Cybersecurity vs Software Engineering: Which to Pick (2026)
Cybersecurity vs software engineering: which should you pick? It's a genuinely hard choice right now. One camp says cybersecurity is safe from AI. The other says software has more jobs. Get it wrong and you could spend years training for the wrong career.
Here's what I found when I dug into it: the two careers are converging on the same core skill. I do both myself these days. I design software with AI, and I defend it with AI. In this guide, we'll look at the evidence, from real job ads to AI risk scores for both fields, and then at how to choose, because I think "cyber or code?" is quietly becoming the wrong question.
TL;DR if you've only got 30 seconds
Some security job ads now require AI coding tools, and software job ads name the same tools. The two careers are converging on one skill.
On average, cybersecurity roles are safer from AI than software roles. But both fields have safe senior roles and red-zone starter jobs.
The skill both now reward is AI-driven engineering: directing AI to build and defend systems properly, inside a real specialist field.
Pick the field you find interesting, aim for a specialist role, and build something real to prove it.
Cybersecurity vs Software Engineering: The Two Careers Are Converging
Look at this security job ad. It's for a detection engineer at Lumin Digital, and we archived it in July 2026. It says it outright: "This is not a traditional SOC analyst seat." A SOC (security operations centre) analyst is the classic entry-level security job, working through alerts by hand. The ad explains that AI-driven triage now handles the bulk of routine alerts, and they want someone who builds the detections and automation those systems run.
And look at what's required:
"Demonstrated experience using AI-assisted development tools (e.g., Claude Code, Codex CLI, or similar) in a professional engineering or security workflow is required." (archived copy)
An AI coding tool, in a security job. Not preferred. Required. It isn't a one-off, either. Another listing we archived in September, for a security operations engineer at CloudBees, says it plainly: "This is not a traditional SOC role." And on the software side, software engineering ads we looked at from companies like Apple and JPMorgan in July 2026 named the same kind of AI coding tools.
So both careers are converging on the same skill: directing AI to build systems, and to defend them. That's why I think the real question is different. Let's look at what the data says first.
What the Field Averages Say
You probably came here believing something like "security is safe, and AI is taking over software development". The raw averages might seem to back you up.
I built JobZone Risk to score 3,649 jobs on how exposed they are to AI, from 0 (very exposed) to 100 (safe). It's my own model, so treat it as a guide, not gospel. Here's how the two fields compare:
Cybersecurity roles average 49 out of 100, against 36 for software development. JobZone puts each role in a zone rather than whole fields, and both fields have roles in every zone. 51 of the 91 cybersecurity roles are in the green zone, where AI makes people faster rather than replacing them, against 29 of the 99 software roles.
Make your decision on those numbers alone, though, and you might walk straight off a cliff. In a McKinsey survey of 104 large enterprises, mostly security chiefs, 35% said they expect AI agents to replace their tier 1 SOC analysts within three years. A safer field on average doesn't make every job in it safe.
Compare Roles, Not Fields
So stop comparing whole fields and start comparing specific roles. When you do, something interesting jumps out:
In cybersecurity, a senior security architect scores 67.8 and an enterprise security architect 71.1: green, safe. At the other end of the same field, a tier 1 SOC analyst scores just 5.4. Deep red, meaning JobZone rates most of its tasks as highly exposed to AI.
In software, an avionics software engineer, the person who writes the software that flies planes, scores 70.6. A junior software developer scores 9.3: red, highly exposed to AI.
A security architect and a SOC analyst are both "cybersecurity". That's not one career. It's two. And remember, the score is for the role as it's usually done, not for you. You can score the exact job you're aiming for for free, with no email needed. Do it before you spend years training for it.
The Bottom Rung Is Narrowing in Both
Now the part nobody enjoys saying out loud. The lowest scores of everything I looked at are the entry-level jobs: the tier 1 SOC analyst, the junior developer, and the junior penetration tester at 6.4. All red. The bottom rung of both ladders is narrowing. The scores, the job ads and the security chiefs in that McKinsey survey all point the same way.
So anyone telling you to grind certifications and apply for a hundred junior roles is, in my view, selling you the old map. But that score measures the job as it's traditionally done. It can't see the person who does it a completely different way. Which brings us to the most important part.
Build a Capability, Not a Job Application
So how do you actually get into either career? Stop trying to get a job, and build a capability instead. You'll still need to understand code in both fields. But increasingly, you won't be the one writing all of it. The skill is designing what gets built, directing the AI to build it, and judging what it hands back. The AI does the labour; you're the architect.
That is not vibe coding. Here's the difference:
Vibe coding is accepting whatever the AI gives you. That gets you insecure, untested code, and in a job it gets you fired. AI-driven engineering is doing it properly: you write the spec, check the output, test it and own it when it ships.
So there are two things to learn, not one. First, AI-driven engineering itself: the discipline of directing AI to a professional standard. It applies to both careers. Second, a real field to point it at, such as cloud security, application security or, on the software side, something like avionics. The AI-driven part is how you build. The field is what makes it worth building.
One Capability, Three Doors
That capability opens three doors, not one.
Door 1: Employed. You turn up with something you've built, not just a certification. The pay for this kind of work can be very high: in the AI-driven security job listings we archive, the top advertised bands include $499,000 to $900,000 at Netflix and $401,000 to $510,000 at OpenAI. You can browse them in AI-Driven Cyber Security Jobs.
Door 2: Consultant. Solve real problems for real businesses and set your own rates. Nobody's permission is required.
Door 3: Founder. Build your own product and ship it. This is how I work. My security runs on one AI system I built, called HAL. It hunts vulnerabilities, proves them and writes them up end to end. Not because the AI is clever on its own, but because of the system I built around it. That's AI-driven engineering.
Let me be honest about this route. It's harder than a graduate scheme, and a portfolio doesn't guarantee interviews. A good graduate scheme has real advantages: structured training, a salary while you learn, and a recognised name on your CV. If you can get onto one, especially one that already uses AI tools, take it, and keep building on the side. If you can't, building your own proof is the road that's opening while the old one narrows.
Your free next step is simple: pick one real problem this week and build the thing that solves it, using Claude Code or any similar AI coding tool. If you want the longer version of how to become that person, my free web-book Become the Cyber Security Expert the AI Era Demands covers it.
So, Cybersecurity or Software Engineering: Which Should You Pick?
Honestly, that's now the smaller decision. On sheer numbers there are far more software jobs than security jobs, but the entry-level openings are narrowing in both, so the size of the field matters less than whether you can show you can do the work. Pick whichever you'd find genuinely interesting, then build the capability inside it. In my view, experienced specialists are the most resilient in both fields. Seniority matters too, though: junior specialist roles like junior penetration tester still score in the red.
If you ask what I'd pick, I'm a little biased: cybersecurity. Not because it's safer. It's because it's the sharp end, attackers against defenders, and AI is now automating both sides. Automated attacks against automated defences that you build. To me that's the most interesting work there is. But that's taste, not data. Pick the one you find interesting.
If you want to become an AI-driven security engineer, that's what our AI Master's Program is for (a mentored StationX programme, not a university degree). You learn to direct AI to solve real security problems, with a weekly peer group, and you finish able to build credible commercial security solutions. You can get a full refund up until the programme begins, and if you haven't proven you can build your own working solutions by the end of the programme year, the programme stays open until you do, at no extra cost. Whichever way you go, go and build something.
Frequently Asked Questions
Is cybersecurity or software engineering better?
Neither field is safe or doomed as a whole. On JobZone Risk, cybersecurity roles average 49 out of 100 for safety from AI and software development roles average 36, but both fields contain safe senior roles and red-zone entry-level roles. Pick the field you find more interesting, then aim for a specialist role inside it.
Is cybersecurity safer from AI than software engineering?
On average, slightly: 51 of 91 cybersecurity roles are in JobZone's green zone, against 29 of 99 software development roles. But the starter jobs in both are exposed. A tier 1 SOC analyst scores 5.4 out of 100 and a junior software developer 9.3.
Do cybersecurity jobs require coding now?
More and more of them expect you to work with AI coding tools. One detection engineering job ad we archived in July 2026 said experience with AI-assisted development tools such as Claude Code or Codex CLI was required. You need to understand code and judge what the AI produces, even if you don't write every line yourself.
Can I switch from software engineering to cybersecurity?
Yes, and developers have an advantage, because application security and AI-driven security engineering both reward people who understand how software is built. Learning to direct AI tools to build and check security systems is the bridge between the two.
What is AI-driven engineering?
It's the discipline of directing AI to build software and systems to a professional standard: you write the spec, check the output, test it and take responsibility when it ships. It's the opposite of vibe coding, where you accept whatever the AI hands you.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
