The cybersecurity job market changed shape in the last 18 months
If you're still chasing the same SOC and pentest job descriptions you saw in 2023, you're competing with everyone else who didn't update their target. The roles that are paying premium right now barely existed three years ago — and the established roles that still pay well have all quietly absorbed AI/ML literacy as a baseline expectation.
This isn't hype. It's a head count shift in real Malaysian and SEA hiring data. Here's what we're seeing across coaching clients, and where to put your next 100 hours of learning.
1. AI Security Engineer is the fastest-growing role of 2026
Production LLMs introduced an entirely new attack surface — prompt injection, jailbreaks, RAG data leakage, agent escape, model supply chain — and there are very few people qualified to defend it.
What changed: GoTo, Sea Group, Standard Chartered, Maybank, and most major Malaysian and SEA banks now have at least one open AI Security role. Many companies are creating the role and the headcount is going unfilled for months.
The pay reflects it: RM 14–22k/month in Malaysia, USD 140–220k globally. That's a 30–40% premium over equivalent-tenure traditional security engineers.
How to get there: Pair existing security skills (AppSec, cloud security, pentest) with the OWASP LLM Top 10, Garak/PyRIT for red-teaming, and the NIST AI RMF as your governance scaffold. The new ISACA AAISM cert was built for exactly this audience.
2. MLSecOps is the boring-but-explosive middle
Less glamorous than red-teaming GPT-5, but at least as in-demand: securing the ML platform itself. Training pipelines, model artifacts, feature stores, model serving — every layer is a new attack vector and most platform teams are flying blind.
Why it matters: When the SEC, EU AI Act, and MAS guidelines all start asking "where did your model come from?" — you need AI-BOM, signed model artifacts, and audit trails. That's an MLSecOps Engineer's job.
Best background: DevOps engineers, MLOps engineers, or cloud security engineers expanding into ML. CKS + AWS Security Specialty + AI-102 covers the technical surface.
3. DevSecOps still has more open roles than SOC L2/L3
This is the unsexy truth: while everyone's chasing AI Security headlines, the role most companies actually need right now is DevSecOps. Maybank, Carsome, Grab, AirAsia — every Malaysian tech-forward employer is hiring for SAST/DAST/SCA + IaC + supply-chain security.
Why this stays hot: Compliance pressure (NIS2, SEC cyber disclosure, BNM RMiT) is pushing every regulated organisation to formalise software supply-chain controls. SLSA, SBOM, signed artifacts — these aren't academic anymore.
The hidden advantage: It's a smaller candidate pool. Most security folks resist the "shift-left + dev enablement" identity. If you don't mind partnering with engineering instead of policing them, your competition is thinner.
4. Supply chain security graduates from "compliance shelfware" to engineering work
SBOM (Software Bill of Materials) and now AI-BOM are no longer just artifacts produced for auditors. They're becoming runtime signals — checked at deploy, verified by policy engines, traced after incidents.
Tools to know: Sigstore + Cosign for artifact signing, in-toto for attestation, OPA + Conftest for policy enforcement, Trivy + Grype for vulnerability scanning, GUAC for graph queries across the supply chain.
Why this matters for your career: Mentioning "I rolled out signed artifacts and an AI-BOM pipeline" in an interview is a clear differentiator at the senior+ level. Most candidates can't.
5. The boring middle: IAM, identity-first security, detection engineering
Every breach root cause analysis still leads back to identity. Compromised creds, over-permissioned service accounts, stale OAuth scopes. Identity-first security is finally getting the budget and headcount it always deserved.
Detection Engineering specifically is having a moment — treating detection rules as code, with version control, CI tests, and coverage maps against MITRE ATT&CK. If you've been writing Splunk SPL queries for years, this is your shot at a 30–40% pay bump by repackaging that skillset.
6. Privacy + AI governance is the sleeper category for GRC
Most security professionals dismiss GRC as paperwork. They're wrong about 2026 GRC.
The new GRC spec: mapping controls across NIST AI RMF + EU AI Act + ISO 42001 + GDPR + your local PDPA — for products that didn't exist 18 months ago. That's genuinely hard and senior-grade work.
The cert combo that pays: CIPP/E + AAISM + an existing CISA/CISM. Standard Chartered is hiring exactly this profile at RM 12-18k/month right now.
7. CrowdStrike permanently changed how we think about resilience
The July 2024 outage taught everyone that "your security tool taking down production" is not an abstract risk anymore. Resilience engineering — graceful degradation, blast-radius control, deploy-cell patterns — is now table-stakes for security platforms.
What to learn: Chaos engineering basics, deploy strategies (canary, blue-green, ring deployments), failure mode analysis. SRE skills are increasingly part of senior security engineer expectations.
8. What's plateauing or contracting
Honest read: not everything is up and to the right.
- Generic L1 SOC roles are saturated. There are still jobs but the salaries aren't moving and shifts are tougher.
- Penetration testing without a specialty is plateauing. AI red-teaming, cloud-native pentest, or web3/blockchain depth is what differentiates now.
- Pure compliance auditor roles are getting absorbed into broader GRC scopes — you need risk + privacy + AI literacy on top.
This isn't bad news. It just means the bar to entry is moving up, and the floor is moving with it.
Where to spend your next 100 learning hours
If we coached you today, here's what we'd say based on where you are:
- 0-1 year experience → Security+ → CompTIA SecurityX or AWS AI Practitioner → OWASP LLM Top 10 walkthrough. Build a vulnerable RAG app, exploit it, document the findings.
- 1-3 years → Pick AI Security OR DevSecOps OR MLSecOps and go deep. Add CKS or AAISM. Ship one production-grade project that you can talk about for 30 minutes.
- 3-5 years → CISSP or AAISM. Lead one program (AI security review, supply-chain rollout, detection-as-code migration). Speak at one local event.
- 5+ years → Pivot to leadership or principal IC. Map your work to AI governance, board-level resilience, or product security strategy.
The meta point
The half-life of a "hot" cybersecurity skill has compressed. What worked in 2022 is still useful, but the ceiling is lower. The skills paying premium in 2026 didn't exist — or weren't being hired for — in 2023.
The good news: most people aren't adapting. So the gap between "average" and "differentiated" candidates is wider than it's ever been.
Pick one of the eight trends above, learn it deeply over the next 90 days, and ship one piece of public work (a write-up, a tool, a talk) that proves it. That's the highest-ROI move you can make in cybersecurity right now.
Want help mapping your specific situation to a 90-day learning plan? Book a career consultation — we'll sit down with your CV, your target roles, and the time you have, and build a plan you can actually finish.
Ready to Apply This in Your Career?
LumaShift helps you turn insights like these into tangible career progress. Let's talk about where you are and where you want to be.