FindAJobAI
Get started
Job description · written by the FindAJobAI team

Security Engineer Job Description (2026): Duties, Skills and Salary

A security engineer protects a company's systems, data and customers by building and running security controls. Depending on the team, that means cloud and infrastructure security, application security reviews, detection and incident response, identity and access management, or compliance work under frameworks such as SOC 2 and ISO 27001.

Unlike a security analyst, who mainly monitors and investigates alerts, a security engineer builds: hardened configurations, automated checks in CI, detection rules, secure-by-default libraries. They work with engineering teams across the company, so explaining risk in practical terms matters as much as technical depth.

Security Engineer job description template

Copy it, replace everything in [brackets] and cut what doesn't apply. Keep the requirements to what the job really needs.

Template · replace the [brackets]

Security Engineer

[Company] · [City and office days, or remote with the countries or time zones you hire in] · [Full-time]

About [Company]

[Two or three sentences on what your company does, who it serves and why this team matters now.]

About the role

We're hiring a security engineer to strengthen how we protect [product] and our customers' data. You'll work across [cloud security / application security / detection and response], build controls engineers don't have to think about, and lead our response when something goes wrong.

What you'll do

  • Find and fix vulnerabilities across [cloud accounts, applications and endpoints], prioritized by real risk.
  • Build security into CI/CD: dependency scanning, static analysis, secrets detection and infrastructure policy checks.
  • Write and tune detection rules in [SIEM], and investigate and respond to security incidents.
  • Run threat modeling and security reviews with engineering teams on new features.
  • Manage identity and access controls, including SSO, MFA and least-privilege roles.
  • Support [SOC 2 / ISO 27001 / PCI DSS] compliance, automating controls where you can.
  • Train engineers in secure coding and staff in spotting phishing.

What you'll bring

  • [X]+ years in security engineering, or in software or infrastructure work with a strong security focus.
  • Hands-on experience securing [cloud provider] environments and Linux systems.
  • Knowledge of common attack techniques (OWASP Top 10, MITRE ATT&CK) and how to defend against them.
  • Coding in Python, Go or similar for automation.
  • Experience handling security incidents from detection to post-incident review.
  • The ability to explain risk to engineers and executives without jargon.

Nice to have

  • OSCP, CISSP, CCSP or GIAC certifications.
  • Penetration testing or red team experience.
  • Kubernetes security and container image scanning.
  • Running a bug bounty program.

What we offer

  • [Pay range: e.g. $X–$Y base salary, plus bonus or equity if offered]
  • [Training and certification budget, security conference attendance, on-call pay]
  • [Health cover, retirement or pension plan, paid time off, parental leave]
  • [Work authorization: whether you can sponsor a visa or hire through an employer of record]

[Our process: a recruiter call, a technical interview on a realistic threat scenario, a hands-on review of vulnerable code or a cloud configuration, and a meeting with the engineering leads you'd partner with.]

[Your equal opportunity statement, and how candidates can ask for adjustments during the process]

Put the pay range in the ad. Several US states, including California, Colorado, New York and Washington, require it in job postings, and the EU Pay Transparency Directive gives applicants the right to know the starting pay or its range before the interview.

What real security engineer job ads ask for

The skills named most often in the 504 newest security engineer job ads we analyzed (out of 2,841 live postings), as the share of ads that mention each. A skill most ads name is a fair must-have; one few ads name belongs under nice-to-have.

  1. 1Incident management40%
  2. 2AWS35%
  3. 3Python35%
  4. 4Cloud security30%
  5. 5Azure28%
  6. 6Vulnerability management27%
  7. 7NIST26%
  8. 8Auditing24%

Certifications mentioned most: CISSP (26%). Degrees mentioned most: Bachelor's degree (40%), Computer Science (35%), Master's degree (10%).

From live job ads · computed November 2, 2026 · refreshed daily

Security Engineer duties by seniority

What the job usually looks like at each level. Pitch the ad at one level and say which in the title.

Junior

  • Triages scan results and alerts with guidance.
  • Maintains security tooling and documents findings.
  • Gathers evidence for access reviews and audits.

Mid-level

  • Owns a security area such as cloud, application or detection.
  • Leads incident investigations and threat modeling sessions.
  • Automates controls and fits security into developer workflows.

Senior

  • Sets security architecture and program priorities with leadership.
  • Leads major incidents, coordinating legal, communications and customers.
  • Builds the security roadmap and mentors the team.

Security Engineer career path

  1. Security Analyst
  2. Security Engineer
  3. Senior Security Engineer
  4. Security Architect or Security Manager

Security engineers often move in from system administration, networking, software development or a security operations center (SOC) analyst job. Specialties branch out from there, including application security, cloud security, detection engineering and penetration testing, and senior paths lead to security architecture, management and eventually CISO roles.

Advertised pay for security engineer jobs

Median advertised base salary in Security Engineer job ads in the United States: $182,500 (middle half: $140,800–$221,600), from 553 job ads with a published salary in the last 90 days.

This is advertised pay, not total compensation: bonuses, commission, equity and benefits aren't included, and many ads publish no pay at all.

Similar roles

All job descriptions

Security Engineer job description FAQ

What does a security engineer do?

Builds and runs the controls that protect a company's systems and data: fixing vulnerabilities, securing cloud and code, writing detection rules, responding to incidents and supporting compliance, working with engineering teams so security is built in rather than bolted on.

Security engineer vs security analyst: what's the difference?

Analysts mostly monitor alerts, investigate events and report on risk, often in a SOC. Engineers design and build the defenses and tooling. Many engineers start as analysts, and job ads use both titles loosely, so describe the actual work.

Which certifications should a security engineer job description ask for?

Usually none as hard requirements. CISSP suits senior and management-leaning roles, OSCP signals hands-on offensive skill, and cloud security certifications suit cloud-focused roles. Listing them as nice-to-have keeps strong engineers without them in the pool.