The Security Engineer List

Live index

The best security engineer jobs, ranked.

Security engineering has become one of tech’s best-paid specialties, and the strongest programs now post their salary bands. This is the living index of the security orgs worth your application — posted pay, which specialties they hire for, and whether they hire remote or entry-level, re-verified as the market moves. Every number traces to a posted range, a live careers page, or levels.fyi.

Programs ranked

Hiring now

Remote friendly

$680k

Top core-req base

Sources: posted salary ranges, levels.fyi, and company careers pages. Last verified October 10, 2026. How we rank →

Sort

Tier 1The institutions — the security orgs that define the field, and pay accordingly

Google security engineers assess designs, harden infrastructure and access-control enforcement points, hunt for vulnerabilities, and build detection and response tooling alongside software engineers. Current reqs lean toward cloud and product security, identity and access (including AI-agent access), and AI-era threats such as agentic security and LLM workflows. The org is large and highly specialized, with a posted-pay ladder from Security Engineer II through Staff and a strong offensive and research arm.

Base salary

$147k–$210k

Locations

Mountain View · NYC · Kirkland · Reston · Austin

Work setup

Hybrid (about 3 days a week in office); one req, Senior Security Engineer, Frontline Intrusion Operations, is tagged remote-eligible for CA, NV, OR and WA

Experience

Bachelor’s degree or equivalent experience. Minimums by level: Security Engineer II asks one year of security assessment plus one year of coding; III two years of each; Senior five; Staff eight. An entry-level path exists through the internship and Security Engineer II.

Worth knowing: Google closed its roughly $32 billion all-cash acquisition of Wiz on March 11, 2026; Wiz keeps its brand inside Google Cloud and continues to cover AWS, Azure and Oracle Cloud — the largest security acquisition in the industry’s history.

The US careers search returned 92 security results on Oct 10, 2026, including 15 Security Engineer-titled reqs from II to Staff — cloud and product security (Cloud CISO), access security, Android anti-malware, security research, silicon and network-device security, Frontline Intrusion Operations (red team), DeepMind serving-layer security — plus a Staff SWE Detection and Response Platform req and Mandiant/GTIG consulting reqs

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Google Security page →

Security engineers protect OpenAI’s research and production environments, from bare-metal hardware and firmware through Kubernetes, multi-cloud and CI/CD to model weights and user data. Infrastructure security, detection and response, application security and agentic-AI security dominate the reqs, and the org describes itself as ‘technical in what we build but operational in how we do our work’.

Base salary

$266k–$445k

Locations

SF · Seattle · NYC · DC · remote

Work setup

Hybrid, 3 days a week in office on Application Security (relocation offered); Infrastructure Security, Threat Intel Engineering and some D&R, Agent Security and Host Assurance reqs are US-remote

Experience

Experienced hires: the core Security Engineer reqs state no year count but expect hands-on AppSec, detection-and-response or infrastructure-security depth (secure coding, Kubernetes, multi-cloud, threat modeling); Forward Deployed Security Engineer asks 5+ years and Staff Security Reliability 10+. No entry-level or new-grad path.

Worth knowing: In 2026 OpenAI disclosed two supply-chain incidents that forced code-signing certificate rotation: a malicious Axios release ran in its macOS signing workflow on March 31, and the TanStack ‘Mini Shai-Hulud’ campaign breached two employee devices and some internal repos (disclosed May 14). OpenAI reported no customer data or production systems affected.

26 Security-department reqs on the Ashby board (of 815), about 14 of them security-engineering ICs — Application Security (SF, Seattle, NYC), Detection & Response, Agent Security, Infrastructure Security, Host Assurance, Security Observability, Threat Intel Engineering, and a Forward Deployed Security Engineer in DC

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full OpenAI Security page →

Security engineers secure the systems that train, serve and increasingly are Claude: identity and secrets, supply-chain and CI/CD hardening, sandboxing, firmware and BMC security, detection and response, red teaming, and AppSec for agentic and code-execution systems. Reqs skew Senior and Staff+, teams build LLM-driven tooling for their own work, and several reqs are remote-friendly, which is unusual for a lab this size.

Base salary

$300k–$405k

Locations

SF · NYC · Seattle · DC

Work setup

Office-centered hybrid — all staff are expected in an office at least 25% of the time and most security reqs are tagged on-site; Offensive Security, Threat Intel and Staff+ Application Security reqs are remote-friendly. Detection & Response includes an on-call rotation.

Experience

Experienced hires, skewing senior: Detection & Response asks 3+ years of software engineering or 5+ years of detection engineering and incident response; Offensive Security 5+ years of red teaming; Senior Software Security 5+; Staff+ reqs 7–8+. No entry-level or new-grad security engineer path.

Worth knowing: Anthropic’s AppSec team says Claude is its primary tool — it drives static analysis, drafts vulnerability fixes as pull requests and does first-line bug bounty triage — and Project Glasswing, launched in April 2026 with Claude Mythos Preview, reported over 10,000 high- or critical-severity vulnerabilities found with partners by May.

51 Security-department reqs on the Greenhouse board (of 645), about 17 of them US security-engineering ICs — Detection & Response, Offensive Security, Threat Intel, Senior and Staff+ Software Security, Staff+ Application Security, Platform and Hardware Security (OpenBMC, OS, firmware), Security Fusion Platform and GRC Platform — across SF, NYC, Seattle and DC

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Anthropic Security page →

Tier 2The heavyweights — big tech security orgs with clear ladders, many specialties, and top-of-market pay

Security engineers at Amazon do application security reviews, threat modeling, penetration testing, vulnerability management, detection and incident response across AWS and the consumer businesses (Stores, Devices, Ads, Leo satellites). Cloud and AppSec dominate, and AI security reqs are growing. Hiring is large and decentralized — each security org posts its own reqs — and loops test Leadership Principles alongside technical depth.

Base salary

$159k–$202k

Locations

Seattle · Arlington · Austin · NYC · Dallas

Work setup

Mostly in office 5 days a week (corporate policy since January 2025), with a handful of reqs listed as ‘US, Virtual’ or virtual within Washington or Texas (6 of 196 hits)

Experience

Security Engineer I: bachelor’s plus 2+ years of non-internship web-protocol, attack and remediation experience. Security Engineer II: bachelor’s in CS or STEM or 2+ years in IT security, knowledge of networking protocols and common vulnerabilities; AppSec II reqs add 3+ years of programming and 2+ years of security code review. Some Leo and Amazon Dedicated Cloud reqs require US citizenship or clearances.

Worth knowing: On April 7, 2026 AWS CISO Amy Herzog announced general availability of AWS Security Agent for autonomous penetration testing, and the AWS security pipeline now carries multiple AI and AGI security reqs.

A ‘security engineer’ search of US reqs on amazon.jobs returns 196 hits on Oct 10, 2026, about 125 of them in the Systems Security Engineering job family — AppSec, AWS Proactive Security, GuardDuty, Vulnerability Management, incident response, compliance penetration testing, AI/AGI security, Leo satellite security and Ads Security; biggest sites are Seattle (41), Arlington VA (16), Austin (15) and New York (12); newest posted Oct 9, 2026

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Amazon Security page →Amazon interview guide →

Apple security engineers work inside SEAR and adjacent teams to secure silicon, firmware, OS kernels, frameworks, services and Apple Pay, with a strong offensive-research and low-level (C, C++, kernel, SoC) bias. Most reqs are on-site in Cupertino and Seattle, and recent postings explicitly ask for fluency with AI and agentic tooling. It is the most hardware- and platform-centric security org on this list, with very few remote seats.

Base salary

$123k–$214k

Locations

Cupertino · Seattle · Sunnyvale · Austin · NYC

Work setup

Hybrid or on-site by team (about 3 days a week in office); one of 71 reqs — Offensive Security Researcher, Kernel and Embedded Security, NYC — is flagged home office

Experience

Product Security Engineer, SEAR is leveled ICT2–ICT3 with no years-of-experience bar (C, C++ or Objective-C, vulnerability classes, security tooling); Red Team reqs (ICT4–ICT5) ask 4+ years with 2+ in security reviews; Senior Security Engineer asks 10+. No formal new-grad program, but entry-level reqs exist.

Worth knowing: Apple’s Security Bounty now pays up to $2 million for zero-click exploit chains (over $5 million with bonuses), and Apple says SEAR runs its own offensive research on exploit chains to drive foundational defensive improvements.

The Security and Privacy team listed 71 unique US reqs on Oct 10, 2026, about 25 of them core security-engineering titles — product security, red team and offensive research, platform, SoC and OS security, cloud and identity security, compiler and supply-chain security — newest posted Oct 9, mostly Cupertino and Seattle

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Apple Security page →

Interviewing for security engineer roles?Aced’s Security Engineer interview course covers secure design, vulnerability assessment, cryptography basics, and the coding rounds.

Start prepping →

Security engineers here do offensive work and product security on Windows, Azure and M365 — pen testing, red teaming, code audit and mitigation design — plus SOC and detection engineering for Microsoft’s internal estate. Reqs skew to offensive security, security research and security operations rather than generalist AppSec, and 2026 postings stress AI and agentic tooling. Several cleared reqs sit in Reston and Redmond.

Base salary

$102k–$202k

Locations

Redmond · Reston · Atlanta · Pittsburgh · US remote

Work setup

Mixed by req — 23 of 41 list ‘3 days/week in-office’, 16 list ‘0 days/week in-office – remote’, and 2 are fully on-site cleared work; company policy sets 3 days a week for staff within 50 miles of an office (Puget Sound from February 2026)

Experience

Security Engineer II (IC3): bachelor’s in CS, math, statistics or related plus 2+ years in security, or master’s plus 1+ year, or equivalent experience. Senior (IC4): bachelor’s plus 4+ years. Principal (IC5): bachelor’s plus 6+ years. Entry level: the IC2 Red Team req asks only for a bachelor’s or equivalent experience. Some reqs require government clearances.

Worth knowing: Microsoft’s July 10, 2026 Secure Future Initiative report says its multi-agent system for assessing cloud services had over 90% of findings confirmed by security engineers, and a 2026 Windows Security req asks hires to ‘build reusable agents and tools’ to speed up security reviews.

41 US reqs in Microsoft’s ‘Security Engineering’ profession as of Oct 10, 2026 (Security Research 19, Penetration Testing 8, Security Operations Engineering 8, Security Assurance 6), plus more security-titled reqs filed under Software and Hardware Engineering; 29 list Redmond, the rest Reston VA, Atlanta, Pittsburgh, Reno, Mountain View, Maryland or generic US; newest posted Oct 9, 2026

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Microsoft Security page →

Netflix security engineers work in a small, senior, autonomy-heavy org, mostly on cloud security and IAM across AWS and GCP, platform and workload identity, workforce security (including GenAI tools), Open Connect CDN protocol security and security analytics. Hires are expected to build tooling and drive work independently under the culture memo’s ‘context not control’ model. There is almost no entry-level path.

Base salary

$400k–$680k

Locations

US remote (hubs in Los Gatos and LA)

Work setup

Remote — every open security engineering req lists ‘Remote, United States’ and the posting text states no office-day requirement

Experience

Senior-heavy: open security engineering reqs are L5 and L6 (staff level), with no entry-level security req. The L5 cloud security req asks for deep AWS/GCP IAM and cloud security architecture experience and strong scripting; the L6 Open Connect req asks for applied cryptography and protocol (TLS, QUIC) expertise.

Worth knowing: Netflix security reqs are all-cash: the L5 security engineer band is posted at $400,000–$680,000 and L6 at $499,000–$900,000, with no bonus and a choice between salary and stock options — the highest posted security pay on this list.

About 8 US security-engineering reqs open on Oct 10, 2026, all listed ‘Remote, United States’: Security Engineer L5 (Cloud Architecture, Tooling and Security), Security Engineer 5 (IAM), Security Analytics Engineer L5, Security Software Engineer L6 (Security Protocols & Foundations, Open Connect), Software Engineer L6 (Platform Security), two Business Security Partner L5 reqs and a Support Solutions Engineer L5 (Security, Privacy and Assurance); newest posted Sep 23, 2026

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Netflix Security page →

Meta security engineers find and fix vulnerabilities across its apps and infrastructure through security assessments, threat modeling, code review and tooling, and they are expected to write real code. Specialties span product security, offensive and red team, detection and response, vulnerability management and Applied AI security. 2026 has been a contraction year, so openings are fewer and more selective than the posted pay bands suggest.

Base salary

$154k–$217k

Locations

Menlo Park · NYC · Bellevue · DC

Work setup

Hybrid, 3 days a week in office company-wide (Instagram has required 5 days since February 2026); no remote-tagged security req verified

Experience

Core reqs ask 5+ years of security engineering (Product Security, Applied AI) and 8+ years for the general Security Engineer req, with strong coding plus threat modeling, security design review and vulnerability research. A University Grad path exists through separate UG security reqs in prior cycles.

Worth knowing: Meta’s May 20, 2026 layoffs (about 8,000 people, 10% of staff) reportedly hit its cybersecurity teams and came with cancelled plans to hire 6,000 — yet a Product Security Engineer req was posted on September 21, 2026.

A Product Security Engineer req in Menlo Park (posted Sep 21, 2026, valid through Oct 27) is confirmed open, and Security Engineer reqs for Applied AI, Investigations, Vulnerability Management, offensive and red team, and detection and response surface for Menlo Park, New York, Bellevue/Seattle and Washington DC — but hiring is tighter after the May 2026 layoffs

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Meta Security page →

Tier 3The focused teams — security-first companies and lean orgs where you own more, sooner

Coinbase security engineers protect custody and customer assets: threat intelligence and detection engineering, cryptographic and key-management platforms (MPC, KMS, secrets, certificates), plus cloud, application and offensive-security work on the Web3 side. The open US roles are senior, remote and Go/Python/Rust-heavy, with explicit generative-AI expectations in the postings.

Base salary

$180k–$212k

Locations

Remote US

Work setup

Remote-first, with quarterly in-person ‘surges’

Experience

Threat Intelligence Platform Engineer asks 2+ years building threat-intel platforms or security data pipelines; Senior Threat Intelligence 5+ years in threat intel, incident response or investigations; the security-platform SWE reqs 5+ years plus applied cryptography or KMS/HSM. No entry-level or new-grad security path.

Worth knowing: On May 5, 2026 Coinbase cut about 14% of staff (about 700 people) in a restructuring toward AI-assisted small teams, and the live board now holds only four US-remote security-engineering reqs — yet those seats carry the highest reported total comp on this list.

Four US-remote security-engineering reqs open on the Greenhouse board — Senior Threat Intelligence Engineer, Threat Intelligence Platform Engineer, and Senior Software Engineers for Secrets Management and Certificate Management; the only Product Security Engineer req is Canada-only and the Security Platform Engineer reqs are India or Israel

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Coinbase Security page →

Datadog security engineers are builders: they ship guardrails, golden paths and automation for a large multi-cloud Kubernetes estate rather than only reviewing. Open US seats cluster in platform and cloud security, vulnerability lifecycle, CI/CD supply-chain security and AI-agent product security. Roles are Senior-level and hybrid, centered on New York and Boston.

Base salary

$192k–$240k

Locations

NYC · Boston · Atlanta · limited remote

Work setup

Hybrid with an office-centered culture; one req allows remote in five states

Experience

All open reqs are Senior: Product Security asks for a CS degree or 5+ years of product or application security; Platform Security asks for Go, Python or Rust plus Kubernetes and cloud security; Vulnerability Management for multi-cloud remediation experience. No entry-level or new-grad security path right now.

Worth knowing: Datadog’s 2026 security reqs are AI-heavy: the Product Security for AI Agents seat owns security for Bits Code, its cloud coding agent (prompt-injection threat models, sandboxing, on-call), and the vulnerability-management seat works on a ‘PRs, not tickets’ automation model.

Four core US security-engineering reqs open on the Greenhouse board — Senior Platform Security Engineer (NYC), Senior Security Engineer Vulnerability Management (NYC/Boston), Senior Software Engineer CI/CD Security (NYC), and Senior Product Security Engineer for AI Agents (Atlanta, NYC, remote in five states) — plus adjacent incident-readiness and audit reqs; no offensive or detection-engineering req open now

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Datadog Security page →

Cloudflare security engineers work as ‘Customer Zero’ for the company’s own network and products: product security and bug bounty triage with LLM-based automation, AI and agent red teaming, insider threat, IAM, and Cloudforce One threat intelligence and vulnerability defense. A separate group builds distributed secrets and key-management platforms in Go and Python. The org was shaped by the November 2023 nation-state intrusion and ‘Code Red’ remediation, which rotated 5,000+ credentials.

Base salary

$166k–$208k

Locations

Austin hub · NYC · DC · distributed US

Work setup

Hybrid (in-office days not stated; the IAM role is ‘hybrid from Austin’); Security Platform engineering reqs are distributed across US cities and US-remote

Experience

Mid-to-senior: AI Security Research & Red Team asks 4+ years in offensive or application security, Product Security 5+ years of AppSec in large-scale cloud or SaaS, Insider Threat 5+ years, Cloudforce One engineers 5 years building large-scale software. No entry-level or new-grad security engineer path.

Worth knowing: Cloudflare announced a roughly 20% workforce cut (more than 1,100 jobs) on May 7, 2026 to move to an ‘agentic AI-first’ model — yet by October its board still lists 15 Security-department reqs, including new AI-security roles such as AI Security Research & Red Team Engineer (published Aug 10, 2026).

15 Security-department reqs on the Greenhouse board (of 424), about 10 of them US security-engineering ICs mostly in Austin — Product Security, IAM Security, Insider Threat, Senior Threat Intelligence, AI Security Research & Red Team (Austin, NYC), GRC Engineer and Cloudforce One threat-intel and vulnerability-defense engineers — plus about four security-platform and detection reqs in Engineering

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full Cloudflare Security page →

Internal security engineers at CrowdStrike sit mainly in Product Security, hardening the Falcon platform’s code, software supply chain and open-source footprint, running threat models, secure code review and bug-bounty response, and building automation to triage vulnerabilities. AppSec, supply chain and vulnerability intelligence dominate the open US seats, and most of the company’s other ‘security’ reqs are product engineering, services or sales — so the internal ladder is narrow but fully remote.

Base salary

$120k–$180k

Locations

Remote US · NYC (SIEM)

Work setup

Remote-first for Product Security; hybrid (about 2 days a week) for the NYC and Sunnyvale reqs

Experience

Engineer II (Software Assurance) lists no explicit years — experience implementing and monitoring software security systems, GitHub and SCA tooling, Python or Go scripting — and is the closest thing to an entry path; Vulnerability Intelligence asks 5–7+ years, Senior AppSec 8+. No formal new-grad security track.

Worth knowing: CrowdStrike’s own posting says Product Security ‘breaks the mold of traditional internal security’ by focusing on active threats to its products; the Sep 30, 2026 Engineer II req centers on securing GitHub orgs, secret scanning and malicious-package monitoring, ten months after the company fired an insider (Nov 2025) who passed internal screenshots to Scattered Lapsus$ Hunters.

Four internal Product Security reqs open in the US, all remote — Engineer II Software Assurance (posted about Sep 30, 2026), Senior Application Security, Product Security Engineer Vulnerability Intelligence, and Software Engineer Security Automation — plus a hybrid NYC Security Engineer III for the Next-Gen SIEM product; no internal detection-and-response, cloud security or offensive reqs

Prep with Aced View open roles

Salary band, hiring status & score breakdown — see the full CrowdStrike Security page →

The comp landscape

Posted base-salary bands for each program’s core security engineer req, US market — equity and bonus come on top, and at the AI labs and big tech they can double the number. Bands span levels; senior hires land near the top. Full breakdown in the Security salary guide.

Netflix

$400k–$680k

OpenAI

$266k–$445k

Anthropic

$300k–$405k

Datadog

$192k–$240k

What does a security engineer do?

A security engineer builds and defends the systems a company runs on: reviewing code and architecture for vulnerabilities (product and application security), hardening cloud and corporate infrastructure, hunting and responding to intrusions (detection and response), and attacking their own company before someone else does (offensive security and red teams). Unlike a security analyst, the job is engineering — you ship code, tooling and fixes, not just findings.

The best programs run a dedicated security engineering ladder with pay that matches or beats the software track, and they hire across specialties rather than for a single “cyber” role. The interview loop reflects that: coding, a security design or threat-modeling round, a specialty deep-dive (web, cloud, cryptography, binaries), and behavioral.

Preparing for the loop? Start with our guide to security engineer interview questions.

How we rank

Every program gets an Index score out of 100, built from four weighted dimensions. Scores are editorial judgments grounded in the data below — not paid placements.

30%

Compensation

Posted security engineer salary bands, levels.fyi data, and verified offer reports — total comp where equity data exists, base bands otherwise.

25%

Program maturity

How real the security org is: a dedicated security engineering ladder, named teams and specialties, scale, and whether security sits at the core of the business.

25%

Career capital

What the role does for the rest of your career — brand strength, the caliber of threats and systems you get to work on, and alumni outcomes.

20%

Momentum

Open req counts across specialties, remote and entry-level paths, and whether the org is expanding or coasting.

We also track Palo Alto Networks, Okta, Stripe, Uber, Salesforce, Block, Robinhood, Palantir and Wiz (now part of Google Cloud), currently outside the ranking and queued for the next data pass. Every program ranked here has a posted US salary band on a live security engineering req; total compensation is shown only where levels.fyi has a usable security-specific sample, which is why Google, Meta, Apple, OpenAI, Anthropic and Cloudflare show base bands alone.

Compensation data comes from posted salary ranges (required in several US states), levels.fyi, and public offer reports; figures are US-market and vary by level and location. Hiring status reflects each company’s careers page as of October 10, 2026. Spotted something outdated? Email [email protected].

Frequently asked questions

Posted mid-level base bands at big tech and the security vendors cluster between $120k and $240k: CrowdStrike $120,000–$180,000, Microsoft Security Engineer II $102,100–$202,200, Apple ICT2–ICT3 $122,700–$214,300, Google Security Engineer III $147,000–$210,000, Meta $154,000–$217,000, Amazon Security Engineer II $159,300–$202,400, Cloudflare $166,000–$208,000, Coinbase $180,370–$212,200 and Datadog (Senior) $192,000–$240,000. The AI labs post far higher: OpenAI $266,000–$445,000 and Anthropic $300,000–$405,000, plus equity. Netflix tops the list with an all-cash $400,000–$680,000 L5 band. With equity, levels.fyi puts total compensation at $210k–$252k at Microsoft, $240k–$334k at Amazon L5, $215k–$325k at Datadog, $425k–$480k at Coinbase and $425k–$612k at Netflix.

Netflix, on posted numbers: $400,000–$680,000 for an L5 security engineer and $499,000–$900,000 at L6, paid entirely as salary with no bonus. OpenAI ($266,000–$445,000 plus equity) and Anthropic ($300,000–$405,000 plus equity, with Staff+ reqs at $405,000–$485,000) are next. Among the rest, Coinbase shows the highest reported total compensation ($425k–$480k on levels.fyi, equity at grant value) and Google posts the highest big-tech top-of-band — $300,000 base at Staff with a 20% bonus target.

A recruiter screen, a technical phone screen, then a four-to-six round loop that mixes coding with security-specific rounds: secure code review or finding vulnerabilities in a snippet, threat modeling or security design for a system, a specialty deep-dive (web, cloud and IAM, cryptography, binaries or detection), and behavioral. Amazon’s published loop is one or two 60-minute screens and five 60-minute interviews covering secure code review, scripting, threat modeling, security testing, web vulnerabilities and cryptography alongside Leadership Principles; Microsoft runs two to four hour-long conversations; Netflix a four-to-five interview panel of 45 minutes each; Google adds a hiring committee. Expect four to eight weeks end to end.

Most want two or more years, but a few real entry points exist. Google’s Security Engineer II asks for one year of security assessment and one year of coding, and ran a Summer 2027 Security Engineering Intern req (closed October 9, 2026); Apple posts ICT2-level Product Security Engineer reqs with no years-of-experience bar; Microsoft has an IC2 Security Engineer – Red Team req (posted October 2, 2026); Meta has posted University Grad security reqs in earlier cycles. Amazon’s lowest rung, Security Engineer I, asks for 2+ years, and OpenAI, Anthropic, Netflix, Datadog, Cloudflare, Coinbase and CrowdStrike have no entry-level or new-grad security path right now. Every posting accepts equivalent experience in place of a degree.

More often than software engineering jobs, and it varies by company. Netflix lists every open security req as ‘Remote, United States’; Coinbase and CrowdStrike’s Product Security team are remote-first; 16 of Microsoft’s 41 US security reqs are remote; OpenAI’s Infrastructure Security, Threat Intel and several Detection & Response reqs are US-remote; and Anthropic’s Offensive Security, Threat Intel and Staff+ AppSec reqs are remote-friendly. Amazon is in office five days a week, Meta, Google and Apple are hybrid at about three days, and Datadog allows remote on a single req in five states.

Application and product security everywhere, detection and response at the AI labs and big tech, offensive security and red teams (Google’s Frontline Intrusion Operations, Apple’s SEAR, the Microsoft Red Team, Anthropic Offensive Security, Cloudflare’s AI Security Research & Red Team), cloud and infrastructure security (Netflix, Amazon GuardDuty and Proactive Security, OpenAI’s GPU-cluster and model-weight protection), and a fast-growing AI-security track — OpenAI Agent Security, Datadog’s Product Security for AI Agents, Amazon’s AI/AGI security reqs, Meta’s Applied AI security and Microsoft’s agentic security-review tooling.

Both, depending on where you look. Amazon has about 125 open security reqs, Apple 71 in its Security and Privacy team, Microsoft 41 in its Security Engineering profession and Google 92 security results; Anthropic lists 51 Security-department reqs and OpenAI 26. On the other side, Meta’s May 2026 layoffs reportedly hit its security teams, Cloudflare cut about 20% of staff and Coinbase about 14% — yet all three posted new security engineering reqs between August and October 2026, and all twelve programs on this list are hiring now.

A security engineer builds: they write code, tooling and fixes, review architecture and threat-model systems, and sit on an engineering ladder with engineering pay — Google, Microsoft, Amazon and Apple each run a dedicated security engineering ladder. A security analyst monitors and investigates, typically in a SOC, on an IT or operations ladder. The interview loops reflect it: security engineer loops include coding and design rounds, and the postings on this list ask for Python, Go, Java, C or C++ alongside security depth.

Land the offer, not just the interview.

Practice security engineering interview questions, mock interview with peers, and learn the frameworks hiring managers actually score you on.

Take the Security course Practice interview questions

The best security engineer jobs, ranked.

The comp landscape

What does a security engineer do?

How we rank

Browse security engineer jobs

Salary & hiring by company

Interview guides

More job lists

Frequently asked questions

Land the offer, not just the interview.

Follow Us