Security Engineer jobs: skills, pay and how to get hired

Updated 5 Nov 2026. Figures from the jobs in our search, not the whole market.

In short

Security engineers make systems hard to break into, notice quickly when someone tries, and help teams recover when an attack gets through.
Ads ask for security basics first, then cloud security on Azure or AWS, log monitoring in a SIEM, and standards such as ISO 27001.
Every country gets a short section of its own: the leading cities, remote and hybrid work, the certifications that count there, and published pay.
Our shares come from the security jobs in our own search and are worked out again each morning (as of 5 Nov 2026); they are not the whole market.

Contents

What a security engineer does
The skills the ads ask for
Where the jobs are, country by country
Your CV for a security engineer job
How we read our data

See open Security Engineer jobs Score your CV for these jobs

What a security engineer does

A security engineer protects a company's systems and data by building the defences into them. On a normal day that means reviewing a new design for weak spots, setting up who may access what, keeping passwords and keys out of the code, checking cloud settings, and writing the rules that raise an alarm when something looks wrong. When an alarm is real, the security engineer helps find out what happened, stop it spreading and close the gap.

The job comes in flavours. Application security engineers work with developers on the code and the build pipeline. Cloud security engineers own the guardrails of AWS, Azure or Google Cloud. Detection and response engineers build the monitoring and handle incidents. Many ads, especially in smaller companies, want a bit of each.

Titles vary: Security Engineer, IT Security Engineer, Cloud Security Engineer, Application Security Engineer, and in German ads IT-Sicherheit or Informationssicherheit. We count them as one role. The ladder goes to senior, lead or staff, security architect, head of security and CISO, the chief information security officer; see the career paths.

The skills the ads ask for

We read a sample of the ads every day and count the skills they name. On a computer, hover a skill in the text to see its share; on a phone, the table has the same figures.

Skill	Share of ads	What is expected
Cybersecurity	58%	The whole field: how attacks work, which controls stop them, and how to weigh a risk against its cost.
SIEM	20%	Collect logs in one place, write detection rules people trust, and tune away the noise; Splunk is a common SIEM.
Azure	8%	Entra ID (identity), policies, Defender and logging in Microsoft's cloud, common in European companies.
AWS	13%	IAM, organisation guardrails, logging and the security services of Amazon's cloud.
Linux	24%	Harden a server, read its logs and find what a process is doing; most cloud workloads run on Linux.
ISO 27001	30%	The international standard for an information security management system: risks, controls, audits.
Networking	20%	TCP/IP, DNS, TLS, firewalls and segmentation; enough to read a packet capture and spot odd traffic.
Penetration Testing	11%	Attack your own systems with permission, the way an attacker would, and write findings a team can fix.
Python	18%	Automate the routine: parse logs, call APIs, enrich alerts and write small security tools.
CISSP	7%	A broad certification from ISC2 that needs several years of security work; common in senior and lead ads.
Kubernetes	9%	Pod security, network policies, secrets and admission rules for container platforms.
English	72%	The working language of security tools, advisories and most international teams.
German	70%	Asked in many ads in Germany, Austria and Switzerland, for audits and work with business departments.

Shares of the security engineer ads we read in the last 7 days, as of 5 Nov 2026. Our ads, not the whole market.

Underneath everything sit the foundations: networking, so you can tell normal traffic from odd traffic; Linux and Windows and Active Directory, where most breaches play out; and a working grasp of how attacks unfold. Ads call this cybersecurity and rarely spell it out, but every interview tests it.

On top, most ads name a cloud and a way of watching it. Azure is strong in European companies that already run Microsoft 365; AWS leads at start-ups and product companies. Monitoring means a SIEM, a system that collects logs from everywhere and raises alerts on rules you write. Standards such as ISO 27001 and laws such as the GDPR (EU) shape the paperwork side.

What sets candidates apart is automation and proof. Python or PowerShell to script the routine, infrastructure written in Terraform so settings can be reviewed, and hands-on work such as penetration testing. Certifications such as CISSP appear mostly in senior ads; they open doors, but interviews test what you have done.

Where the jobs are, country by country

Each country below has its own figures: which cities have the most jobs in our list, whether the number is going up or down, how often ads offer remote or hybrid work, the certifications and rules that matter in that country, and pay ranges from published research, in the local currency.

Germany

10% of the ads offer hybrid work, and 29% are fully remote.

Pay (Base salary)

Entry level: €50,000 to €60,000 a year
Mid-level: €53,000 to €73,000 a year
Senior: €73,000 to €101,000 a year

Total pay: bonuses for security engineers are small in Germany; Payscale gives about €2,000 to €6,000 a year, from few salaries.

Hamburg, Cologne and Munich lead Indeed's city figures for security engineers.

Sources: StepStone (2026), Indeed (Oct 2026), Payscale (Jul 2026).

Pay researched on 27 Oct 2026.

Framework: many German public bodies and many companies build their security on IT-Grundschutz, the method of the German Federal Office for Information Security (BSI). It fits with ISO 27001, and the BSI itself certifies German organisations against ISO 27001 on the basis of IT-Grundschutz.

Rules: NIS2, an EU directive, widens which German companies must manage cyber risk and report serious incidents. Operators of critical infrastructure, KRITIS in German, have had such duties for longer.

Certifications: CISSP and CompTIA Security+ appear in German ads too, and some public-sector ads ask for the German IT-Grundschutz-Praktiker course, built on the BSI method. Audits and policies are often written in German.

Job figures as of 5 Nov 2026.

United States

18% of the ads offer hybrid work, and 40% are fully remote.

99% of the ads that say are full-time.

Pay (Base salary)

Entry level: $74,000 to $97,000 a year
Mid-level: $97,000 to $149,000 a year
Senior: $100,000 to $188,000 a year

Total pay: Built In's respondents report about $23,000 a year in extra cash on top of base, and Payscale gives security engineers bonuses of about $2,000 to $18,000.

New York pays security engineers the most, then Austin and Chicago (Indeed).

Sources: Payscale (Oct 2026), Payscale: senior (Aug 2026), Indeed (Oct 2026), Built In (2026).

Pay researched on 27 Oct 2026.

Certifications: CompTIA Security+ is a common first certification and is asked for in many US government and defence roles. CISSP, from ISC2, is granted only after about five years of security work. OSCP, from OffSec, is a long hands-on exam in penetration testing.

Rules: US federal cloud work brings FedRAMP, US health data falls under HIPAA, and many US software companies are asked by their customers for a SOC 2 report, an audit of their controls.

Job figures as of 5 Nov 2026.

United Kingdom

16% of the ads offer hybrid work, and 47% are fully remote.

Pay (Base salary)

Entry level: £37,000 to £45,000 a year
Mid-level: £45,000 to £77,500 a year
Senior: £61,500 to £90,000 a year

Total pay: Payscale, from an older count (Oct 2025), gives bonuses of up to about £8,000 a year and total pay of about £28,000 to £79,000.

Manchester and London lead Indeed's city figures for security engineers.

Sources: ITJobsWatch (Oct 2026), ITJobsWatch: senior (Oct 2026), Indeed (Oct 2026), Payscale (Oct 2025).

Pay researched on 27 Oct 2026.

Certifications: CISSP is widely named in UK ads. For penetration testing, OSCP and the exams of CREST, a UK-founded industry body, are the common proof; UK government work often needs security clearance as well.

Schemes: Cyber Essentials, a UK government scheme backed by the NCSC (the UK's National Cyber Security Centre), is often required of suppliers to the UK public sector.

Job figures as of 5 Nov 2026.

Switzerland

5% of the ads offer hybrid work, and 69% are fully remote.

Pay (Base salary)

Entry level: CHF 89,000 to CHF 101,000 a year
Mid-level: CHF 91,000 to CHF 115,000 a year
Senior: CHF 115,000 to CHF 146,000 a year

Total pay: Payscale gives bonuses of about CHF 4,000 to CHF 25,000 a year, from few salaries collected in 2024.

Of the large cities, Basel pays security engineers the most, then Zurich and Bern (Indeed). Lohncheck puts senior security engineers at about CHF 89,000 to CHF 129,000, counting 13 monthly salaries.

Sources: Indeed (Oct 2026), Payscale (Oct 2024), Lohncheck: senior (2026).

Pay researched on 27 Oct 2026.

Sector: Swiss banks and insurers hire many security engineers and work under the rules of FINMA, the Swiss financial regulator. Ads ask for English with German or French.

Certifications: CISSP and CISM, ISACA's certification for people who manage security, appear often in Swiss ads for senior and lead roles.

Law: the revised Swiss data protection act (FADP) has applied since September 2023; it is close to the GDPR of the EU, but not the same.

Job figures as of 5 Nov 2026.

India

2% of the ads offer hybrid work, and 44% are fully remote.

Pay (Base salary)

Entry level: ₹4 lakh to ₹8.2 lakh a year
Mid-level: ₹4.56 lakh to ₹10 lakh a year
Senior: ₹9.2 lakh to ₹20 lakh a year

Total pay: Payscale gives security engineers bonuses of about ₹20,000 to ₹2.9 lakh a year, and total pay of about ₹4.3 lakh to ₹20 lakh.

Chennai, Gurgaon and Pune pay the most (Indeed, from few salaries).

Sources: Payscale (Apr 2026), Indeed (Dec 2025).

Pay researched on 27 Oct 2026.

Employers: global capability centres (the in-house tech centres of foreign companies), IT services firms and banks hire many security engineers; a security operations centre that watches clients' systems around the clock is a common first job.

Rules: CERT-In, India's national computer emergency response team, requires many organisations to report certain incidents within six hours, and the DPDP Act of 2023, India's data protection law, adds duties for personal data.

Certifications: CISSP, CompTIA Security+ and CEH appear in Indian ads. Write each exactly as granted, with the year.

Job figures as of 5 Nov 2026.

Your CV for a security engineer job

A security CV is read twice: by hiring software that looks for the tools and standards in the ad, and by a security lead who looks for risk you actually reduced. A list of tools says little; a fixed gap, a faster detection or a passed audit says a lot.

Use the keywords the ads use

Name the area the way the ad does: "cloud security", "application security", "incident response", "vulnerability management", "IAM" (identity and access management), "SIEM". The skills table above shows which keywords the ads use most.
Name the tools you ran yourself: the SIEM, the cloud, the scanner, and the scripting language such as Python.
Write certifications exactly as granted: "CISSP", "CompTIA Security+", "OSCP". An exam you are still preparing for is "CISSP, in progress" or "Associate of ISC2", never the full title.
Say what you protected and how big it was: the number of accounts, servers, applications or users. Leave out anything confidential about your employer's weaknesses.

Prove each skill

Write each line as a change you made and its effect, with a number, so the reader can see the risk went down. Keep details that would help an attacker off the page: say what kind of gap you closed, not where it was.

Skill	Weak line	Strong line, with proof
Cybersecurity	Responsible for IT security.	Rolled out phishing-resistant MFA for 2,400 staff; account takeovers fell from 11 a quarter to none.
SIEM	Experience with Splunk.	Rewrote 60 SIEM detection rules; false alarms down by two thirds, triage time down to 15 minutes.
Vulnerability management	Handled vulnerabilities.	Set fix deadlines by real exploit risk; critical findings open past 30 days fell from 140 to 12.
Azure	Cloud security knowledge.	Wrote Azure policies that block public storage and unencrypted disks across 85 subscriptions.
ISO 27001	Supported audits.	Led the technical controls for the first ISO 27001 certification; passed with no major findings.

Never claim an incident or a fix that was a team's as yours alone. Say which part you did: "I wrote the detection", "I led the containment".

How we read our data

The jobs: the security engineer jobs in our job search, matched the same way the search matches them. Our list is not the whole market, so we give shares and rankings, never counts.
The skills: we read a sample of the ads every day and count the skills in them with a fixed word list. We keep only the counts, never the ad text.
Pay: from published salary research, with each source and its date, as a range from entry level to senior. It is not worked out from our ads.
Dates: every figure is worked out again each day, and shows the day it was worked out.

Frequently asked questions

What does a security engineer do?: Builds defences into a company's systems: safe designs, tight access, protected keys, sound cloud settings and monitoring, and helps handle incidents when an attack gets through.
Do I need a certification to become a security engineer?: Not always. Security+ helps for a first job and CISSP is common in senior ads, but hands-on work you can show, such as detections, fixes or a home lab, carries more weight in interviews.
Which cloud should a security engineer learn?: The one the ads in your market name most: Azure is strong in European companies, AWS at start-ups and product companies. The ideas, identity, guardrails and logging, carry over.
Is a security engineer the same as a penetration tester?: No. A penetration tester attacks systems to find gaps; a security engineer builds and runs the defences. Many security engineers test, but most of the job is building.
What should a security engineer CV show first?: Two or three risks you reduced, each with a number, the clouds and tools you ran yourself, and certifications written exactly as granted.

More on the security engineer role

The cvscored teamPublished 27 Oct 2026 · Updated 27 Oct 2026

See open Security Engineer jobs Score your CV for these jobs

Related roles

Jobs from Arbeitnow and the Bundesagentur für Arbeit