Security Engineer résumé: what employers are asking for right now
We read 201 open security engineer postings on employers' own job boards, at companies including Anthropic, Braze and Palantir. Of the 118 whose requirements we have read, the skills asked for most are Python (70%), AWS (43%) and Go (41%) — so those belong near the top of a security engineer résumé, in the words the posting uses. The median posting asks for 5+ years of experience.
From 201 open postings on employers’ own job boards, as of .
Skills security engineer postings ask for
| Skill | Share of postings | Bar |
|---|---|---|
| Python | 70% | |
| AWS | 43% | |
| Go | 41% | |
| Cloud Security | 36% | |
| Application Security | 34% | |
| Incident Response | 31% | |
| Kubernetes | 31% | |
| Threat Modeling | 31% | |
| GCP | 23% | |
| Siem | 22% | |
| CI/CD | 21% | |
| Iam | 21% | |
| Terraform | 18% | |
| Authentication | 14% | |
| TypeScript | 14% |
Share of the 118 postings whose requirements we have read.
A skills section built from those postings
List only what you can talk about in an interview, and use the posting’s own words for it — a screener searching for “Python” will not match a synonym. Ordered by how often employers ask:
Skills
Python · AWS · Go · Cloud Security · Application Security
Incident Response · Kubernetes · Threat Modeling · GCP · Siem · CI/CD · Iam · Terraform
Authentication · TypeScript
- Line 1: asked for by a third or more of postings.
- Line 2: often asked for.
- Line 3: sometimes asked for.
Sample security engineer résumé
An illustrative example, not a real person: the employers and results are made up. The skills are the ones the postings above ask for, so it shows how those requirements read on a page.
Senior Security Engineer
Security engineer with 7+ years securing cloud and application platforms across AWS and GCP. Experience spans threat modeling, incident response, IAM, Kubernetes, CI/CD, and detection engineering, with hands-on work in Python, Go, and Terraform.
Experience
Senior Security Engineer · Series B cloud software company
2021 – present
- Built cloud security guardrails for AWS and GCP using Terraform and IAM policies, reducing critical misconfigurations by 38% across production accounts.
- Led incident response for container and API incidents, improving mean time to contain from 2 hours to 35 minutes through playbooks and SIEM detections.
- Partnered with application teams on threat modeling and application security reviews, blocking high-risk releases before deployment and adding required controls to CI/CD.
- Automated security checks in Python and Go for Kubernetes workloads, cutting manual review effort by 60% and improving release coverage for new services.
Security Engineer · Multi-product SaaS provider
2018 – 2021
- Implemented cloud security monitoring in SIEM for AWS and GCP audit logs, increasing alert fidelity and surfacing lateral movement attempts earlier.
- Reviewed authentication and IAM flows for customer-facing services, tightening privileged access and removing unused roles across 120+ service accounts.
- Built Python tooling for vulnerability triage and incident response enrichment, shortening investigation time and standardizing evidence collection.
- Supported bug bounty findings and application security fixes, coordinating remediation for injection, auth, and misconfiguration issues across web services.
Skills
Python · AWS · Go · Cloud Security · Application Security · Incident Response · Kubernetes · Threat Modeling · GCP · Siem · CI/CD · Iam · Terraform · Authentication · TypeScript
More security engineer bullet points to adapt
- Developed Python automation to inventory cloud assets and flag exposed storage, helping teams remediate 200+ findings before audit.
- Created Kubernetes admission controls and policy checks that prevented insecure deployments from reaching production namespaces.
- Designed threat models for new services and translated findings into engineering tickets, closing high-risk gaps before launch.
- Expanded SIEM coverage for authentication and privilege escalation events, improving detection of suspicious access patterns.
- Built Go services for security event enrichment and routing, reducing alert triage time for on-call responders.
- Hardening CI/CD pipelines with signed artifacts and secret scanning, decreasing build-time security exceptions across release workflows.
- Led incident response for a credential compromise, rotating keys, containing access, and documenting lessons learned for engineering teams.
- Partnered with platform teams on Terraform module standards, improving baseline security for networking, logging, and IAM.
- Reviewed AI-related service designs for AI Security risks, including data exposure, prompt injection, and excessive tool access.
- Assessed container and serverless applications during application security reviews, prioritizing fixes by exploitability and business impact.
What sets an application apart
Listed as a plus rather than a requirement: Kubernetes (12%), Terraform (11%), Artificial Intelligence (9%), Bug Bounty (9%), LLM (9%), AWS (8%), Python (8%) and AI Security (8%). Worth naming if you have it, and never worth claiming if you do not.
Level, location and pay
- Most are senior roles (63% of postings that state a level).
- 31% are listed as remote.
- Listed mainly in United States, Canada and United Kingdom.
- US postings that publish a yearly salary: median $275k, middle half $235k–$308k (from 23 postings).
Who is hiring security engineers
- Anthropic14 open
- Braze13 open
- Palantir13 open
- Stripe12 open
- OpenAI11 open
- Cloudflare8 open
- Flexport7 open
- GitLab7 open
- Klaviyo7 open
- Robinhood7 open
- Harvey6 open
- Asana5 open