How will AI impact Cybersecurity jobs?

Based on recent, credible research (2024–2026) from leading sources such as PwC, McKinsey, Microsoft, OpenAI, Goldman Sachs, academic studies, gartner, sans insitute , and peer-reviewed papers, conduct a deep, evidence-based analysis of the likelihood that the following cybersecurity jobs will be impacted or replaced by AI over the next 3-5 years.

For each job, provide:

- AI Risk Rating: a score from 1–10 (10 = highest risk)
- Clear Explanation (2–4 sentences): why this role has this risk level, grounded in real AI capabilities and limitations
- Key Risk Factors: bullet points covering task automation, AI tool exposure, and cost pressures
- What AI is LEAST likely to replace: human strengths that protect the role
- Evidence & Sources (VERY IMPORTANT): cite specific, verifiable studies or reports only - do NOT hallucinate
- Confidence Level: Low / Medium / Medium–High / High (based on strength of available evidence)


[
  { "id": "soc-analyst",              "title": "SOC Analyst",                                          "description": "First line of defence in a Security Operations Centre, monitoring SIEM alerts, triaging events, and escalating confirmed incidents. Typically tiered (L1 triage, L2 investigation, L3 threat hunting).Common entry point into blue-team careers." },
  { "id": "dfir",                     "title": "Digital Forensics and Incident Response (DFIR)",        "description": "Investigates breaches end-to-end: containment, evidence acquisition, forensic imaging, timeline reconstruction, and root-cause analysis. Blends host/network forensics with live incident handling. " },
  { "id": "pen-tester",               "title": "Penetration Tester / Ethical Hacker",                  "description": "Simulates real-world attacks against networks, apps, and infrastructure through scoped, time-boxed assessments to find exploitable weaknesses before adversaries do — the recognised baseline offensive security role. Delivers findings with remediation guidance." },
  { "id": "red-teamer",               "title": "Red Teamer",                                           "description": "Conducts full-scope, objective-driven adversary emulation across people, process, and technology — stealth and evasion matter as much as access. Distinct from pen testing by its goals, secrecy, and breadth." },
  { "id": "bug-bounty",               "title": "Bug Bounty Hunter",                                    "description": "Independently hunts vulnerabilities in live targets through public and private bounty programmes, rewarded per valid finding — a merit-based engagement model rather than a salaried role." },
  { "id": "vuln-management",          "title": "Vulnerability Management Analyst",                     "description": "Runs the continuous defensive cycle of discovering, prioritising, and driving remediation of vulnerabilities across the estate. Blue-team role focused on systematically reducing attack surface." },
  { "id": "security-architect",       "title": "Security Architect",                                   "description": "Designs the security of systems, networks, and cloud environments from the ground up, defining controls, reference architectures, and standards. Senior, design-led role balancing risk, business needs, and technical control." },
  { "id": "detection-engineer",       "title": "Detection and Response Engineer",                      "description": "Builds and tunes the detections that fire in the SOC — writing rules, queries, and automation to catch adversary behaviour with high fidelity. Bridges engineering and threat detection." },
  { "id": "security-researcher",      "title": "Security Researcher",                                  "description": "Discovers new vulnerabilities, studies attacker techniques, and advances defensive or offensive knowledge — often publishing findings, CVEs" },
  { "id": "ciso",                     "title": "CISO",                                                 "description": "Chief Information Security Officer — the executive owning enterprise security strategy, risk posture, budget, and board-level reporting. Translates cyber risk into business terms and leads the security function." },
  { "id": "threat-intel",             "title": "Threat Intelligence Analyst",                          "description": "Tracks threat actors, campaigns, and TTPs, turning raw intelligence into actionable insight for defenders and leadership." },
  { "id": "grc-analyst",              "title": "GRC Analyst",                                          "description": "Governance, Risk, and Compliance — ensures the organisation meets regulatory, contractual, and internal security requirements. The bridge between security operations and business assurance." },
  { "id": "cloud-security-engineer",  "title": "Cloud Security Engineer",                              "description": "Secures cloud platforms (AWS, Azure, GCP) — hardening configurations, managing identity, and building guardrails at scale." },
  { "id": "iam-engineer",             "title": "IAM Engineer",                                         "description": "Owns identity and access — provisioning, authentication, authorisation, and lifecycle management across the enterprise." },
  { "id": "malware-analyst",          "title": "Malware Analyst / Reverse Engineer",                  "description": "Dissects malicious code to understand capability, behaviour, and attribution — supporting detection and response. Deep low-level and assembly expertise required." },
  { "id": "devsecops",                "title": "DevSecOps Engineer",                                   "description": "Embeds security into the software development lifecycle and CI/CD pipelines, shifting protection left. Combines developer fluency with security engineering." },
  { "id": "cyber-trainer",            "title": "Cybersecurity Trainer / Educator",                     "description": "Builds and delivers security training, awareness programmes, and technical courses for practitioners or the wider workforce." },
  { "id": "soc-manager",              "title": "SOC Manager",                                          "description": "Leads the Security Operations Centre — owning people, process, metrics, and escalation across analyst tiers. Operational and people-focused." }
]

Full field schema for each object:

{
  "id": "exact-id-from-list-above",
  "title": "Role Title",
  "risk_rating": "Low | Low–Medium | Medium | Medium–High | High",
  "risk_score": 7,
  "badge_color": "blue | amber | red",
  "badge_text": "Medium–High Risk",
  "confidence": "Low | Medium | Medium–High | High",
  "confidence_pct": 85,
  "explanation": "2–4 sentence explanation.",
  "risk_factors": ["Factor 1", "Factor 2", "Factor 3"],
  "protected_by": ["Human strength 1", "Human strength 2"],
  "evidence": ["Source (Year): finding", "Source (Year): finding"],
  "summary_finding": "One or two sentence verdict."
}

Badge colour rules:
  risk_score 1–6  → badge_color: "blue"
  risk_score 7–8  → badge_color: "amber"
  risk_score 9–10 → badge_color: "red"

Only include verifiable sources. Do not hallucinate citations.