AI in the SOC takes over alert triage, enrichment and timeline building. Analysts spend more time checking AI output, handling exceptions and making decisions under uncertainty. For hiring, the question shifts from "can this person run our SIEM?" to "can this person tell whether an automated investigation holds up?"

This affects two groups. Security analysts see their entry-level queue work shrink. SOC team leads have to rewrite job profiles and interview exercises. Both need a clear picture of which skills now carry weight and where the data is still thin.

High-volume triage roles change first. These are the jobs where someone works through a queue of alerts, enriches each one and closes or escalates it. That work is repetitive, so it is the easiest to automate.

SANS workforce research for 2026 reports that SOC and security-analyst roles made up 32% of AI-driven role reductions. Threat-intelligence analysts followed at 26% and incident responders at 22%.

SOC and security-analyst roles accounted for 32% of reported AI-driven role reductions in 2026 (SANS Institute).

Read that number with some care. It describes reported reductions, not the total number of jobs. It does show that the entry level of the SOC feels it first.

That is a problem for the whole field. Junior triage is where future senior responders learn the job. If that layer gets thinner, someone has to build another route to senior level.

Analysts spend less time collecting data and more time judging it. AI handles enrichment, correlation and first-pass summaries. The analyst checks whether the investigation is complete and whether the conclusion rests on evidence.

Practitioner material describes this as a new core skill: spotting unsupported assumptions and noticing what evidence the system never collected. A fluent summary is not proof. A confident but wrong investigation can speed up the wrong response, for example isolating a host that should have stayed online.

A report discussed by Cybersecurity Dive found that nearly six in ten SOC workers saw AI creating room to build strategic decision-making skills. The same report says analysts increasingly validate evidence and handle exceptions. Note that these statements come from vendor-linked sources. They show where the industry is heading, and they are no neutral consensus.

The work gets harder, not easier. That is worth saying plainly to anyone who expects AI to make the job lighter.

Team leads hire for investigative judgment first and tool familiarity second. Vendor-specific SIEM knowledge still helps, but it differentiates less when AI writes queries and summaries.

Current job descriptions for AI-assisted SOC roles commonly combine SIEM query skills, detection engineering, Python or PowerShell, SOAR playbooks, cloud and identity telemetry, EDR and MITRE ATT&CK. On top of that comes validation of AI output, as one vendor's career guide puts it.

D3 Security looked at 665 SOC job postings. In its SOC Rebuild Index, 22.7% asked explicitly for AI or automation skills. That is a vendor sample, so it is no market-wide survey. Still, it fits what we hear in intake calls: automation scripting comes up more often, especially for mid-level and senior roles.

One more point. A Cisco survey cited in a 2026 analysis found that 49% of security leaders named hands-on experience with AI agents as the hardest entry-level skill to find. Check the method behind that analysis before using it as a hard benchmark.

These three terms describe how much control people keep. In the loop means an analyst approves an action before it happens. On the loop means an analyst supervises an agent within set limits. In the lead means the team decides the rules.

Take account disablement as an example. With a human in the loop, the analyst approves each disablement. On the loop, the agent may disable accounts below a certain risk level, and the analyst reviews the exceptions afterwards. In the lead, the team decides which accounts the agent may touch at all, and who answers for it.

The last one matters most for buyers. An AI assistant speeds up work, but it does not own the risk decision. In practice "AI SOC" should mean fast collection and correlation, with people controlling judgment and authorization.

This also creates a new kind of role. Someone has to define what an agent may investigate, which data it can reach, which actions need approval and how its performance is monitored. Security engineers with a network background are a natural fit, as in a network security engineer role where detection and response decisions meet infrastructure knowledge.

Regulation keeps the accountability with the organization. NIS2 raises expectations for risk management, incident handling and management responsibility. Using an AI platform does not move that responsibility to the vendor.

The EU AI Act asks organizations to assess AI by purpose and risk profile, and to document oversight and logging where obligations apply. A product's marketing label does not decide its classification. GDPR matters too, because SOC telemetry can contain identity data and employee activity. For financial entities, DORA adds requirements on auditability, third-party oversight and exit arrangements.

For hiring, this has a concrete effect. Organizations need people who can document why a human approved or rejected an action, and who can explain an automated decision to an auditor. That is a skill, and it shows up on the shortlist for security officer profiles, such as an information security officer.

Give the candidate something to check, and skip the build exercise. A realistic exercise is an incident timeline created by an AI agent. Ask the candidate to find what is missing, mark claims without evidence and flag any unsafe remediation advice.

This tells you more than a tool quiz. It shows whether the person forms a hypothesis, tests it against telemetry and explains the outcome in plain language to a system owner. Communication counts here. Analysts have to explain uncertainty, containment options and remaining exposure to non-technical people.

On our side, we run this kind of exercise into the intake. Before we search, we agree with the hiring manager on what a good answer looks like. Candidates then know what they are walking into, and managers see the same evidence we do. That is part of how a Delivery Sprint works: intake, sourcing, interviews, with no black box.

One caution. We do not have solid public data on how many Dutch SOCs already hire this way. The direction is visible in job descriptions and vendor material, but the numbers are partial.

AI in the SOC moves the work from clearing queues to judging evidence. Entry-level triage shrinks, and demand grows for analysts who can check AI output, write detections and take responsibility for decisions. Regulation keeps accountability with the organization, so oversight has to be designed, not assumed.

If you are hiring for this kind of profile, or planning your own move into it, we are happy to compare notes on what the market looks like right now.

1. The SOC Rebuild Index: 2026 Edition - D3 Security
2. www.sans.org › white-papers › 2026-cybersecurity2026 Cybersecurity Workforce Research Report | SANS Institute
3. SOC Analyst Career Path: Roles, Skills, and What AI Changes
4. How to Become an AI SOC Analyst in 2026
5. SOC analyst career path and salary guide, 2026: tiers, pay ...
6. www.onlinecybersecurity.org › articles › cyberAI & Cybersecurity Skills Gap: Career Path Guide (2026)

Written by our AI, read by a flesh-and-blood recruiter.