AI exposure: Information Security Engineers
Develop and oversee the implementation of information security procedures and policies. Build, maintain and upgrade security technology, such as firewalls, for the safe use of computer networks and the transmission and retrieval of information. Design and implement appropriate security controls to identify vulnerabilities and protect digital files and electronic infrastructures. Monitor and respond to computer security breaches, viruses, and intrusions, and perform forensic investigation. May oversee the assessment of information security systems.
Reading this score
computed43.4% of this occupation's weighted task load is exposed, which puts Information Security Engineers at the 78th percentile of 923 occupations. The capability is largely there. Its average task scores 2.8 out of 4 on what a current system can produce, and the frictions that hold other jobs in place are comparatively weak here.
What holds the line here is context. Across this occupation's 20 tasks it averages 1.98 out of 3, the highest of the five friction dimensions. In plain terms, the work depends on knowledge the model cannot hold. Much of this job runs on things that were never written down: what this particular organisation does, what happened last week, what the person across the table actually meant. That context is the barrier, and it erodes as systems are given more access.
The most exposed thing this job does is Assess the quality of security controls, at 73.3%. The least is Conduct investigations of information security breaches to identify vulnerabilities and..., at 10.0%. A gap of 63.3% between two parts of the same job is the reason this index publishes at task level. An occupation-wide number would have hidden both.
Within computer and mathematical occupations, this one is less exposed than the median of 57.8% across the group's 36 roles, with 34 scoring higher. Being in an exposed family does not make a particular job exposed, and the reverse holds too.
What would move this score. Of 20 tasks, 18 are currently banded exposed, 1 assisted and 1 untouched. For that distribution to shift materially would take cheaper ways to verify output, since the cost of checking is currently doing more to hold this work in place than the cost of producing it. The score is re-computed every quarter against a fresh capability reference, and the change is published rather than quietly applied.
Task by task
20 tasks, O*NET 31.0| Task | Exposed | Assisted | Untouched | Importance | Band |
|---|---|---|---|---|---|
| Assess the quality of security controls, using performance indicators. | 73.3% | 26.7% | 0.0% | 4.41 | exposed |
| Write reports regarding investigations of information security breaches or network evaluations. | 73.3% | 26.7% | 0.0% | 3.71 | exposed |
| Develop information security standards and best practices. | 61.3% | 26.2% | 12.5% | 3.94 | exposed |
| Develop or install software, such as firewalls and data encryption programs, to protect sensitive information. | 55.0% | 20.0% | 25.0% | 4.11 | exposed |
| Develop or implement software tools to assist in the detection, prevention, and analysis of security threats. | 55.0% | 20.0% | 25.0% | 3.71 | exposed |
| Scan networks, using vulnerability assessment tools to identify vulnerabilities. | 50.0% | 25.0% | 25.0% | 4.28 | exposed |
| Develop response and recovery strategies for security breaches. | 50.0% | 25.0% | 25.0% | 4.25 | exposed |
| Recommend information security enhancements to management. | 50.0% | 25.0% | 25.0% | 3.94 | exposed |
| Troubleshoot security and network problems. | 50.0% | 25.0% | 25.0% | 3.74 | exposed |
| Coordinate documentation of computer security or emergency measure policies, procedures, or tests. | 50.0% | 25.0% | 25.0% | 3.72 | exposed |
| Provide technical support to computer users for installation and use of security products. | 50.0% | 25.0% | 25.0% | 3.38 | exposed |
| Review security assessments for computing environments or check for compliance with cybersecurity standards and regulations. | 47.5% | 27.5% | 25.0% | 3.76 | exposed |
| Identify or implement solutions to information security problems. | 45.0% | 30.0% | 25.0% | 3.94 | exposed |
| Identify security system weaknesses, using penetration tests. | 40.0% | 35.0% | 25.0% | 4.56 | exposed |
| Coordinate monitoring of networks or systems for security breaches or intrusions. | 26.7% | 23.3% | 50.0% | 4.42 | exposed |
| Oversee development of plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure or to meet emergency data processing needs. | 26.7% | 23.3% | 50.0% | 4.06 | exposed |
| Oversee performance of risk assessment or execution of system tests to ensure the functioning of data processing activities or security measures. | 26.7% | 23.3% | 50.0% | 3.88 | exposed |
| Coordinate vulnerability assessments or analysis of information security systems. | 26.7% | 23.3% | 50.0% | 3.83 | exposed |
| Train staff on, and oversee the use of, information security standards, policies, and best practices. | 11.7% | 13.3% | 75.0% | 4.28 | untouched |
| Conduct investigations of information security breaches to identify vulnerabilities and evaluate the damage. | 10.0% | 40.0% | 50.0% | 4.22 | assisted |
Task text and importance ratings sourced from O*NET 31.0. Shares computed. The occupation score is the importance-weighted mean.
Where the score comes from
judgedEvery task is scored through the standardised work activities it maps to. These are this occupation’s averages on the six rubric dimensions. Capability is what AI can do; the other five are what stands in the way.
| Dimension | Mean | Scale |
|---|---|---|
| Capability | 2.77 | 0-4 |
| Embodiment | 0.38 | 0-3 |
| Presence | 0.75 | 0-3 |
| Accountability | 1.07 | 0-3 |
| Context | 1.98 | 0-3 |
| Verification cost | 1.68 | 0-3 |
What this means in practice
Where most of a role's weighted task load is exposed, the work that survives is usually the part of the job nobody wrote into the job description: deciding what should be produced rather than producing it, and being answerable for the result. The tasks lowest on this page are a better guide to where to spend your time than any general advice about the future of work.
Occupations either side of this one
The four closest scores in the same occupational family, then the four closest anywhere in the index.
Read this carefully. Exposure is not displacement. A high score means current AI systems can produce this work, not that anyone will stop paying a person to do it. Adoption depends on economics, regulation and inertia that this index deliberately does not model. How the score is built.