What is a security engineer?
Definition
A security engineer is a person who designs, builds and tests the protections that keep computer systems and data safe, such as secure software, networks and access controls.
- Category
- Security
- Also called
- information security engineer, cybersecurity engineer, information systems security engineer
- Last updated
There is no single official definition, and employers use the title in different ways. CISA's work role framework lists "Security Engineer" and "Information Systems Security Engineer" among the alternate titles for its Systems Developer role, whose tasks include designing hardware, operating systems and applications to meet security requirements.
NIST takes a similar view in its glossary: it defines the discipline by the work involved, so anyone doing systems security engineering counts, whatever the job title says.
What the work looks like
In practice, a security engineer defines security requirements, looks for weaknesses, and designs protections that stop problems or limit the damage. That can include building secure systems, testing them and reviewing the controls around them. Some employers add monitoring and incident response, which overlap with the information security analyst role described by the US Bureau of Labor Statistics: monitoring networks for breaches, checking for weaknesses and recommending improvements.
Why it matters to an ordinary person
You rarely meet a security engineer, but you rely on their work every time you sign in, pay online or store a document in the cloud. How well a company's systems are designed decides how much of your data can leak.
Security engineer vs. related roles
- Security analyst mostly watches for attacks and investigates them.
- Hacker is a broader word, and can mean someone who breaks into systems or someone who tests them with permission.
- Digital forensics investigates what happened after an incident.
How to protect yourself
- 1
Choose services that take security seriously
Look for two-factor authentication, clear breach notices and a privacy policy that says how your data is protected.
- 2
Turn on every security option you're offered
Two-factor authentication, sign-in alerts and device lists are built by security teams for you to use.
- 3
Keep devices and apps updated
Updates often fix security flaws that engineers have found and patched.
- 4
Cut down what's exposed about you
Strong systems protect what a company holds, but not what is listed on people-search sites. Serus finds where your details are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What does a security engineer do?
Designs, builds and tests security protections for systems. CISA's role description centres on designing systems to meet security requirements.
What is the difference between a security engineer and a security analyst?
Engineers mostly design and build protections. Analysts mostly monitor and investigate. Employers draw the line differently, so job ads vary.
Do you need a degree to be a security engineer?
Requirements vary by employer. Check the specific job posting or a source such as the US Bureau of Labor Statistics outlook pages.
Sources
Something wrong or out of date? Tell us and we'll re-check it.