Topic starter
14/09/2026 10:10 am
TL;DR: The analysis of 665 US security operations job postings shows the SOC market shifting from queue-watching to pipeline-building, with 37% of roles now in engineering and automation families and 22.7% carrying active AI or automation requirements, according to D3. The hiring data suggests validation, detections-as-code, and mixed-stack fluency are becoming the durable SOC skills, not manual triage alone.
Editorial analysis by NHI Mgmt Group, based on content published by D3: “We Read 1,000 SOC Job Postings. Security Teams Are Hiring Three Builders for Every Analyst.”.
Key questions
Q: What breaks when a SOC stays centred on manual triage instead of automation and validation?
A: Manual triage caps throughput, but the deeper failure is governance.
Q: Why does AI-assisted SOC work still need human validation?
A: Because AI can summarise and prioritise, but it cannot be trusted to own final operational judgment without oversight.
Q: How do security and compliance teams know if SOC 2 automation is working?
A: SOC 2 automation is working when it keeps evidence current, control ownership visible, and audit requests organised without replacing testing.
Practitioner guidance
- Build detections-as-code into the SOC operating model Version detection logic, test alert content before deployment, and require review for every rule change so automation stays governable.
- Define human approval gates for AI-assisted response Require analysts to approve or reject AI-generated investigation paths and response plans before the system can execute containment steps.
- Standardise cross-platform SOC workflows Document how alerts move across SIEM, EDR, and automation tools, including where enrichment, escalation, and closure happen.
Bottom line: The hiring data shows that the modern SOC is being rebuilt around engineering, automation, and AI-assisted validation rather than queue watching.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:11 am
The SOC is becoming an engineering function, not a queue function. The hiring data shows that organisations are paying for people who build, validate, and automate the control plane of operations rather than people who only clear alerts. That shift changes the security model because the work now includes pipeline design, content governance, and response orchestration. For identity and access governance, this also means the SOC increasingly depends on reliable permissions, service accounts, and approval boundaries. Practitioners should treat staffing as part of operational control design.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: Should organisations prioritise engineering roles over additional analyst seats in the SOC?
A: In most modern SOCs, yes. If the workload is dominated by alert volume, platform integration, and repetitive triage, adding more analysts only extends the same bottleneck. Engineering roles change the underlying system by reducing noise, codifying response, and making automation maintainable.
👉 Read our full editorial: The SOC is being rebuilt around automation, validation and AI