What comes after senior security engineer?

Lead or staff security engineer, then security architect, head of security and CISO.

What is the difference between lead and staff?

Both sit at the same level. A lead guides a group of engineers; a staff engineer drives the hardest technical work across teams without managing people.

Do I need CISSP to become a security architect or CISO?

Many ads for those roles name it, and it shows broad knowledge. What decides is the scope you have already handled, shown with results.

Does a CISO still do hands-on work?

Rarely. The CISO sets direction, owns the risk and the budget, and leads the people who do the hands-on work.

What should the CV show for a head of security role?

A team you built, a programme you ran, an audit or incident you led, and the risk that went down.

Security engineer career path: from engineer to security architect, head of security and CISO

Each step up the security ladder, from security engineer to security architect, head of security and chief information security officer (CISO): what changes in the job, the gap to close, how to show it on your CV and in interviews, and a plan you can follow while working.

The cvscored teamPublished 27 Oct 2026 · Updated 27 Oct 2026

Contents

The ladder at a glance
The steps up to lead and staff
The steps up from lead and staff
Your CV for the next step
Key takeaways
Frequently asked questions
More on the security engineer role

The ladder at a glance

Step	What you are measured on next	Typical time
Security engineer to senior security engineer	Areas you own end to end, without a reviewer	2 to 3 years
Senior security engineer to lead or staff security engineer	Security results across several teams	2 to 4 years
Lead or staff security engineer to security architect	How the whole system fits together, written down	2 to 4 years
Security architect to head of security	A team, a budget and the company's security plan	3 or more years
Head of security to CISO	Security risk at board level, and the trust of customers and regulators	3 or more years

Many security engineers start in cloud teams, and cloud security is one of the busiest corners of this field; the ladder of the cloud platform itself, up to cloud architect and head of cloud, is on the cloud engineer career paths.

Detection and response is the other half of security work: the ladder from SOC analyst through SOC team lead and head of security operations, which meets this one at CISO, is on the security analyst career paths.

Once a security architect, the next steps are senior, principal and chief security architect or head of security architecture; they are set out on the security architect career paths.

The steps up to lead and staff

Security engineer to senior security engineer

What changes: you own an area, such as cloud guardrails, detections or application security, from plan to result, and others bring their questions to you.

The gap: depth in one area and breadth across the rest; threat models you lead; automation in Python or similar; and the habit of measuring whether a control works.

On the CV and in interviews: an area you owned and how its risk changed, with a number. Expect a design review or an incident walk-through.

Plan (9 to 12 months): take one area off your lead's desk; automate its most tedious task; lead two threat models; write the runbook others use.

Senior security engineer to lead security engineer

What changes: you guide a small group of security engineers: plan the work, review it, unblock it, and agree priorities with engineering managers.

The gap: planning and saying no, coaching engineers, and agreeing priorities with teams that have their own deadlines.

On the CV and in interviews: work your group delivered and how you got it there. Expect questions on a conflict over priorities and on growing a junior.

Plan (12 months): run the group's planning for two quarters; mentor two engineers; agree one shared target with an engineering manager and report on it monthly.

Senior security engineer to staff security engineer

What changes: you take on the hardest security problems that cross teams, such as moving the company to single sign-on or to short-lived credentials, and you set the technical standard.

The gap: writing proposals others follow, designing paved roads that are secure by default, and influence without being anyone's manager.

On the CV and in interviews: a cross-team change you drove, with its effect. Expect a system design question with security at its centre.

Plan (12 months): write and win agreement for one company-wide proposal; build one paved road a team adopts; review designs outside your own area every week.

The steps up from lead and staff

Lead security engineer to security architect

What changes: you design how identity, networks, data protection and monitoring fit together across the company, and you write the reference designs teams build from.

The gap: a view of the whole estate, cloud and on premises; frameworks such as zero trust; and drawing a design that both engineers and managers can follow.

On the CV and in interviews: a reference architecture you wrote and the projects that used it. Expect to draw a secure design for a new system on a whiteboard.

Plan (12 months): document the current security architecture; write two reference designs; join the architecture board for every large project.

Staff security engineer to security architect

What changes: your cross-team standards become the company's security architecture, owned and kept up to date by you.

The gap: breadth outside your strongest area, the language of risk and compliance, and planning several years ahead rather than one project.

On the CV and in interviews: the standards you set and how they changed the estate. Expect questions on a design for a regulated workload.

Plan (12 months): fill your weakest area with one real project; map the controls to a framework such as ISO 27001; present a multi-year target design.

Security architect to head of security

What changes: you lead the security team and its budget, own the security plan for the company, and answer for incidents and audits.

The gap: hiring and managing people, budgets and suppliers, policies, audits and regulators, and presenting to leadership.

On the CV and in interviews: the team you built, the programme you ran, and an audit or incident you led. Expect questions on priorities with a fixed budget.

Plan (12 months or more): manage two or three people; own one audit from start to end; write next year's security plan with its costs; run an incident exercise with leadership.

Head of security to CISO

What changes: you own security risk for the whole organisation, report to the CEO or the board, and speak for the company to customers and regulators.

The gap: board reporting, the legal duties of the company, crisis communication, and security as part of business strategy.

On the CV and in interviews: the risk you reduced at company level, the programme you built, and how you worked with the board. Expect a case about a serious breach.

Plan (12 months or more): present to the board or its risk committee; lead a crisis exercise with the executives; build a security strategy tied to the company's plans.

Your CV for the next step

At each step up in security, hiring managers want to see the wider scope already on your CV, under a real job, in the words their ads use. Three rules:

Keep the titles you held. Show the larger scope through the lines under each job.
Use the next level's words. A senior role wants "owned", "threat models", "automation"; a lead or staff role wants "across teams", "standards", "mentored"; an architect role wants "reference architecture", "zero trust"; a head of security role wants "programme", "budget", "audit", "board".
Say what changed. A risk reduced, an audit passed, an incident contained faster, or people you grew.

Skill	Weak line	Strong line, with proof
Ownership	Worked on cloud security.	Owned the cloud guardrails for 85 subscriptions; public storage incidents went from monthly to none.
Across teams	Helped other teams.	Moved 40 services to short-lived credentials with their teams; no long-lived keys left in production.
Architecture	Designed security solutions.	Wrote the zero trust reference design; the 6 most sensitive applications moved behind it within a year.
Programme	Managed security.	Built a team of 5 and the security plan; first ISO 27001 certificate in 14 months.

Key takeaways

The ladder runs security engineer, senior, lead or staff, security architect, head of security, then CISO.
Senior means owning an area and showing its risk went down.
Lead grows a group of engineers; staff solves the hardest problems across teams.
Security architect designs how the whole estate fits; head of security adds a team, a budget and audits.
CISO owns security risk for the organisation and speaks to the board, customers and regulators.

Frequently asked questions

What comes after senior security engineer?: Lead or staff security engineer, then security architect, head of security and CISO.
What is the difference between lead and staff?: Both sit at the same level. A lead guides a group of engineers; a staff engineer drives the hardest technical work across teams without managing people.
Do I need CISSP to become a security architect or CISO?: Many ads for those roles name it, and it shows broad knowledge. What decides is the scope you have already handled, shown with results.
Does a CISO still do hands-on work?: Rarely. The CISO sets direction, owns the risk and the budget, and leads the people who do the hands-on work.
What should the CV show for a head of security role?: A team you built, a programme you ran, an audit or incident you led, and the risk that went down.