Example · Cybersecurity Student
Your first job used to be clearing the alert queue. Now it is catching what the triage agent missed.
18 of your 40 hours still need you
- 11 stay yours
- 7 faster with AI
- 22 tools could take
A typical week at the middle pace. Your plan uses your own tasks.
Is cybersecurity safe from AI?
In the work a cybersecurity student is heading toward, 18 of a typical 40-hour week still need a person, by our task-by-task count. Tools could already take about 22 hours. Cybersecurity is still growing fast on paper, and that is real. The part that worries you is also real.
Read more
The work that used to train new analysts, clearing the alert queue and the phishing mailbox, is the work vendors now sell triage agents to do. So the door into a first job in a security operations center (SOC) is narrower than the growth figure suggests, and it is narrowing at the exact spot most programs point you toward.
What holds is the person who can tell when the tool is wrong, who can sit with a system owner and decide what risk the organization is accepting, and who is trusted near the containment button. You can start building proof of that this semester with a home lab, a free public dataset, your classes and your clubs. You can keep your major. The plan helps you bring evidence along with your transcript.
The hard truth
Your cyber degree competes with IT experience and certs.
Your degree counts most when it comes with hands-on proof. Most security hiring managers say they would consider people with only IT work experience or one entry-level certification, so you compete with them.
Sources (2)
- 90% of hiring managers would consider entry-level candidates with only IT work experience and no formal qualifications. ISC2 Cybersecurity Hiring Trends Study, 2025-06
- 89% would consider candidates holding only an entry-level cybersecurity certification. ISC2 Cybersecurity Hiring Trends Study, 2025-06
What stays yours
Verifying who someone is before you reset their MFA (two-step login) or recover their account
Identity is where attackers get in, and organizations are slow to let a tool approve an account recovery on its own. If you work a help desk, on campus or off, you already practice the judgment a social-engineering call tests.
Talking a panicked user through what happened after they clicked
The conversation needs trust and a read of the person. A model can draft the script, but it can't get a scared user to admit they also typed their password.
Hands on hardware: imaging, collecting a laptop, the physical side of an incident
Somebody has to be in the building. It rarely gets you hired, but it keeps campus and in-house IT seats alive.
Deciding whether an alert is really malicious when the evidence is mixed
As triage gets cheap, the person who can audit the verdict becomes the bottleneck. The plan asks you to log this skill and put a number on it.
Knowing how an organization's systems and people actually work
This means knowing which server nobody is allowed to reboot and which department always fails the access review. That knowledge is undocumented, and GRC (governance, risk and compliance) analysts rely on it.
Which cybersecurity jobs fit new grads with AI?
Plan A is your best move in the field you are studying for. Most sessions in the 13-week plan build toward it.
- A
Start as an entry security analyst who checks the AI triage tool's calls
Why it fits
Why you. If you like the investigation part of class, or worry about being blamed for a missed alert, this move puts you in charge of finding it. A help desk job, if you have one, already trains the identity checks it needs.
The gap. No log of your own judgment against a tool's, no home lab with real log data, and no competition results.
The trade-off. Entry seats at managed security firms are the ones being cut first, and shift work is common. You are betting the checking role grows faster than the alert queue role shrinks.
Other moves that fit
These are also good bets in this field. Read them if Plan A doesn't suit you.
Security compliance work for defense suppliers
Why it fits
Why you. GRC is a large share of where cyber graduates land, and it rewards people who can talk to system owners and write clearly.
The gap. A close reading of NIST SP 800-171 and CSF 2.0, the main federal security rule sets, and one control map you made yourself.
The trade-off. The work is less hands-on. If CMMC timelines slip, demand cools. Pay at small contractors varies, so compare offers.
Government and security clearance jobs, with the costs spelled out
Why it fits
Why you. If you're a US citizen open to government work, and your school offers Scholarship for Service, this path pays your way through school.
The gap. You can't apply for a clearance yourself. An agency or cleared employer has to sponsor it for a position, and an internship with one is the usual door.
The trade-off. Federal hiring runs through agency hiring committees under Executive Order 14356, and appropriations lapses happen. Scholarship for Service ties you to a service obligation in a constrained market.
What's a plan B for cybersecurity students?
Plan B is a job AI is creating that these skills already fit. One session a week in the plan trains you for it, so it is ready if your job shrinks or you want a change.
BPlan B, picked for this role
AI agent ops specialist
Talking a panicked user through a phishing click is support-floor work, and teams running AI agents need that person watching the queue.
Other options
AI governance analyst
The GRC track through the defense supply chain maps directly onto AI risk and compliance reviews, starting from controls you already study.
Domain AI red teamer
Deciding whether an alert is really malicious trains you to think like an attacker, which is what red teaming an AI system asks.
In your own plan you can switch to any of the 47 roles.
The first two weeks
The first 2 of 13 weeks. Most weeks have a 45-minute, a 60-minute and a 90-minute session, plus one 40-minute Plan B session. Weeks 9 and 10 are finals and drop to one main session plus Plan B, and weeks 11 and 12 fall over winter break and stay light. Week 13 is the first week of spring and ends in applications. By week 13 you'll have a Splunk home lab, a triage log of about 70 alerts with your miss rate, and a one-page summary sent with about 20 summer applications.
- Week 1: See where your time goes
What you do
- AList a typical week of your classes, labs, clubs and projects. Mark which parts AI already helps with, such as reading logs or writing reports.
- ACheck the National Cyber League (NCL), a student hacking competition. Fall late registration ran October 10 to 13, so if you missed it, write down the spring season dates.
- ATake Splunk's free Intro to Splunk course. Splunk is a common tool for searching security logs.
- BTake the first half of Anthropic's free AI Fluency: Framework & Foundations course. Use made-up help desk tickets for every example.
- Week 2: Build your home lab
What you do
- ADownload Splunk's Boss of the SOC v3 (BOTS) practice dataset. Check its MD5 hash, a fingerprint that proves the file is intact.
- AInstall the free Splunk Enterprise trial with the listed add-ons. Search index=botsv3 to confirm events load.
- AAnswer ten BOTS practice questions. Save the search you used for each one.
- BFinish AI Fluency and its quiz. Ask AI to sort five made-up phishing reports and grade each call.
Three courses from the plan
Checked 2026-10-13.
- CompTIA Security+ V7 (SY0-701)CompTIA · $439 exam voucher (US); $579 with retake
Don't buy this now. It retires before most juniors graduate.
- ISC2 Certified in Cybersecurity (CC)ISC2 · $199 exam; $50 annual maintenance fee
Only if you already hold a free code. Otherwise put the $199 toward Security+ V8.
- Professor Messer Security+ SY0-701 courseProfessor Messer · Free
Yes, for concepts. The core ideas carry over to V8.
Risks beyond AI: moderatePublic-sector hiring risk
Public-sector hiring is the non-AI risk for this path. Many cyber programs lean on federal and state jobs, and federal hiring contracted sharply in 2025: a hiring freeze, then agency hiring committees under Executive Order 14356 (October 15, 2025), plus appropriations lapses. Private demand is steadier, and defense-contractor compliance work has a regulatory calendar behind it.
Where this could be wrong
- The destination blend is ours. If your program sends more graduates into GRC or federal roles, the share of your week that holds up rises. If most land in first-line (tier one) work at a managed detection and response (MDR) firm, it falls. Your career center has the real placements.
- We may be underweighting the IT stepping stone. BLS projects computer support specialists to decline 3%, yet with about 48,700 openings a year. That door is wide, but it leads to the same squeezed entry level.
- Vendor accuracy claims are self-reported. If independent tests show triage agents miss more than vendors say, the junior seat lasts longer. If they miss less, the role of checking the AI shrinks too.
- Federal hiring could recover fast. OPM, the federal personnel office, told Federal News Network it expected most scholars to place by the end of fiscal 2026. If that happened, the public and cleared path should rank higher.
Also matched: cybersecurity student, cybersecurity major, cyber major. Research checked 2026-10-13. Page updated .