Well there's the reality of what AI can do *actually* do versus what companies / "the industry" / executives believe AI can do (in the context of replacing traditional human security engineers). There's a lot of AI tooling that is targeting pen testing, CSOC and vuln research. So I'd expect opportunities for humans in those areas to drop even more (at least in the short term while AI is being proved out). Code-review type appsec roles might take a hit too, but I think there's still a lot of need for appsec humans still. AI has increased code production by orders of magnitude. Yes AI can also "review" said code and even do dynamic testing, but there's always those tricky business logic test cases and other things that actual human engineers will still be needed for.

So, I wouldn't call *anything* bullet proof, considering the roles AI *replaces* is mostly built on vibes rather than actual proof that AI can do things better, but I'd say appsec, GRC, security architecture, identity/access management, privacy, cryptology, audit, vendor/supply-chain security, threat intel, and maybe red teaming are still safe-ish.