Short answer
Security engineering assesses how technical security risk is identified, reduced, and verified within the person’s scope.
About Security engineering
The ability to reduce technical security risk through secure design, implementation, verification, and evidence-based remediation.
Use this competency for
- Roles that design, build, review, or operate systems with security-relevant data or access.
- Functions responsible for technical controls, threat analysis, or vulnerability remediation.
Do not use this competency for
- Roles with no influence over technical design, implementation, access, or security controls.
Important distinctions
Reliability engineering
Reliability engineering protects availability and recovery. Security engineering protects systems and data against misuse and unauthorized access.
Code quality
Code quality covers maintainability of code. Security engineering covers technical risk from threats, controls, and unsafe behavior.
Expectations by level
IC1
Individual contributor 1
Implements a scoped change with guidance using established security controls and resolves identified issues before release.
Observable behaviors
- Uses approved authentication, authorization, and secret-handling patterns.
- Runs the required security checks for the change.
- Escalates a possible exposure with reproducible evidence.
Examples
- Used the existing authorization check instead of trusting a client-provided role.
- Removed a credential from a test fixture and followed the team rotation procedure.
IC2
Individual contributor 2
Independently assesses and reduces security risk in a team-owned system, handling incomplete threat information and verifying controls.
Observable behaviors
- Maps trust boundaries and likely abuse paths for a change.
- Prioritizes findings by realistic impact and exposure.
- Tests that a control blocks the behavior it targets.
Examples
- Added object-level authorization after testing access across two account contexts.
- Designed a file upload flow with type validation, size limits, and isolated processing.
IC3
Individual contributor 3
Sets security direction across teams for complex shared risks and enables teams to apply verifiable controls without relying on one reviewer.
Observable behaviors
- Defines reusable controls for a recurring threat class.
- Coordinates remediation where ownership crosses systems.
- Uses findings and incidents to improve shared security guidance.
Examples
- Introduced a shared authorization boundary after similar access flaws appeared in several services.
- Led remediation of an exposed dependency path across teams and verified each reachable instance.