Security engineering is a builder role, and the CV needs to prove it. The distinction between a security analyst and a security engineer is the difference between monitoring an environment and constructing the controls that protect it — writing detection rules rather than triaging alerts, integrating SAST into CI/CD pipelines rather than reviewing scan reports, designing IAM architecture rather than auditing access logs. Most security engineer CVs fail because they describe tools used rather than systems built, analysis performed rather than controls deployed, and advisory work rather than engineering work. A security engineer CV that has no code, no tooling built, and no automation evidence will not shortlist for engineering-track roles regardless of the analytical depth it demonstrates. The second structural issue is domain clarity: AppSec, cloud security, detection engineering, and identity/PAM are different disciplines with different toolchains and different hiring pools. A CV that doesn't signal which domain the candidate builds in will be screened out for all of them. This guide covers how to structure a security engineer CV, the ATS keyword clusters that matter by domain, and the bullet patterns that prove engineering output.

What Security Engineer Job Descriptions Require in 2026

Security engineer JDs split by domain. The four primary domains in 2026 hiring:

Application Security (AppSec) Engineer: Secures software development processes. Primary work: integrating security tooling into CI/CD (SAST, SCA, secret scanning, DAST), conducting code review, running threat modelling sessions with product teams, and triaging security findings from automated scanning. Requires software engineering literacy — the ability to read code in at least one language and understand the vulnerability classes in the OWASP Top 10. Python or Go for automation is expected.

Cloud Security Engineer: Designs and implements security controls for cloud infrastructure. Primary work: cloud security posture management (CSPM), IAM design and least-privilege enforcement, network security (security groups, VPC design, network policies), encryption (KMS, secrets management), and cloud-native security tooling (AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center). Terraform for security infrastructure-as-code is standard.

Detection Engineer: Builds the detection logic that the SOC uses. Primary work: writing SIEM detection rules (Splunk SPL, KQL for Sentinel, SIGMA rules), developing and tuning detections mapped to MITRE ATT&CK techniques, building SOAR playbooks for automated response, and measuring detection coverage. Strong crossover with data engineering skills.

Identity and Access Security Engineer: Designs zero trust architecture, PAM (Privileged Access Management) systems, PKI, and SSO/MFA deployments. Less common as a standalone title; more often combined with platform or infrastructure security. Okta, CyberArk, HashiCorp Vault, and certificate management are the primary tooling areas.

Requirements common across all security engineering domains:

  • Code and automation — Python (universal), Go (infrastructure and detection tooling), Bash (automation). Security engineers who cannot write code are limited to configuring vendor products; those who can extend and automate them are significantly more valuable.
  • Cloud platform depth — AWS, Azure, or GCP security services, with IaC (Terraform, CDK, Bicep) for security control deployment
  • Relevant certification — domain-specific: AWS Security Specialty, Azure Security Engineer Associate, CKS (cloud/container security), GIAC certs (detection/AppSec), CISSP for senior/architecture roles

Security engineer salaries in 2026: £55K–£90K UK; $110K–$160K US. Senior security engineers and detection engineering leads exceed £100K/$175K.

ATS Keywords for a Security Engineer Resume

Security engineering ATS filtering is domain-specific. The tool and framework names for AppSec are entirely different from those for cloud security or detection engineering — use the cluster that matches your domain.

Essential ATS terms for a security engineer resume:

  • Title variants: Security Engineer, Application Security Engineer, AppSec Engineer, Cloud Security Engineer, Detection Engineer, DevSecOps Engineer, Platform Security Engineer, Staff Security Engineer
  • AppSec: SAST, DAST, SCA, Semgrep, Snyk, Veracode, Checkmarx, Burp Suite, OWASP Top 10, secure code review, threat modelling, shift-left security, CI/CD security, secret scanning, GitHub Advanced Security
  • Cloud security: AWS Security Hub, Microsoft Defender for Cloud, GCP Security Command Center, CSPM, IAM, KMS, secrets management, HashiCorp Vault, network policy, security groups, CIS Benchmark, AWS Config, Azure Policy
  • Detection engineering: SIEM, Splunk, SPL, Microsoft Sentinel, KQL, SIGMA rules, MITRE ATT&CK, detection rules, SOAR, security automation, threat hunting, false positive tuning
  • Container and infrastructure: Kubernetes security, OPA, Falco, container security, CKS, Terraform, infrastructure as code, network segmentation
  • Identity: zero trust, Okta, CyberArk, PAM, PKI, certificate management, MFA, SSO, SAML, OAuth
  • Languages: Python, Go, Bash, PowerShell
  • Certifications: CISSP, AWS Security Specialty, Azure Security Engineer Associate, CKS, GIAC, GREM, GWEB, CompTIA Security+
  • Long-tail phrases: security engineer resume examples, how to write a security engineer resume, AppSec engineer cv, cloud security engineer resume, detection engineer resume

Placement: Domain (AppSec / Cloud Security / Detection) and primary tooling in the headline. Code languages (Python, Go) visible in Skills — they signal engineering ability. GitHub link in your header if you have public security tools, detection rules, or security automation scripts.

Security Engineer CV Structure and Bullets That Prove Engineering Output

Section order:

  1. Headline — "Security Engineer | AppSec · Semgrep · Snyk · CI/CD · Python · OWASP" or "Cloud Security Engineer | AWS Security Hub · Terraform · CSPM · IAM · CKS"
  2. Certifications — domain-relevant cert first; AWS Security Specialty, CKS, GIAC certs near the top
  3. Skills — Security Domain / Languages & Automation / Cloud / Detection & Response / Frameworks
  4. Experience — 4–5 bullets per role; show what was built, deployed, or automated — with scale and outcome
  5. Projects / Open Source — security tools you have built, detection rule libraries, GitHub contributions to security projects; this section has real weight for security engineering roles

Two pages for 4+ years. GitHub link in the header. If you have contributed to open-source security projects or published detection rules, list them — they are more persuasive than most certifications.

Three elements make a security engineering bullet convincing: what was built or deployed (tool, system, control), the scale of deployment (endpoints, pipelines, teams), and the security outcome (vulnerabilities blocked, MTTD reduced, compliance achieved). Three examples:

  • Built a detection engineering pipeline for a 4,000-endpoint environment — authored 34 detection rules in Splunk SPL mapped to 22 MITRE ATT&CK techniques; reduced MTTD on covered attack techniques from 6 hours to 11 minutes with false positive rate held below 3% through tuning and exception management
  • Integrated SAST (Semgrep), SCA (Snyk), and secret scanning into 18 CI/CD pipelines across 6 product teams — blocked 240 high-severity security findings from reaching production in the first 6 months; reduced mean time to remediate code vulnerabilities from 34 days to 8 days
  • Deployed a cloud security posture management solution using AWS Security Hub and custom Lambda remediation functions — achieved 94% compliance against CIS AWS Benchmark within 8 weeks; automated remediation for 12 low-risk misconfiguration classes, freeing 14 hours of weekly manual security review

Security engineering interviews test both design ("how would you implement a zero trust architecture for this environment?") and code ("write a Python script to parse this log and extract IOCs"). For detection engineering roles, expect to write a SIGMA or KQL rule for a given attack technique. Your bullets' specificity sets the technical depth of the interview discussion.

Three Security Engineer CV Mistakes That Position You as an Analyst

Tools used, not tools built or configured at scale. "Experience with Semgrep and Snyk" signals awareness. "Integrated Semgrep into 18 CI/CD pipelines, writing 40 custom rules targeting the organisation's primary vulnerability patterns and reducing mean time to fix from 34 days to 8 days" signals engineering. The distinction is: did you use the tool, or did you deploy, configure, extend, and measure it? For every security tool on your CV, ask: what did I actually do with it beyond running it? The answer to that question is the bullet.

No code or automation evidence. Security engineering roles require software engineering skills. A security engineer who configures vendor products manually but writes no code is a power user, not an engineer. Hiring managers for engineering-track security roles expect to see Python, Go, or Bash evidence — scripts, automation, custom tooling, SOAR playbooks, or detection rule code. If your current CV has zero code evidence, add it: even a GitHub repository with a Python script for log parsing or a collection of SIGMA detection rules signals the engineering mindset that separates these roles from analyst positions.

Domain ambiguity. A CV that mixes AppSec bullets, cloud security work, detection rule authorship, and IAM architecture without a clear positioning tells the hiring manager that the candidate is unfocused or junior. Senior security engineers specialise — they are the AppSec person or the cloud security person, with secondary exposure to adjacent areas. Lead with your primary domain in the headline, frame your experience bullets around that domain, and position adjacent skills as supporting context. A clear domain signal is what gets a security engineer CV into the right shortlisting pile.

If you are applying to security engineer or DevSecOps roles and want your CV rebuilt around the specific AppSec, cloud security, or detection engineering requirements in a target job description, Resumegpt generates your security engineer CV from your work history in under 60 seconds — engineering output evidenced, domain positioned, ATS-optimised, and exported as a PDF ready to submit.