svnt
10 hours ago
Completely absent is quantity of jobs. If e.g. ml engineer job postings go +40% from 200 to 280 and writer job postings go -50% (over two years) from 20000 to 10000, then we have a better idea of the impact.
Without those data this report isn’t really quantifying impact on “180M jobs.”
the_arun
9 hours ago
Also decline in Security engineer by 0.35% doesn't make sense by conventional wisdom. Shouldn't it be increasing due to increased demand for security in all ai integrations?
raesene9
9 hours ago
I wouldn't be surprised by a drop in security postings. Quite a few companies view security as an "overhead" so the siren call of reducing that overhead by introducing AI is a thing.
Also for a lot of jobs in security it's pretty hard to measure how well it's being done, so if the AI based solutions are worse, that might not show up for a while
mattlutze
7 hours ago
We also need to consider the confounding effect of corporate performance and recession expectations.
Cost centers in businesses are early canaries of expected pain, and a reduction in security roles may reflect belt-tightening irrespective of AI impact.
monero-xmr
8 hours ago
Security products and practitioners are the classic snake oil salesmen. They are actually sales and marketing roles for help closing deals by emphasizing some security aspect. True security comes from general IT practices followed by engineers themselves.
pixl97
7 hours ago
> True security comes from general IT practices followed by engineers themselves.
Thank goodness engineers pop up out of the ground fully trained on good general IT practices....
ACCount37
8 hours ago
I would be wary of making categorical claims like this, but it's unfortunately true that "security" field hasn't been doing well in a long, long time now.
Half the field is B2B "magic bullet" solutions like CrowdStrike and all the associated sales tactics - with pitches that boil down to "you give us money, we make your security issues go away". Half of what remains is mandatory certifications and other flavors of checklist-obsessed cargo cultists - often CYA-driven, often demanding the adoption of the fancy acronym of the day, regardless of the real threat profiles. Then you get the "security snake oil" - "magic bullet" systems that don't work, never did and never will, but are supported by the right influence groups and get the right pockets lined, and so are used anyway. DRM systems like WideVine and PlayReady being the prime examples. Then there are the corporate "security of our business model" shills - who pay lip service to "security", but have the true aims of "prevent anyone we don't like from doing anything that can harm our revenue streams" - with Apple being a common example.
And about a fifth of the field is people who do actual security work, and keep the sky from falling.
Spooky23
7 hours ago
I agree with you totally, although I'd venture to guess 20% is way too high. I'd say you have about 10% people doing security work, 15% doing compliance, and the rest are consuming oxygen.
It's a growth field, so you have lots of idiots getting certifications and stupid jobs. Reminds me of the 90s when I started, and companies were paying MCSE's (ie read a book, hit next-next-finish in Windows NT) more than software engineers in some markets.
Ekaros
5 hours ago
As the security guy. I get the feeling that on average engineers are not exactly great at general IT practises. Or even doing basic things.
99954bb63ccc
7 hours ago
> True security comes from general IT practices followed by engineers themselves
Sounds exactly like something the average security practitioner would say...
`not_sure_if.jpg`
Yoric
8 hours ago
How does this affect hiring of security engineers?
brendoelfrendo
7 hours ago
> True security comes from general IT practices followed by engineers themselves.
I have yet to meet an org whose engineers care about security, or who would not compromise security if secure practices got in the way of shipping a product or feature.
pwlm
7 hours ago
I'm a bit amazed you consistently get downvoted while you seem to speak the truth. So much gray in your comments.
hurrckplgbd
6 hours ago
I consistently see this commenter making a single comment, of questionable relevance, expressing a strong opinion which isn't particularly thoughtful or interesting or true. Then they ignore the pushback and move on to the next thread, where they post another tangential hot take. I'm not at all surprised at the result. Those comments attract a lot of downvote because they aren't very good.
This thread is a microcosm of that. They went on a tangent from a tangent to express how little they think of their colleagues working in security. It wasn't out of curiosity, it didn't raise interesting questions or provoke interesting debate. They didn't defend or substantiate their opinion so that they and we could learn something from it. It was just a drive-by flamebait to stir the pot and express derision. It should be downvoted; it's a bad comment.
Perhaps that pattern is difficult to see when their hot takes align with your own takes.
pwlm
5 hours ago
A microcosm indeed.
I didn't write my comment to applaud them.
hurrckplgbd
5 hours ago
I don't understand what "you seem to speak the truth" means if it isn't an endorsement?
monero-xmr
4 hours ago
I post my view that is against the HN hive mind and don't always feel like rebutting the same hive mind talking points again and again. I like to post to prove there is an alternative view out there
standardly
3 hours ago
I'm also guilty of what they accuse you of. Sometimes my internet comments are not made for the purpose of sparking discussion, but more of a "vent" where I know my take is not popular but I feel the need to throw it out there anyway. The comment is more for "me" than anyone else. And, yeah.. that makes it a bad comment lol.
I also just love playing devil's advocate, and I'm adverse to hivemindy-feeling opinions (even when I share them). Maybe this all describes you, too.
hurrckplgbd
2 hours ago
I don't have a problem with people doing that as long as they don't pretend that every other commenter holds the same contrary opinion and that the downvotes indicate they're too sensitive to discuss such things, or other similar rationalizations. If you want to leave some drive-by snark without rationalizing it as being about other people, it's not my favorite kind of comment but I'm not going to object to it either.
hurrckplgbd
3 hours ago
I don't know your motivations but I know the "HN hive mind" isn't the problem. When you do engage with people who disagree with you, it usually becomes evident to me that there isn't much substance behind your views and that you struggle to disagree amicably. I also see lots of people on HN with a similar perspective to yours who don't have the same problems or engage in the same patterns of behavior.
The facts are that HN has a diverse set of perspectives with many conservative/libertarian commenters who would align with you, but that your comments are frequently shallow flamebait. Though I have seen a couple good points you've made, as well. Do with that information what you will.
monero-xmr
2 hours ago
I disagree entirely, I don’t even post very frequently so it’s surprising I have someone tracking my posts. The shorter a comment the better it is, if the same opinion that takes an essay can be distilled into a sentence
hurrckplgbd
2 hours ago
Maybe you disagree, maybe you don't. Since you chose to veer in different direction and reply to something I never said, I don't know either way.
In any case, brevity is something great writing and shallow hot takes share.
monero-xmr
2 hours ago
My first comment on this whole thread was how security in tech is theater, and the sellers mostly snake oil salesmen. I’m not the first to make this observation and I don’t think it’s wrong. Which is why employment in the sector is down, full circle to the OP
hurrckplgbd
an hour ago
Go ahead, take that slim, speculative, tangential connection and interpret it as permission to inject your hot take into the discussion. Decline to elaborate when your supposition is challenged. You've every right to do that.
Just don't pretend that it's for our benefit or that we downvote it because we're unthinking drones, or that you decline to elaborate because we're simply not capable of having the discussion.
I tell you this because if I were insulating myself inside a bubble and rationalizing my interactions with those who disagree with me as being the reflexive behavior of a hive mind, I would hope someone would point that out to me. So here it is; again, do with the opportunity what you will.
monero-xmr
6 hours ago
Thanks! I just take the downvotes, whatever
zingababba
9 hours ago
People are sleeping on AI in sec, lots of lazy sec engs and architects going to be SoL sooner rather than later.
Ekaros
5 hours ago
I could easily see those just running tool and then printing report being replaced by script running the tool and passing results to LLM and then sending report.
And probably more useless architects.
stackskipton
9 hours ago
Most companies don’t care about security beyond window dressing and getting whatever certification required to close deals.
Time for budget cuts? Cut the Security team!
ok123456
8 hours ago
Since most of what these teams do is box-checking for these certifications, it's true.
Security is a process. It's not a constellation of products or certifications.
SkyPuncher
8 hours ago
From what I can see, being closer than the average engineer to the space (but not an expert on my own), a few things are happening:
* Engineers are being pushed for ownership of security more directly. You still need someone on the team to guide and support them, but they're not going to be directly involved all of the time.
* Significant amounts of automation and centralized security. Supply chain management is a double edge sword. It does open up vulnerabilities, but you can simply pay one of the SaaS companies in the space to help with a lot of the heavy lifting.
* Commoditization/Platform-ification drastically reduces attack vectors.
OWASP has a nice comparison from over the years: https://github.com/OWASP/Top10/blob/master/2021-2003_Compari...
Sharlin
9 hours ago
The "S" in "AI" famously stands for "security", so no humans needed anymore.
Tarsul
9 hours ago
if everything goes down 8%, the one that loses only 0,35% is a relative winner.
billy99k
7 hours ago
I think it's because companies are moving away from in-house security and hiring 3rd party companies for security work. It also depends on the time of year this was taken. Q4 is the busiest time for security. Q1 is the slowest.
I'm a security consultant and work with multiple companies that provide security services. Work has increased massively in the last year.
tempfile
8 hours ago
Why do you think there is increased demand for security in AI integrations?
moffkalast
8 hours ago
Bold of you to assume there is any demand for security in AI integrations. It's like 90s web browsers, everyone's running random MCP servers that do god knows what.
danillonunes
8 hours ago
Seems like when the security market is low on the white hat side, it's high on the black hat one. Security people just need to learn to adapt.
papascrubs
an hour ago
I'm sure some of these ransomware groups probably offer health insurance and 401k matching.
xtracto
8 hours ago
Also absent is any data in SDRs, Sales Account Executives and Sales Managers (all the Revenue vertical.