.

What you'd add
  • · Security governance and compliance: CISM or CISSP-ISSMP, board-level security reporting, NIST AI RMF
  • · Budget management: security tooling licensing, headcount planning, CapEx/OpEx for CNAPP/XDR platforms
  • · AI-tool adoption strategy: evaluating Charlotte AI, Cortex XSIAM, and Wiz for organizational ROI and governance guardrails
  • · Regulatory fluency: SOC 2 Type II, ISO 27001, DORA, HIPAA, PCI-DSS — what each requires from the engineering team
  • · Executive communication: translating breach risk, attack-surface metrics, and remediation progress into C-suite and board language
What it takesA real upskill, but a natural one
Sources

Sources

Every claim on this page traces back to one of the following. Updated 2026-06-21.

  1. [1]O*NET 30.3 — Information Security Engineers (15-1299.05)· accessed 2026-05-24
  2. [2]ISC2 2025 Cybersecurity Workforce Study — 3.4M global shortage, AI-skills premium, 73% believe AI drives more demand for specialized cyber skills· accessed 2026-05-24
  3. [3]Snyk — Gartner Magic Quadrant Leader 2025 for Application Security Testing; Snyk AI covers SAST, SCA, IaC, secrets, and container scanning end-to-end· accessed 2026-05-24
  4. [4]GitHub — Copilot Autofix remediates ~two-thirds of suggested code fixes without human edits (2025 GA); integrated with GitHub Advanced Security· accessed 2026-06-21
  5. [5]Wiz — SecOps Agent investigates cloud threats and delivers AI-driven verdicts; Issues Agent routes remediation to the right owner; AI-SPM secures AI pipelines· accessed 2026-05-24
  6. [6]Microsoft Security Copilot — Exposure Management with AI attack-path analysis, Security Analyst Agent for deep multi-step investigation across Defender and Sentinel· accessed 2026-05-24
  7. [7]Okta AI Threat Protection + Identity Security Posture Management — AI detects anomalous authentication patterns, lateral movement, and mis-provisioned identities· accessed 2026-06-21
  8. [8]HiddenLayer — Model Security Platform detects adversarial ML attacks, scans LLMs for prompt injection and data poisoning vulnerabilities (2024-2025)· accessed 2026-06-21
  9. [9]Dark Reading — 64% of 2026 security job postings require AI, ML, or automation skills; security engineers commanding AI-fluency premiums· accessed 2026-05-24
  10. [10]Endor Labs — AI-powered reachability analysis filters SCA noise; GitHub-native; Series B May 2025· accessed 2026-06-21
  11. [11]Mandiant M-Trends 2026 — Frontline investigation data; attack surface expansion from AI deployment and agentic tooling creates new security engineering requirements· accessed 2026-05-24
  12. [12]Eloundou et al. 2024 — GPTs are GPTs (Science)· accessed 2026-05-24
  13. [13]Microsoft — Defender CSPM Exposure Management uses AI attack-path analysis to prioritize cloud misconfigurations by actual blast radius and exploitability (2025)· accessed 2026-05-24
  14. [14]Tenable One ExposureAI — natural-language remediation guidance and attack-path analysis; VPR cuts actionable patch list by 40-50% vs. raw CVSS sorting· accessed 2026-05-24
  15. [15]Snyk — IaC scanning detects Terraform, CloudFormation, Helm, and Kubernetes misconfigurations at PR time; integrated with GitHub Advanced Security and Copilot Autofix· accessed 2026-05-24
  16. [16]GitHub Advanced Security — secret scanning, dependency review, and SBOM export now GA; Copilot Autofix extends to IaC and dependency vulnerabilities (2025)· accessed 2026-05-24

We add the full two-century time machine to the highest-interest roles first. Browse every role →