How to become a security engineer: skills, routes in and pay, read from 1,020 open postings

What security engineers build, what 1,020 open security engineering postings asked for on 12 November 2026, and the routes into the job from software, infrastructure, the SOC, IT and a degree.

A security engineer designs, builds and runs the controls that keep an organization's systems from being misused: who can reach what, which code is allowed to ship, what gets logged and noticed, and how keys, secrets and servers are locked down. It is an engineering job first and a security job second, and that shapes the honest route in: of 1,020 open security engineering postings read in full for this guide, a mere 36 were pitched at interns, new graduates or juniors, seven in ten of the 629 that set a minimum asked for five years or more, and 72% named a programming language. Most people therefore arrive from a job that already taught them to build or operate systems (software engineering, site reliability or DevOps, a security operations seat, IT administration) and add the defender's half on top. What follows is that defender's half, in the order employers seem to value it, with what each step pays.

Where the numbers come from. On 12 November 2026 this guide read CyberJobs.cc's complete job feed, 2,150 open security roles taken from the employers' own careers systems, and kept every posting whose title names security engineering work: security engineer or security engineering; product, infrastructure or platform security; security software engineer, or a software engineer title with a security subject; detection and response engineer; security operations and DevSecOps engineer; plus the engineering titles in the board's security engineering specialty. Of that specialty's 618 roles, 496 qualified. The other 122 were sales and support engineers, analysts, a cyber insurer's underwriters and claims specialists, concert venue security staff and similar titles the specialty had swept in. Twenty-five titles whose work is attacking systems (offensive security, red team, penetration tester) were left to the penetration tester guide, and security architects to their own pages. The result is 1,020 postings from 245 employers. Each was counted for what it names, whether as a requirement or a plus, because postings seldom keep the two apart. Pay comes only from ranges printed in US postings: 391 distinct ranges from 125 employers. Forty-six postings are written in French, Korean or German, so keyword counts slightly undercount them.

Figures from that read carry its date. Figures the board can recount do so whenever this page loads: right now CyberJobs.cc lists 617 open roles in its security engineering specialty, 174 of them remote, and the ranges printed on them run typically from $173k/yr to $374k/yr, centred on $210k/yr.

"Security engineer" is both the board's largest specialty and the commonest single job title in the field. Late on 11 November, 213 open roles carried that exact title on the security engineer title page. The rest of the sample uses titles that say which part of the work they mean, such as product security, infrastructure security, or detection and response, and section 2 sorts them by it.

Contents

1. What a security engineer does, and why companies pay for one
2. The kinds of security engineering, and how the day differs
3. What 1,020 open postings ask for
4. How much coding the job takes
5. A security engineer roadmap: skills in the order they compound
6. Routes in, starting from your current job
7. Certifications: what postings name, and how often none
8. Security engineer salary by level, branch and employer
9. Security engineer vs software engineer
10. The interview loop: coding, system design and threat modeling
11. Where the career leads after senior
12. Security engineer questions, answered

1. What a security engineer does, and why companies pay for one

Begin with the arithmetic that creates the job. A company with a few hundred engineers may merge thousands of code changes in a week, run tens of thousands of cloud resources and grant access to hundreds of outside software services. Nobody can inspect that by hand, and a security team that tries becomes the queue everyone learns to route around. The only way to keep pace is to build controls that act on every change, every login and every machine at once: a check in the build pipeline that each commit passes through, an access system that grants the minimum and withdraws it on its own, a detection that watches every laptop instead of the few someone thought to check. Designing and maintaining those controls is the security engineer's job. The leverage is also why it pays like engineering: one well-placed guardrail does the work of a room full of reviewers.

The US government's cybersecurity workforce framework divides this work into roles that most postings straddle. Its Secure Systems Development role (DD-WRL-004) is "responsible for the secure design, development, and testing of systems" - NICCS, NICE Framework 2.2.0. Its Systems Security Analysis role (IO-WRL-006) is "responsible for developing and analyzing the integration, testing, operations, and maintenance of systems security" - NICCS. A product company's security engineer usually does the first in the morning and the second in the afternoon: designs a control, then keeps it alive in production.

Employers put the balance in plainer words. Discord's senior platform security posting announces "This is a code-forward role!" Tailscale's security software engineer will "spend at least 50% of your time in this role writing software vs purely operational or governance security responsibilities". Superhuman's product security posting wants the ability "to think like an adversary to identify risk, and then build like an engineer to mitigate those risks". Taken together, those three lines describe the trade more accurately than any formal definition: an attacker's imagination decides what needs building, and an engineer's skills decide whether it actually gets built.

One request, followed from ask to alert

Suppose the support team at a mid-sized software company wants an AI agent that reads customer tickets and drafts replies, with access to the ticketing system and to customer records. Here is how a security engineer would carry that request.

A threat model first, however informal. The Threat Modeling Manifesto reduces the method to four questions: what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job - Threat Modeling Manifesto. In this case the second question has concrete answers. A ticket written by an attacker could carry instructions that the agent obeys (prompt injection). Credentials broad enough to read any customer would let one poisoned ticket pull thousands of records. A drafted reply could leak one customer's data into another customer's thread.

Then a design. The agent receives an identity of its own rather than a shared service account, scoped to the customer named on the ticket, with short-lived credentials issued per task. Outbound replies go through a human approval step while the team learns how the agent behaves. Every tool call the agent makes is logged in a shape the detection team can query.

Then the build and the write-up. The engineer writes the access policy as code, adds a pipeline test that fails whenever someone widens the agent's permissions without review, and adds a detection that alerts when the agent's identity reads far more records in an hour than any ticket could need. A short design document records what was decided and why, so the next request of that shape takes a day rather than a week. Very little of this resembles security as films portray it: it is identity, logging, code and clear writing, the mix the postings in section 3 ask for.

Where it stops and the neighbouring jobs begin

A security analyst watches what the controls report and decides what is real; the SOC analyst guide covers that seat. A security engineer builds and tunes the controls themselves. A penetration tester proves where defences fail, while the engineer removes the class of failure so it stops coming back. A security architect sets patterns across many systems and usually writes less code, and many architects started as engineers (section 11). A software engineer builds the product; a security engineer builds what keeps the product, its infrastructure and its staff safe (section 9 compares the two). Because the borders blur, the next section sorts postings by the work they describe rather than by title.

2. The kinds of security engineering, and how the day differs

One title covers at least six distinct jobs. Sorting the 1,020 postings by the part of the work their title names (titles that name none keep a row of their own) produces this map.

Pay here is the middle of the range midpoints in US postings, so each figure moves with who happens to be hiring in that branch; section 8 untangles level and employer from branch. The live counts below show how many roles sit in the board's specialties where security engineers are usually filed, recounted each time the page loads.

Infrastructure, platform and cloud security

This branch hardens the layers everything else runs on: hosts and their operating systems, containers and Kubernetes clusters, networks, the identity that services use to talk to each other, and the keys and secrets they carry. Kubernetes appeared in 49% of its 186 postings and AWS, Azure or Google Cloud in 53%. OpenAI's principal infrastructure security engineer, remote in the US at $401,000 to $510,000, covers a span from "bare-metal hardware and firmware, to Kubernetes clusters and service meshes, to data storage and access pathways for highly sensitive model weights". Discord's senior platform security engineer, at $196,000 to $245,000, lists service identity through PKI and mutual TLS, zero trust access to internal tools, secrets management with rotation, and defining "what identity means for autonomous agents and other non-human actors".

The day looks more like a platform engineer's than an analyst's: design reviews, Terraform and policy code, moving services onto a new identity scheme, and stamping out one kind of misconfiguration across a fleet. Only 21% of these postings were remote, the lowest of the large branches, because many sit at data center, defense and hardware employers. The cloud-heavy version of this work has its own guide: how to become a cloud security engineer.

Product and application security

Product security keeps vulnerabilities out of what the company ships. Titles naming product security engineer (62) outnumbered those naming application security engineer (43), which reflects where the work now sits: inside product teams during design, not at the end as a test of finished code. Plaid's senior product security engineer, remote at $190,000 to $262,800, leads design reviews and threat models, examines "authentication, authorization, trust boundaries, sensitive data flows, and business logic", reads application code to judge whether fixes address the real risk, and asks for "strong software engineering fundamentals". Superhuman's posting, at $227,000 to $310,000, wants experience at "each touchpoint in a secure SDLC: threat modeling, design reviews, secure code reviews, and web app pentesting".

The most current shared map of what goes wrong in web software is the OWASP Top 10 for 2025, which puts Broken Access Control first and Software Supply Chain Failures third - OWASP. Bug bounty programmes were named in 76 postings across the sample, 64 of them in this branch, because triaging reports from outside researchers is part of the job. The board keeps a separate application security engineer title page (128 open roles at 90 employers late on 11 November) and a career guide to application security.

Detection and response engineering

Detection engineers build the machinery that notices intruders and helps people respond. Notion's posting states the philosophy outright: "We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters." That role, remote at $185,000 to $280,000, asked for three or more years and a place in "a shared on-call rotation for incident response". Block's senior detection and response engineer, at $217,800 to $326,800, commands major incidents and asks for six or more years of incident response and forensics. Databricks' staff incident response engineer, at $194,800 to $267,850, works a "distributed 24x7 operations and on-call schedule".

Incident response was named in 63% of this branch's 143 postings, on-call duty in 41% and Python in 75%, the highest of any branch. The difference from a SOC analyst is the direction of the work: an analyst works the queue, while a detection engineer writes the rules that fill it, cuts the noise out of it and builds the automation that speeds each investigation. The detection engineer title page lists the roles carrying that exact title.

Corporate, IT and identity security

This branch protects the company's own people and tools rather than its product: laptops and phones, the identity provider and single sign-on, multi-factor authentication, email, the SaaS applications staff use every day, and the routes by which data can leave. Coinbase's senior corporate security engineer, remote at $186,065 to $218,900, hardens macOS, Chromebook and mobile endpoints and must "identify and close data exfiltration paths introduced by local AI agents and developer tooling", with five years of security engineering including two on endpoints, and a "proven ability to write production code". Identity engineering sits at the senior end of this branch: Roblox's principal security software engineer for identity and access management states $326,060 to $385,050.

Its middle stated pay ($200,000) was the lowest of the large branches, and it is the branch closest to an IT or systems administration background (section 6).

Security software engineering

Some security engineers are software engineers whose subject is security: they build the products other security teams buy, or the internal platforms a large company's security team runs on. Palo Alto Networks, Zscaler, Elastic and SentinelOne were hiring for the first kind; Coinbase, Robinhood and Snowflake for security platforms of their own. Strip the company names and these 102 postings could pass for ordinary backend or systems engineering ads whose subject happens to be security. Go appeared in 62% of them, C or C++ in 35% and Rust in 21%, while only 2 of the 102 named any certification. Their middle stated pay, $242,000 from 38 ranges, was the highest of any large branch. For a working software engineer, it is usually the shortest path into security.

AI security

The newest branch secures AI systems themselves. Dropbox's senior AI security engineer tackles "prompt injection, secure agent access, and MCP integrations" and asks for eight or more years plus workload identity frameworks such as SPIFFE and SPIRE. Databricks posted a senior staff security software engineer for agentic security at $228,600 to $314,250. Sixty-three titles in the sample named AI as the branch, but the subject reaches much further: 218 postings (21%) named securing AI systems, agents or models somewhere in the text. The skills underneath are old ones pointed at a new target. An agent is an identity with permissions, a prompt is untrusted input, and a model pipeline is a supply chain, which is why NIST added a generative AI profile, SP 800-218A, to its secure software development framework - NIST. The board follows this work on its AI security roles page.

The remaining rows: assurance, customer-facing and generalist titles

Twenty-eight postings were assurance and GRC engineering seats, which automate compliance evidence and risk processes: Plaid's security engineer for GRC states $156,000 to $213,600. Readers drawn to that work should read the GRC analyst guide. Fifteen were customer-facing, mostly forward deployed security engineers at Stripe, OpenAI, Palantir and depthfirst, who build security inside a client's environment. The 150 titles that named no branch are the generalists: the first security hire at a startup ( Forus called its seat "Founding Security Engineer", at $180,000 to $300,000), cybersecurity engineers on defense programmes (19% of this row named a clearance) and Thales's French ingénieur cybersécurité postings.

3. What 1,020 open postings ask for

This section is the measurement behind the rest of the guide. A posting counts toward an item whenever its title or text names it, required or preferred, because most postings blur the two.

Seniority: a market of experienced hires

By the level written in each title, 348 postings (34.1%) carried no level word, 324 (31.8%) were senior, 173 (17.0%) staff, 60 (5.9%) principal or distinguished, and 59 (5.8%) were managers, directors or team leads. Only 20 (2.0%) were explicit mid-level titles such as "Engineer II", 19 (1.9%) were internships, co-ops or French stages, and 17 (1.7%) were junior, associate or new-graduate seats.

Do not read a missing level word as an open door: the 203 level-free postings that set a minimum wanted three years at the median.

Experience asked: a median of five years

A minimum number of years appeared in 629 postings. The median was five, and 441 of those 629 set the bar at five years or higher.

The middle request climbed by level: three years for titles with no level word, five for senior titles (218 stating a number), eight for staff (106), ten for principal (45) and seven and a half for managers (38). For someone without years to show, the 72 postings asking two or fewer are where to aim, and a few of them spelled out what counts. Coupa's associate security engineer asked for zero to two years "of experience in security, cloud, DevOps, IT, or software engineering" and added that "Internships, co-ops, research, and hands-on personal or lab projects count". Flexport's security engineer for product security, remote at $130,950 to $202,125, asked for typically two to five years and said "we care more about what you've built than the exact number".

Cloud, infrastructure and pipelines are a baseline

Nearly half the postings, 474 (46.5%), named one of the three large clouds: AWS 439 times (43.0%), Google Cloud 294 (28.8%), Azure 250 (24.5%). Kubernetes appeared in 345 (33.8%), CI/CD pipelines in 341 (33.4%), containers in 297 (29.1%), infrastructure as code in 283 (27.7%, with Terraform alone in 196) and Linux by name in 199 (19.5%). Cloud is no longer a specialty inside security engineering but the ground under all of it.

Security domains: identity leads, the rest run close

Identity and access (single sign-on, OAuth, SAML, least privilege, privileged access, the identity providers) led at 363 postings. Secure development (the SDLC, secure code review, static and dynamic analysis, the software supply chain) followed at 355, incident response at 352 and detection work at 347. Keys, secrets and cryptography appeared in 328 postings, network security in 316 and threat modeling by name in 297. The flatness of that list is the finding: no domain dominates, so employers expect competence across most of them and depth in one or two. Compliance frameworks (SOC 2, ISO 27001, FedRAMP, PCI DSS, NIST, CMMC) appeared in 279 postings, mostly as requirements the engineer's controls must satisfy.

Tools: many names, none dominant

Leaving out each vendor's references to its own products, Splunk led with 66 postings, ahead of Okta (56), CrowdStrike (47), Burp Suite (45), Wiz (43), Elastic (40), GitHub Actions (36), Ansible (35), Semgrep (31), Open Policy Agent (29), Tenable (27), Microsoft Sentinel (27) and HashiCorp Vault (23). A further 82 named a SOAR platform, generically or as Tines. No product appeared in more than about one posting in sixteen, so knowing each concept (a SIEM, an identity provider, a policy engine, a static analyser) through one representative tool beats chasing a vendor.

Degrees: named by a minority, waived by most of those

A degree came up in just 404 postings (39.6%), and in 250 of them (62%) the employer named a substitute, usually equivalent experience. Computer science was named in 348 postings and a PhD in 23, mostly research-flavoured AI security and cryptography roles. Defense employers spell out the trade: SpaceX's senior security software engineer for Starship asks for a bachelor's degree with four years in software development, "OR 6+ years of professional experience in software development in lieu of a degree".

On-call, remote work, clearances and location

On-call duty was named in 167 postings (16.4%), but unevenly: 41% of detection and response postings, 21% of corporate and identity postings, 11% of product security postings and 9% of infrastructure postings. Remote work was offered in 317 postings (31.1%). Of those, 227 were limited to one country, 152 of them to the United States, and 49 were open worldwide. Security services firms were the most remote-friendly employers (66% of their postings), followed by finance, payments and crypto companies (44%), while defense and space employers offered it in 5%. The remote security engineering list keeps the current set.

Clearances were named in 111 postings (10.9%), 68 of them at defense, space and hardware employers, where more than half of all postings asked for one, and 105 postings named US citizenship. Employers hiring cleared engineers are gathered on the cleared roles page. By location, 424 postings named a US workplace, 297 named no country (most of them remote), and India (64), Canada (38), Israel (35) and the United Kingdom (29) followed; the city pages count roles metro by metro.

AI appears twice: as something to secure, and as a tool to use

Securing AI systems was named in 218 postings, as above. Using AI in your own work appeared in more: 365 postings (35.8%) at 148 employers expected engineers to apply language models, coding assistants or agents to the job itself. Plaid's product security posting asks the hire to "leverage AI-assisted security analysis and testing"; Block wants "an established AI-assisted workflow"; Brain Co.'s new-graduate role asks people to "use AI and LLMs to automate work that previously required manual review: triaging findings, generating fixes, summarizing risk". First-pass reviews and triage are what automation absorbs first; judgment about which findings matter, and the controls that remove whole classes of them, is what employers pay more for.

4. How much coding the job takes

Does the job mean programming? The postings answer clearly: 735 of the 1,020 (72.1%) named some programming or scripting language, and many of the rest asked for automation in other words.

Python is the common tongue at 627 postings (61.5%), and Go is a strong second at 358 (35.1%), well ahead of every other language. Python is how security engineers glue systems together (pulling logs, calling APIs, writing detections), and Go is what much cloud-native infrastructure and security tooling is written in. C and C++ (159 postings) and Rust (109) cluster where the work touches operating systems, endpoints, firmware and security products, and TypeScript or JavaScript (169) where it touches web applications.

The branches differ sharply. Python appeared in 75% of detection and response postings, 71% of AI security postings and 67% of product security postings, but in only 43% of assurance and GRC engineering postings. Go appeared in 62% of security software postings against 27% of detection postings. Seniority matters too: 75% of staff postings named a language, against 36% of manager and director postings.

What kind of code, and how good it has to be

The more revealing question is what the code is for. Postings describe four kinds:

• Automation and glue, named in some form in 659 postings (64.6%): scripts and small services that enrich alerts, rotate secrets, open tickets or check configurations.
• Tools and services the engineer builds and maintains, named in 306 postings (30.0%): an access broker, a scanning service, an internal security platform, a detection pipeline.
• Policy and detections as code: rules stored in version control, reviewed like any change and tested before they ship. Notion's line about detections being code is the clearest statement of the idea, and Open Policy Agent, named in 29 postings, is a common engine for it.
• Product code, in the security software branch and inside product security teams that ship secure libraries and defaults for other engineers to use.

How good does it need to be? 194 postings (19.0%) used the words production code or production systems, 178 (17.5%) named code review, and 156 (15.3%) named distributed systems. Only 42 (4.1%) mentioned data structures or algorithms, which tells you the bar is maintainable code that runs in production, not puzzle-solving. Coinbase's corporate security posting makes the standard explicit: a "proven ability to write production code (services, integrations, automations)". The gap between scripting and engineering is tests, reviews, deployment, monitoring and someone else being able to change your code next year.

Who codes the least

Assurance and GRC engineering, customer-facing roles and part of corporate IT security can be done with scripting rather than software engineering, and the generalist titles that name no branch mentioned Python in 49% of postings and Go in 17%. If you dislike writing code, the GRC analyst guide describes a security career built on other strengths; if you enjoy it, code is what most separates a security engineer from the rest of the field.

5. A security engineer roadmap: skills in the order they compound

A posting's skills section reads like a shopping list, yet each item makes the next easier to learn and more useful, so sequence matters. Here is a sequence built from what the 1,020 postings ask for, with a test for each step.

Step 1: systems and networks from the inside

Every control you will build sits on an operating system and moves data over a network. You need to know how Linux decides who may do what (users, groups, permissions, capabilities, services, how processes inherit rights), how a request travels through DNS, TCP and TLS to an HTTP server, and where each layer writes down what happened. Network security was named in 31.0% of postings and Linux in 19.5%, and both are assumed far more often than named. Test: explain every step of loading a web page, and lock down a fresh Linux server so you can say why each change matters.

Step 2: one real programming language, then a second

Python first, because 61.5% of postings name it and it automates everything that follows. Aim beyond scripts: tests, version control, review, deployment, upkeep. Then add Go for infrastructure work or TypeScript for product security. Test: you have built and maintained a small service someone else uses.

Step 3: identity and access

Identity was the most named domain (35.6%) because most real intrusions now run through credentials rather than exotic exploits, and because every other control depends on knowing who or what is asking. Learn how authentication differs from authorization, how single sign-on works through SAML and OpenID Connect, what OAuth tokens grant and how they leak, how roles and policies express least privilege, and how service accounts and AI agents become identities too. Test: you can design access for a new internal tool so that granting and removing it needs no human ticket.

Step 4: cloud and infrastructure as code

With 46.5% of postings naming a major cloud and 33.8% naming Kubernetes, this is the platform where steps 1 to 3 now play out. Learn one provider's identity and networking model deeply, write infrastructure with Terraform, and understand how Kubernetes isolates (and fails to isolate) workloads. It follows identity because cloud security is mostly identity security under new names. The cloud security engineer guide covers this step in depth.

Step 5: secure development and threat modeling

NIST's Secure Software Development Framework, version 1.1 (SP 800-218, published February 2022), describes "a core set of high-level secure software development practices that can be integrated into each SDLC implementation" - NIST CSRC. It groups them into four families: prepare the organization, protect the software, produce well-secured software, and respond to vulnerabilities - NIST SSDF project. The OWASP Top 10 for 2025 tells you which web flaws matter most, and OWASP's Application Security Verification Standard, now at version 5.0.0, turns them into testable requirements - OWASP ASVS. CISA's Secure by Design initiative frames the same idea as a manufacturer's duty, saying products should be secure out of the box with features such as multi-factor authentication, logging and single sign-on "available at no extra cost", and more than 200 software manufacturers have signed its pledge - CISA. Threat modeling, named in 29.1% of postings and in 54% of product security postings, is the habit that ties these together. Test: you can threat model a feature in an hour and turn the result into three concrete engineering tasks.

Step 6: logging, detection and incident response

A control you cannot observe is one you cannot trust. Learn what your systems log, how logs reach a SIEM, how to query them, and how to write a detection that fires on an attack and stays quiet otherwise. MITRE ATT&CK, "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations", is the shared vocabulary for mapping what you detect - MITRE ATT&CK. Then learn the shape of a response: scoping, containment, evidence, communication and the postmortem. Incident response was named in 34.5% of postings across every branch, because whoever built a system is often called when it is attacked. Test: you can write a detection for one ATT&CK technique, prove it fires against a simulated attack, and estimate its false-positive rate.

Step 7: keys, secrets and applied cryptography

Named in 32.2% of postings, this is where many engineers stay shallow. You need not design ciphers, but you do need to know how TLS and certificates work, how key management services and secrets managers hold keys, and how to rotate a credential without an outage. Test: you can design how a fleet of services gets and rotates its database credentials.

Step 8: one branch, chosen deliberately

Only now does specialization pay. Pick the branch from section 2 whose day you want: design reviews and code, systems, investigations, product software, or the newest problems in AI security. Steps 1 to 7 let you apply across the market; depth on top of them is what staff postings describe.

The skill that runs beside all of them: writing

Security engineers persuade more than they command: a control another team must adopt needs a design document that explains the risk, the options and the cost. Design reviews or security reviews were named in 237 postings (23.2%) and mentoring in 318 (31.2%), and both are writing and explaining at heart. Google's free book Building Secure and Reliable Systems is one long argument for treating security and reliability as the same engineering discipline, and it is worth reading at this stage - Google SRE.

6. Routes in, starting from your current job

Thirty-six entry-level postings in 1,020 means that the realistic question is rarely "how do I start in security engineering" and usually "which neighbouring job fills my gaps in the roadmap and points straight at this one". Each route below starts from a job and names the branch it reaches most naturally.

From software engineering

This is the most direct route, and the postings say so. At least 71 postings at 46 employers wrote software engineering or software development into the experience that qualifies, sometimes adding "with a security focus". Figma's security engineer posting, remote at $153,000 to $376,000, asked for "5+ years of proven engineering experience working in either a Security Engineering or a Software Engineering role", adding that in the second case "some security experience is preferred". Anthropic's detection and response engineer, at $300,000 to $405,000, accepted "3+ years of software engineering experience, with security experience a plus", as an alternative to five years in detection or response. A software engineer already holds steps 1 and 2 and usually some of 4; what is missing is identity depth, threat modeling and the response habit.

The shortest bridges are inside your current employer: volunteer for threat models and security reviews, take the security fixes nobody wants, build a secure default for your team, then aim at product security or security software engineering.

From site reliability, DevOps and platform engineering

Infrastructure engineers hold steps 1, 2 and 4 and are often already on call, so the move into infrastructure and platform security is short. MongoDB even titles some of these seats as site reliability engineers for infrastructure security, hardening hosts with AppArmor, SELinux, seccomp and eBPF tooling. The missing pieces are usually identity design, detection and asking how a system could be abused rather than how it could fail; leading your platform's secrets management or production access work supplies both the skills and the interview stories.

From a security operations seat

SOC analysts and incident responders hold step 6 and know what attacks look like in logs, which is exactly what detection engineering needs. The usual step is from working alerts to writing the rules and automation behind them. Samsara's security operations engineer I, at $95,200 to $144,000, describes that level as "a collaborative apprenticeship" for people who "have built foundational experience in a SOC", and Notion's detection posting says "We're hiring across a range of experience levels". The skill to add is software engineering, because detection engineers are judged on code and measurement as much as on investigation. The SOC analyst guide covers the seat this route starts from.

From IT, help desk and systems administration

Administrators know identity providers, endpoints, email and SaaS from the inside, which is most of what corporate security protects. The natural first target is the corporate, IT and identity branch: hardening laptops, rolling out single sign-on and stronger login checks, device management and controls on data leaving the company. The step to add is code: turn the manual parts of your current job into scripts, then into small services. Security services firms are another door here; they offered remote work in 66% of their postings and hire implementation engineers for specific products, although few of their postings print pay, and the handful that did sat near the bottom of the sample.

From school: internships and new-graduate seats

Students have a real door, but it is narrow and early. The sample held 19 internships and 17 junior or new-graduate seats, and the paid ones were good. Illumio's product security engineering intern was paid $37 an hour, Appian's information security engineering intern $50, Verkada's security software engineering intern $55 to $65, and Figma's PhD security engineering intern $74. Brain Co.'s 2027 new-graduate AI security engineer, remote at $140,000 to $190,000, said "You don't need prior security experience" and promised to teach the security domain "through code reviews, design discussions, pairing, and real ownership from day one". SpaceX's new-graduate software security engineers for Starlink were offered between $130,000 and $175,000 across its postings, for a computer science or other STEM degree and experience in "Python, C++, Golang". Anduril Industries' 2027 new-graduate information security engineer, at $88,000 to $117,000, would harden Windows and Red Hat systems to DISA STIGs, run Tenable scans and write the documentation that earns a system its authorization to operate.

The pattern: new-graduate seats hire software engineers interested in security, not security students who cannot build, and they recruit a year ahead. The internships page and the entry-level roles page list today's openings; the latter counted 22 junior security engineering roles late on 11 November, with a typical $103,000 to $166,000.

From the military and cleared government work

Holding a clearance opens a separate set of seats: 68 postings at defense, space and hardware employers named one, and the generalist cybersecurity engineer titles there value it above almost anything else. Rocket Lab's cybersecurity engineer II, which requires a Secret clearance, stated $108,000 to $148,000 for two years of experience. Fourteen postings cited the Department of Defense's 8570 or 8140 rules. Cleared engineers can follow those employers through the cleared roles page.

Without a technical job today, none of these routes begins with an application for a security engineering post. The first move is the technical job itself, and the guide to getting into cybersecurity sets out how to land it; the career paths guide shows how engineering sits among the other specialties.

7. Certifications: what postings name, and how often none

Certifications matter less in security engineering than in any other large part of the field, and the counts make that plain: 817 of the 1,020 postings (80.1%) named no certification at all. The other 203 named at least one, as a requirement, a plus, or one of several options.

The CISSP leads, gently. It appeared in 123 postings (12.1%) at 63 employers. In most of them it sat next to words such as preferred, a plus, such as or equivalent; only 18 of the 123 had none of those words nearby. It also carries a gate worth knowing before you plan around it: ISC2 requires "a minimum of five years cumulative, full-time experience in two or more of the eight domains", with a degree or an approved credential able to cover up to one year, and a candidate who passes without the experience becomes an Associate of ISC2 with six years to earn it - ISC2. That makes it a mid-career credential by design, not a way in.

The rest are scattered. GIAC certifications appeared in 75 postings (7.4%), the OSCP in 46, AWS certifications in 41, the CISM in 39, the CCSP in 35, Security+ in 30 and the CEH in 27. Kubernetes certifications (CKA or CKS) appeared in only 16, despite Kubernetes itself appearing in 345 postings, which is the clearest sign of all that employers want the skill rather than the badge.

It depends heavily on the branch and the employer. Half the assurance and GRC engineering postings named a certification (14 of 28), as did 31% of the generalist titles and 54% of postings from security services firms (22 of 41), whose clients and government contracts often demand them. At the other end, 11% of AI security postings and 2 of 102 security software postings named one. Defense work is the main exception to the general rule: the 14 postings that cited DoD 8570 or 8140 make a baseline certification such as Security+ a real requirement.

Across the whole board the picture is the same with different weights: the certifications page ranks every certification by the postings naming it today, and it shows the CCSP, the CEH and AWS certifications asked for most often in security engineering, while the CISSP page follows that credential alone.

A sensible order, if you want one. For defense or services work, Security+ meets the baseline those postings cite. For cloud infrastructure, one provider's security certification can give step 4 a structure. The CISSP fits once you have its five years and want leadership or architecture. For everyone else, the 80% figure is the advice: something real you built and shipped is read more closely than any certificate.

8. Security engineer salary by level, branch and employer

Across the 391 distinct salary ranges printed in US postings in the sample, from 125 employers, the middle bottom of a range was about $189,000, the middle top $253,000 and the middle of the midpoints $220,000. The spread is wide: one midpoint in ten sat below $152,000 and one in ten above $343,000. Hourly figures (internships) are counted as a year at 2,080 hours, as the board counts them.

By level

Two oddities in that table are explained by who is hiring. Titles without a level word outrank senior titles because 30 of those 119 ranges come from AI labs, which title engineers without levels and pay at the top of the market; without them, the no-level middle falls to $210,000. Principal titles fall below staff because 16 of the 34 principal ranges come from security vendors, whose ranges run lower at every level. Read within one kind of employer, pay climbs as you would expect, and the big step is from senior to staff: at software and internet companies the middle rose from $213,750 for senior titles (39 ranges) to $250,000 for staff titles (30).

The entry rung has too few ranges for a statistic, so here are the seats themselves: Anduril Industries' new-graduate information security engineer at $88,000 to $117,000, Samsara's security operations engineer I at $95,200 to $144,000, SpaceX's Starlink new-graduate software security engineers between $130,000 and $175,000, and Brain Co.'s remote new-graduate AI security engineer at $140,000 to $190,000.

By kind of employer

The order follows what each employer is buying. An AI lab (47 ranges) protects model weights worth vastly more than any salary while competing for a small pool of people. Security vendors (60 ranges) came last, and the gap holds at the same level: senior titles at vendors stated a middle of $174,000 (14 ranges) against $213,750 at software companies. One plausible reason is supply, since a vendor recruits from a large pool that includes its own customers' security teams.

By branch and by workplace

Security software engineering stated the highest middle of the large branches ($242,000 from 38 ranges), followed by infrastructure and platform ($227,000), AI security ($227,500), product and application ($225,000), detection and response ($207,500), corporate, IT and identity ($200,000) and assurance and GRC engineering ($177,000). Remote postings stated a middle of $225,000 across 139 ranges against $215,606 for on-site or hybrid ones across 252, so working remotely carried no discount here.

The board's salary page and the national baseline

The board's security engineer salary page reads only the security engineering specialty, a narrower set than this guide's, and late on 11 November it put the usual span at $173,000 to $374,000 and the midpoint at $210,000, from 309 distinct ranges at 116 employers, split by level, workplace and employer. Its highest-paying jobs ranking placed principal or staff security engineer third of eighteen jobs at $228,000, AI security engineer fifth at $213,000 and security engineer tenth at $200,000.

Federal statistics do not track security engineers as an occupation of their own. The nearest one the Bureau of Labor Statistics publishes, information security analysts, counted roughly 192,900 jobs in 2025 and paid a median of $129,180 a year in May 2025; it expects 21% growth between 2025 and 2035, or some 14,100 openings each year - BLS Occupational Outlook Handbook. The government figure covers every employer, region and level, while this board reads mostly technology employers hiring experienced engineers, so a fair first offer at a regional employer can sit well below the board's middle. The salary calculator checks a specific offer against open postings.

9. Security engineer vs software engineer

The two jobs share tools and often share code, but they optimize for different things, and that difference is what to weigh when choosing between them.

The government medians come from the same handbook, which counted about 1.7 million software developers in 2025 and projected their occupation to grow 10% from 2025 to 2035 - BLS Occupational Outlook Handbook. Software development is the larger field by an order of magnitude, while security is growing about twice as fast.

On this board the comparison tilts the other way, and the detail is instructive. Security postings whose title contains the word "software" (security software engineer, software engineer for security and the like) stated a middle midpoint of $243,750 across 93 ranges, against $215,000 for the other 298. That premium held inside each kind of employer except the AI labs, where both stood at $362,500: $270,990 against $226,350 at software and internet companies, $240,625 against $204,600 at cloud and data companies, and $202,500 against $185,500 at security vendors. The market pays most for software engineering's standard of code applied to security's problems, which is why moving from software into security rarely costs a pay cut.

Choose software engineering to make the product itself. Choose security engineering if adversarial thinking appeals, you enjoy working across many teams' systems, and you can accept that success often means nothing happened. The doors stay open both ways.

10. The interview loop: coding, system design and threat modeling

Postings rarely describe their interview process: only three in the sample, at two employers, spelled out a coding round. Nebius described its loops step by step: a 30-minute recruiter chat, a 60-minute live-coding interview "to asses basic coding skills", a 60-minute security interview on domain knowledge, then a 90-minute security system design interview for its application security role (or a 90-minute incident response interview for its detection role), an optional 90-minute deep dive on a past project, and a 45-minute close. DataDome's senior security engineer gets a take-home technical challenge and then presents the resulting "technical proposal" to the team. Pinterest tells candidates its interviews will explore "how you collaborate with AI".

From those loops and the skills postings name, expect four kinds of round:

Practical coding. With data structures or algorithms named in only 4.1% of postings, the coding round is usually a realistic task rather than a puzzle: parse a log file and flag suspicious sessions, write a small service that checks an access policy, find and fix the flaw in a request handler, or automate a dull manual step.

Security system design. You are handed a system to secure or a security system to build: distribute secrets to a fleet of services, give engineers just-in-time access to production, isolate tenants in a multi-tenant database, design the pipeline that takes logs from thousands of hosts to detections. Good answers start with what is protected and from whom, then weigh security against reliability, cost and friction aloud.

Threat modeling. A feature arrives (a password reset flow, a file upload, an AI agent with tool access) and you walk through what can go wrong using the four questions from section 1, ranking threats by impact and likelihood and proposing fixes engineers will actually adopt. This round decides most product security loops.

Domain depth and behaviour. A branch-specific deep dive (Kubernetes isolation for infrastructure roles, an incident walk-through for detection roles, endpoint controls for corporate security) followed by questions about influence: how you persuaded a team to adopt a control it did not want, or how you handled an incident you caused.

The interview questions guide works through worked answers across specialties, including application security, cloud and identity questions that reappear in engineering loops, while the interview practice tool gives feedback on spoken answers to a technical round. A step earlier, the cybersecurity resume guide covers putting the systems you built, the vulnerability classes you closed and the incidents you handled onto one page.

11. Where the career leads after senior

The sample shows three directions above senior, and many careers combine them.

The technical track: staff and principal. Staff (173 postings) and principal or distinguished titles (60) together made up nearly a quarter of the sample. Their middle requests were eight and ten years; staff engineers own a problem across many teams, principal engineers set direction for an area. OpenAI's principal infrastructure security engineer will "set technical direction and drive execution on high-impact infrastructure security programs", at $401,000 to $510,000. Roblox's principal network security engineer asks for eight years at $326,060 to $385,050. The board's principal and staff security engineer title page held 332 open roles at 114 employers late on 11 November, with a typical $203,000 to $383,000.

Architecture. Security architects set the patterns many teams build on; the move suits engineers who prefer breadth to building. On the board's ranking, security architect sat seventh at $208,000, below principal and staff engineers, which says the technical track does not need an architect title to keep rising.

Management. Fifty-nine postings were manager, director or team lead seats, asking a median of 7.5 years and stating a middle midpoint of $245,000. Discord's engineering manager for platform security, at $248,000 to $310,000, wanted "3+ years of experience as people manager, having managed a team of 3+ security software engineers", plus "comfort with writing the roadmap, not just following one". Crusoe's director of infrastructure security, at $285,000 to $335,000, asked for ten years of security engineering including five leading multi-team organizations. Further up, the board's ranking places security directors second at $265,000 and CISOs first at $300,000, but those seats are few.

The tracks need not be chosen early, and many engineers try management and return. All three share the skill section 5 put beside everything else: explaining risk so that people act on it.

12. Security engineer questions, answered

What is a security engineer's job, day to day?

Designs, builds and runs the controls that keep an organization's systems from being misused: identity and access systems, secure development pipelines, detections and incident response tooling, hardened infrastructure, and key and secrets management. Postings describe at least six branches (section 2), and 72% of them name a programming language.

From a first tech job, how many years until a security engineering role?

Usually several years from a first technical job. The 629 postings that set a minimum wanted five years at the median, and level-free titles three. Software, infrastructure and SOC experience all count toward those years, so someone with three years of software or SRE work is often closer than they think.

Can you become a security engineer with no experience?

Rarely directly. Just 36 of the 1,020 postings targeted interns, new graduates or juniors, and most of those wanted a computer science degree or proof of building things. The workable route is a software, infrastructure, IT or SOC job first, with the roadmap in section 5 learned alongside it.

Do security engineers need to code?

In most postings, yes: 72.1% named at least one language, Python in 61.5% and Go in 35.1%. The standard is maintainable code that runs in production, not competitive programming; data structures or algorithms appeared in only 4.1% of postings.

What do security engineers get paid, from intern to staff?

In US postings on this board, the middle of the stated range midpoints was $220,000 on 12 November 2026, rising from about $200,000 for senior titles to $248,000 for staff titles, and today's band for the specialty is $173k/yr to $374k/yr. AI labs paid most and security vendors least. The government's closest figure, for information security analysts across all employers, was a median of $129,180 in May 2025.

What is a product security engineer?

A security engineer embedded with product teams who keeps vulnerabilities out of what the company ships, through threat models, design and code reviews, secure defaults and triage of outside reports. It is the same family as application security engineer, and on 12 November product security titles outnumbered application security titles 62 to 43 in this sample. The board's open roles in that specialty are on the application security list.

Which certification is best for a security engineer?

None is required in most cases: 80.1% of postings named no certification. The CISSP was named most (12.1%), usually as a plus, and it needs five years of experience to award in full. Defense and services employers are the exception, where a baseline such as Security+ is often a real requirement.

Is a college degree required for security engineering jobs?

Most postings did not ask. A degree appeared in 39.6% of them, and 62% of those let experience stand in for it. A degree matters most for new-graduate seats and some defense employers.

Is security engineering a remote job?

Often. 31.1% of postings were remote, most of them limited to one country, and finance and security services employers offered it most. Infrastructure roles at data center, hardware and defense employers were the least remote, at 21% for that branch and 5% at defense employers.

Will AI replace security engineers?

It is changing the work rather than removing it. 35.8% of postings expected engineers to use AI in their own work, and 21.4% hired them to secure AI systems. Routine review and triage are what automate first; designing controls, judging risk and securing the AI systems themselves are where demand is growing.