Security Engineer Job Description Template 2026

Last updated: May 23, 2026 | By Mike Carter

A security engineer in 2026 designs, builds, and operates the controls that keep an organization’s code, cloud, network, and endpoints from getting owned, with U.S. base comp ranging from $115,000 at mid-level to $245,000 at staff, varying widely by specialization. Most postings stall because the JD names a generic “security engineer” when the work is actually one of four very different jobs.

Mike Carter, partner at KORE1. I run the commercial side of our staffing practice, which means I sit in on a lot of intake calls and a lot of debriefs that start with the same sentence: “we posted this six weeks ago and the senior people just aren’t applying.” It is almost never the comp. It is the listing. In 2026 a security engineer job description is competing against listings from CrowdStrike, Wiz, Palo Alto Networks, and every cloud-native vendor that pays in equity. A generic posting written off a 2019 template lands in the same inbox as those, and the senior candidates worth landing keep scrolling.

I am writing this from the side of the desk that watches what works in market, not from the side that runs the technical interview. The template below is what our cybersecurity staffing recruiters open every kickoff with, and it is what we hand to clients building the search internally. It saves three weeks on the average senior security req when the hiring manager actually uses it.

Disclosure on the table. KORE1 collects a placement fee when a client hires through our IT staffing services practice, security is one of our highest-volume verticals, and the template below makes our recruiters’ lives easier. It also makes yours easier whether you ever talk to us or not. Read accordingly.

One thing that has changed since 2023 deserves naming up front. The security talent market is no longer one market. Cloud security engineers fluent in Wiz, Prowler, and Terraform Sentinel pull twenty to thirty percent more than network security engineers running the same number of years. Application security engineers who can actually read a Java codebase and write a Semgrep rule clear two hundred thousand in non-coastal metros. A “Senior Security Engineer” posting that does not name which of those archetypes it is closes in nine weeks instead of three. Pick the archetype on the kickoff. Write the JD against it. The rest of this post is the framework for doing both.

Four Security Engineer Archetypes Most JDs Conflate

The security engineer title in 2026 splits into four distinct hiring profiles: cloud security engineer, application security engineer, network and infrastructure security engineer, and detection and response engineer. Each commands its own comp band, reports through its own org, and reads a JD with different keywords.

This is not academic. It is a $20,000 to $40,000 spread inside what looks like the same title, and a posting that does not pick a lane will sit open while the candidate worth landing reads the first three bullets, decides the company has not figured out what it actually needs, and moves on. Senior security candidates have options. They use JD quality as a signal about engineering culture before they hit Apply.

Cloud Security Engineer. The fastest-growing archetype and the one with the deepest comp band. Owns IAM at scale, cloud-native detection in AWS Security Hub or Azure Sentinel or Google SCC, and the guardrails that keep developers from shipping a public S3 bucket on a Friday afternoon. Lives in Terraform and Open Policy Agent. Writes Service Control Policies. Knows the difference between a permission boundary and a trust policy without thinking about it. The strongest cloud security engineers we place have ten thousand lines of HCL in their commit history and can talk through how they cut alert volume in half by tuning GuardDuty plus a custom Lambda. Mid-level base lands $135,000 to $170,000 in most metros and $155,000 to $195,000 in San Francisco, Seattle, and New York. Senior pulls $170,000 to $220,000. Staff and principal clear $215,000 to $260,000 at product companies and a chunk higher at the AI-first ones.

Application Security Engineer. AppSec. Sits next to the development organization, not the SOC. Reviews code. Writes Semgrep and CodeQL rules. Runs threat models on new services before they ship. Owns the SAST and DAST pipeline plus the secrets-scanning that catches the AWS key someone forgot to gitignore. The best ones in this archetype write code that ships. They are not running scanner reports and forwarding tickets. They are sitting in pull request reviews and rewriting the vulnerable function themselves when the engineer who introduced it is on PTO. Mid runs $130,000 to $165,000. Senior $165,000 to $210,000. Staff at security-mature product companies clears $220,000. The single biggest mistake hiring teams make in this archetype is writing a JD that reads like a compliance role. The candidates worth landing are software engineers who chose security. They want the language of code review, not the language of audit.

Network and Infrastructure Security Engineer. The traditional archetype and still a big chunk of the market, especially in financial services, healthcare, and any regulated vertical where on-prem is still half the footprint. Owns firewall rule sets in Palo Alto or Fortinet, network segmentation, VPN and ZTNA architecture, endpoint hardening through CrowdStrike or SentinelOne, and the patch-management cadence that decides whether the next ransomware attempt lands. Reads Wireshark captures the way a developer reads logs. Comp is more compressed than cloud or AppSec because the supply side is bigger. Mid $115,000 to $145,000. Senior $145,000 to $185,000. Lead and staff $185,000 to $225,000. Regulated verticals add seven to twelve percent, sometimes more for cleared candidates in the federal contracting space.

Detection and Response Engineer. Sometimes posted as Security Engineer, sometimes as SOC Engineer, sometimes as Incident Response Engineer, and the conflation costs hiring teams real money. Lives in the SIEM. Writes detection rules in Sigma or Splunk SPL or KQL. Builds the SOAR playbooks. Tunes alerts down from twelve thousand a day to eighty. Holds the pager when the threat actor actually shows up. Comp lands $125,000 to $160,000 at mid, $160,000 to $200,000 at senior, $200,000 to $245,000 at staff and lead positions in financial services and tech. The JD has to name the SIEM. Splunk people and Sentinel people and Chronicle people are different talent pools, and a generic detection-engineer listing pulls applicants from none of them.

Sources: Bureau of Labor Statistics (15-1212 Information Security Analysts), Glassdoor (May 2026), PayScale (2026), Levels.fyi (2026), KORE1 internal placement data 2025-2026. 25th to 75th percentile. Coastal metros add 15-22%. Cross-reference with our security engineer salary guide for the full per-metro breakdown.

Pick the archetype before the kickoff ends. The teams that close inside 30 days have answered one question: which surface area does this engineer own on Monday of week one, and which one are they explicitly not on the hook for. The teams that drag past 60 days almost always answered that with “all of them.”

The Security Engineer Job Description Template

Copy what fits. Cut what does not. Bracketed text is a placeholder for your actual environment, your actual scope, your actual tooling. Parenthetical italic notes are for whoever is writing the listing and never appear on the live posting.

Job Title

[Security Engineer (Cloud / AWS) | Senior Application Security Engineer | Network Security Engineer | Detection & Response Engineer (Splunk)]

(The qualifier in parentheses is the single most useful phrase in the entire JD. Without it, you pull resumes from every archetype and screen them all out. With it, the JD does the first cut before the recruiter opens their inbox. Avoid the “Security Engineer (Cloud / Network / AppSec / DevSecOps)” slash-format that lists everything. It reads like the team has not decided what it needs, and the candidates worth landing skip past slash-titles on sight.)

About the Role

(Three sentences. What surface area? Who does this person sit with? Remote, hybrid, or onsite? Skip the company-mission paragraph. The reader is scrolling, and a hiring manager bio is not what closes them.)

[Company Name] is hiring a [archetype] to own [specific scope: our AWS Security Hub and cloud-native detection stack across 12 production accounts / our application security program covering 40 services and 200 engineers / our network and endpoint security posture across two data centers and 6,000 endpoints / our SIEM and SOAR layer ingesting 8 billion events a day]. You will partner with [the platform team / the engineering organization / IT operations / the SOC] and report to [Director of Security / Head of Application Security / CISO / VP of Engineering]. The role is [remote within the U.S. / hybrid in {city}, in-office {days}/week / onsite in {city}], with [an on-call rotation of {frequency} / no formal on-call / a Tier 2 escalation pager shared across the team].

What You Will Own in the First 90 Days

(Six specific responsibilities. Every line names something a real engineer would actually do at your org. Strike the generic “ensure system security” lines. Name the platform, the integration, the project on the roadmap.)

• Own [the AWS / Azure / GCP] security tooling stack for [specific scope, named services or business units], including detection, IAM guardrails, and the cloud security posture management (CSPM) layer that catches drift before it ships
• Design and write the [Terraform / Pulumi / CloudFormation] guardrails that make secure defaults the only path of least resistance for the engineering org, including the Open Policy Agent rules and Service Control Policies that enforce them
• Build and maintain the [SAST / DAST / SCA / secrets scanning] pipeline integrated into [GitHub Actions / GitLab CI / CircleCI / Jenkins], partnering with engineering on the false-positive triage so security signals do not become alert noise
• Own the detection content library in [Splunk / Sentinel / Chronicle / Elastic], including the rule lifecycle, the tuning cadence, and the SOAR playbooks that automate response on the noisier alert classes
• Lead threat modeling for [new product launches / regulated services / a specific roadmap area], including the architecture review at design time and the follow-through that turns findings into closed tickets
• Partner with [the platform team / engineering leadership / the SOC] on the [zero-trust / SASE / identity-first / cloud-native] roadmap that the org is building over the next [12 / 18 / 24] months, including the design proposals, the build phase, and the operational handoff

What You Bring

(Anchor on stack and depth signals. Most postings overload the requirements section with twelve bullets and lose the candidates who actually qualify. Pick four to six that matter. Hold the rest as preferred.)

• [X+] years building and operating security in production, with deep fluency in [primary cloud or platform] and the tooling your team uses every day, not a survey-level familiarity from a certification course
• Hands-on experience designing and operating [the relevant control plane: cloud IAM at scale / application security in a CI/CD pipeline / network and endpoint posture across {N} sites / SIEM detection and response], including the boring-but-important pieces that decide whether the program works at three in the morning
• Working code-level fluency in at least one of [Python / Go / Java / TypeScript / Rust], because security engineering in 2026 is a writing job, not a configuration job. The senior candidates we place all ship code
• Working knowledge of [Terraform / Pulumi / CloudFormation], one major CI/CD platform, and one container or orchestration platform ([Docker, Kubernetes, ECS]) that your stack uses
• Demonstrated ability to read code that is not theirs, find the actual vulnerability, and write the patch or the detection that closes it without three rounds of back-and-forth with the engineering owner
• Communicates security risk in business terms when the audience is non-technical, and in mechanical terms when the audience is engineering. The candidates who only do one of the two stall at senior

Preferred (Not Required)

(The list that exists so you do not lose a great hire over a missing checkbox. Tag clearly as preferred. Hiring teams that put eight items here and call them “required” are the same teams that wonder why the pipeline is empty.)

• Prior experience in [regulated vertical: financial services / healthcare / public sector / SaaS at scale] where the security program has to satisfy specific frameworks ([SOC 2 / ISO 27001 / PCI DSS / HIPAA / FedRAMP])
• One or more relevant certifications, with the caveat that a real production track record matters more than a stack of certs. We see CISSP, OSCP, CCSP, AWS Security Specialty, GIAC GCFA, GCIH, GREM most often on the resumes that close
• Experience contributing to open-source security tooling, public CVE disclosures, or CTF performance at a recognizable competition
• Familiarity with the [AI / ML / LLM] security surface area as the org rolls out model endpoints and agent workflows, including prompt-injection defense, prompt hardening, and the evaluation harness for security regressions

Compensation

(Pay transparency works. Postings that name a band pull 40 to 60 percent more qualified applicants in our internal funnel data. List the range. List the variable. Name the equity if there is any.)

Base salary range: [$XXX,000 – $XXX,000] depending on level and experience. Annual variable [target percentage / structure]. Equity grant for senior and above. Full benefits ([medical / dental / vision], [401k match], [unlimited / X weeks] PTO).

Five JD Patterns That Quietly Kill Your Senior Pipeline

The mistakes are the same across most stalled security searches we get called into. Five patterns show up most.

One. The catch-all archetype JD. The posting names everything. Cloud, network, AppSec, detection, GRC, identity. The list signals one of two things to a senior reader. Either the team is genuinely under-resourced and looking for a unicorn who will burn out in eighteen months, or the team has not figured out what it needs and is going to discover that in the candidate’s first month. Both reads are bad. Both make the senior candidate close the tab.

Two. The certification-as-gate posting. Lists CISSP as required. Lists three more certs as preferred. Says nothing about what the engineer will actually build. The senior candidates worth landing did the cert work years ago and have moved past treating it as a signal. The candidates who lead with certifications on the resume are usually the ones still moving through the early-career bands. Naming certs as the primary requirement filters the population you actually want.

Three. The audit-shaped JD for an engineering role. Reads like a checklist. “Conduct audits. Maintain compliance documentation. Ensure adherence to policy.” The job is an engineering job. The language has to match. AppSec and cloud security candidates who write code want the JD to talk about the systems they will design and the rules they will write, not about the artifacts they will produce for a regulator.

Four. No comp band. A 2026 posting without a salary range pulls roughly half the applications of an otherwise-identical posting that names one. The senior security market knows what it costs. Hiding the band reads as either a low offer the team is hoping to anchor, or a process that has not been thought through. Either read costs candidates.

Five. The “must have experience with all of” list. Twelve technologies. Six platforms. Three SIEMs. Two cloud providers. Five frameworks. No human has touched all of those at production depth in a single role, and the posting reads accordingly. The fix is to name three or four that actually matter on day one, list the rest as preferred, and let the recruiter handle the long-tail filtering on the phone screen.

How to Tier the Posting

One JD will not cover Mid through Staff. Tier it. The work, the comp, and the candidate pool are different at each band.

Mid (2-5 years). Frame the role around what they will learn and what they will own. Name the senior engineer or staff engineer they will partner with. Senior security candidates in this band are looking for the next stretch role. The JD that names the mentorship pathway plus the surface area outpulls the JD that just lists requirements.

Senior (5-9 years). Frame the role around ownership. What is theirs. What they will be the technical decision-maker on. What the on-call profile looks like and what tooling autonomy they have. Senior security engineers have been managed badly enough times to read the JD for those signals specifically.

Staff and Principal (9+ years). Frame the role around scope and influence. What the strategic charter is. Which engineering leaders they will partner with. Whether the role is a builder or an architect or a hybrid. At this band the candidate is interviewing the company at least as hard as the company is interviewing them, and the JD is the first read. Vague JDs at this tier close to nobody.

What the Best Postings Get Right

A handful of patterns show up consistently in the postings that close fast on our desk. None of them are clever. They are just specific.

Specific tooling. Name the SIEM. Name the cloud. Name the IaC platform. Name the CI/CD. The candidates worth landing scan the JD for those words in the first eight seconds, and a vague posting fails the scan.

Specific work. “Cut alert volume in our Splunk deployment by half” beats “improve detection.” “Reduce mean time to remediate critical CVEs from 21 days to under 7” beats “manage vulnerabilities.” Specificity signals that the team knows what good looks like.

A real comp band. Not a hidden one. Not a wide one ($120K to $260K reads as “we have no idea”). A tight band that matches the level and the metro.

A named hiring manager. The hiring manager’s name in the posting, or the recruiter’s name, or both. Anonymous JDs from unnamed teams underperform.

One honest sentence about the security program’s current state. “We are 18 months into rebuilding our cloud security posture and have shipped {specific milestones}.” Or, “Our SIEM is mature, our AppSec program is early, and this role owns standing up the second one.” The senior candidate respects honesty about where the program is. The candidate who would not be a fit self-selects out.

Common Questions Hiring Teams Ask Us

How long should a security engineer JD actually be?

Four hundred to seven hundred words. Anything shorter under-sells the role to senior candidates. Anything longer past nine hundred words pulls completion rates down sharply.

Think of it like a product page. The opening 80 words decide whether the senior reader keeps scrolling. The next 300 words convert. Past 700, you are losing the people who would have applied.

Does naming the SIEM in the title hurt the candidate pool?

The opposite. Naming the SIEM in the title pulls four to five times the qualified applicants of generic listings, because Splunk, Sentinel, Chronicle, and Elastic candidates are different talent pools.

The fear is that you narrow the funnel. The reality is that an unnamed SIEM is invisible to every detection engineer running a saved search for their platform. Name the tool.

Should we list CISSP as required?

Almost never. Listing CISSP as required filters out roughly thirty percent of the candidates who would otherwise close, and the ones it filters in skew toward GRC and compliance, not engineering.

If you actually need CISSP for a customer-contractual reason or a clearance, say that. Otherwise list it as “preferred” or skip it. The senior engineer worth landing has done the cert work or has explicitly chosen not to, and either signal is fine.

What is the realistic time-to-fill for a senior cloud security engineer?

Twenty-five to forty-five days for a well-scoped role with a real comp band. Roles that drift past sixty days almost always trace back to JD architecture, not market scarcity.

KORE1’s overall IT staffing average is 17 days across all roles. Senior cloud security runs longer because the pool is smaller and the screen is deeper, but the band above is what a healthy search looks like. If your search is past 60 days, the JD is usually the first place to look, before you raise the comp.

Do we have to post a salary range?

Depends where you post. Colorado, California, Washington, New York, Maryland, and Illinois all require a salary band by law, and that list keeps growing. Everywhere else it is optional, but skipping it costs you applicants.

Pay transparency is now a default expectation among senior security candidates. The application rate on banded postings runs forty to sixty percent higher than on unbanded ones in our funnel data, and the candidates who do apply to unbanded postings drop out at higher rates during the recruiter screen.

How do we handle remote versus hybrid in the JD?

Name it in the first three sentences. The candidates worth landing filter listings by remote status in the first scan. Burying remote, hybrid, or onsite below the responsibilities section costs you applicants who would have qualified.

If the role is hybrid, name the days expected onsite. “Hybrid, in office Tuesday through Thursday in Irvine” closes faster than “hybrid in Orange County” because the second one reads as undecided.

Is it worth hiring a security engineer through a staffing firm instead of running the search internally?

It depends on whether you have an internal recruiter who runs security searches every week. If yes, run it internally. If no, the math usually favors a partner. The senior security market has its own rhythm and its own platforms, and a generalist recruiter loses real days learning it.

We work in two models. Contract and contract-to-hire when the role might evolve or the team needs immediate coverage. Direct hire when the role is permanent and the budget is approved. If you want to talk to a recruiter on our cybersecurity desk, we are happy to share what we are seeing in market for your specific metro and archetype, no commitment.

If You Use Nothing Else From This Post

Three things. One. Name the archetype before you write the JD. Two. List a real comp band that matches the archetype and the metro. Three. Cut the JD down to the four to six requirements that actually matter on day one, and move the rest to preferred.

The teams that do those three things close their senior security searches inside a month. The teams that do not are the ones we end up talking to in week eight, when the req has been open long enough that someone in finance is starting to ask whether the role still needs to exist. It still needs to exist. The JD just needs to be rewritten. This template is the version we hand them.

The full security engineer salary guide has the per-metro breakdown and the certification-to-comp data. The DevSecOps engineer guide covers the adjacent archetype that sits between AppSec and platform. And the how to hire cybersecurity engineers in 2026 guide is the end-to-end playbook for the search, from kickoff through offer.