Roles we recruit
Seven practices, 27 functions. Start at the practice when you cannot yet name the title; go straight to the function when you can.
Browse all 229 roles Brief us on a seatFlat 15% of first-year base · shortlist in 10 working days
A security engineer protects customer data across your tools: access policies, vulnerability management, logging, incident response and the evidence enterprise buyers and auditors ask for. Certifications are easy to list, so we screen for controls they put in place, an incident they handled and how they work with people who want to move fast.
The first quarter decides whether customer data sits behind controls you can show to a buyer or an auditor. Each stage below has a signal that predicts it, and we test for that signal before you meet anyone.
The ramp, and the test behind each milestone
Weeks 1 and 2
Every system that holds customer data, such as the CRM, billing, support, marketing and the data warehouse, with access lists, sign-in coverage, connected apps and the last security review answers.
On track looks like a data and access map of every tool that holds customer data, with the five biggest gaps ranked by risk.
How we test for it before you meet them
A review exercise in our screen: a described stack and a customer security questionnaire. We score what they check first and what they would ask the business.
Weeks 3 to 6
Single sign-on and multi-factor sign-in enforced on the systems that hold customer data, shared accounts retired, admin rights reduced and a joiner, mover and leaver routine in place.
On track looks like multi-factor sign-in on every system holding customer data, and leavers' access removed within a day.
How we test for it before you meet them
We ask what they changed first at their last company and what pushback they got. A former CTO or IT lead confirms it.
Weeks 7 to 10
Central logs on the key systems, a vulnerability routine with owners and deadlines, and an incident plan with named roles that has been practiced in a tabletop exercise.
On track looks like a tested incident plan and a vulnerability list with owners, ages and fix dates.
How we test for it before you meet them
A reference call about an incident or a tabletop exercise they led: what happened, how long containment took and what changed afterwards.
Weeks 11 to 13
Policies short enough to be followed, evidence collected as part of normal work, a pack for customer security reviews and consistent answers to the common questionnaires.
On track looks like a security review pack that answers common questionnaires, and audit evidence that collects itself.
How we test for it before you meet them
We ask for an audit or an enterprise security review they supported and what slowed it down.
After day 90
A short risk register with owners, a quarterly review with leadership, and new tools checked before they are connected to customer data.
On track looks like new tools reviewed before they are connected, and a quarterly risk review with the CTO and the head of sales.
How we test for it before you meet them
We ask how they decide whether to block a tool or accept the risk. A specific, business-aware answer predicts an engineer others consult rather than avoid.
Five responsibilities. If the seat mainly runs infrastructure and releases, it is a DevOps or cloud engineer; if it mainly watches alerts, it is a security analyst.
Single sign-on, multi-factor sign-in, admin rights and the joiner and leaver routine across the tools that hold customer data.
Finding and tracking weaknesses in systems and dependencies, with owners and deadlines for fixes.
What is logged, who looks at it, and a response plan that has been practiced.
Answers for enterprise buyers, SOC 2 or similar evidence, and policies short enough to follow.
Checking what each new tool can access before it is connected to customer data.
Three neighboring seats absorb work people assume belongs here. Drawing the line wrong is how a security engineer ends up running releases or resetting passwords.
That seat ownsThe path from code to production: pipelines, releases, environments and monitoring.
Hire it instead whenreleases and outages are the pain, more than customer-data risk.
That seat ownsDesigning and running the cloud setup: accounts, networks, services, access and cost.
Hire it instead whenthe cloud foundation needs design or cleanup, beyond the controls on it.
That seat ownsAccounts, servers and the tools people log into: single sign-on, devices, licenses, patching and backups.
Hire it instead whenpeople wait for logins or leavers keep access, which is administration more than security.
The title stays the same; the company does not. Pick the one that matches your situation.
The first dedicated hire, when enterprise deals stall in security review and nobody owns the answers.
Prepares for SOC 2, ISO 27001 or a customer audit, and makes evidence part of normal work.
Works with developers on secure code, dependency checks, design reviews and follow-up on test findings.
The questions we ask in our own screen. Use them in yours; the warning signs are as useful as the answers.
Every candidate we put forward is scored on these five, and the scores travel with the shortlist, gaps included. Four out of five with a named weakness beats a clean sweep you cannot verify.
| What we score | Weak evidence | Strong evidence |
|---|---|---|
| Controls they put in place | Lists tools and certifications. | Controls rolled out on systems holding customer data, with the pushback they handled. |
| Incident handling | Describes alerts, not incidents. | Detection, containment, communication and change afterwards, confirmed by a reference. |
| Prioritizing risk | Works through the scanner list in order. | Ranks by exposure and effort, and agrees deadlines with owners. |
| Working with the business | Sends policies and waits. | Controls that people follow, confirmed by an engineer or a sales leader. |
| Fit with your stack and customers | Experience in a different stack or with different buyers. | Has secured a stack like yours and passed reviews for buyers like yours. |
Public US benchmarks, read October 2026. The sources sit far apart: Salary.com’s security engineer base band ends at $80,121, while Built In’s self-reported median base is $119,000 and the BLS band for information security analysts runs from $97,810 to $163,500. The chart shows all three. Scope, on-call duty and industry move the number most.
Each bar runs from the 25th to the 75th percentile, the middle half of reported pay.
Base salaryWages including commission (BLS)Median base salaryAverage total pay, base plus variable
Security Engineer
Salary.com base benchmark
$62,119 to $80,121 base
Security Engineer, self-reported
Built In, self-reported
$119,000 median base$153,053 average total
Information Security Engineer
Salary.com base benchmark, the same seat under another title
$74,290 to $88,487 base
Information security analysts
BLS, all industries, the nearest category
$97,810 to $163,500
Security Engineer and Information Security Engineer bars: Salary.com base salary, 25th to 75th percentile, United States, as of October 1, 2026. Security Engineer dot and ring: Built In median base salary and average total compensation (base plus additional cash, self-reported), reviewed October 17, 2026. Information security analysts: U.S. Bureau of Labor Statistics, Occupational Employment and Wage Statistics, May 2025, annual wage at the 25th and 75th percentiles (SOC 15-1212), all industries. Public aggregates, not ZaphyrRecruit placement data.
A security engineer protects customer data across a company’s tools. The work covers access and identity, vulnerability management, logging and incident response, security reviews for enterprise buyers, audit evidence such as SOC 2, and checking what each new tool can reach. In a go-to-market company that includes the CRM, billing, support and marketing systems.
Salary.com puts a security engineer at $62,119 to $80,121 base (October 2026) and an information security engineer at $74,290 to $88,487. Built In’s self-reported figures are much higher: a $119,000 median base and $153,053 average total. BLS puts information security analysts at $97,810 to $163,500. Scope, on-call duty and industry explain the spread, so price the seat on what it owns.
A security analyst watches for threats: monitoring alerts, investigating events and reporting what they find. A security engineer builds the controls that make threats harder: access policy, logging, vulnerability management and response plans. In small companies one person does both. If you need someone to review alerts all day, hire an analyst; if controls and customer reviews are the gap, hire an engineer.
When enterprise deals stall in security review, when an audit is coming, or when nobody checks what each new tool can access. Before that, a managed provider and a part-time lead may be enough. The signal is revenue waiting on questionnaires, and customer data spread across tools that nobody has mapped.
A managed provider or consultant suits monitoring, penetration tests and one-off audit preparation. An in-house security engineer pays off when controls need daily ownership: access reviews, vulnerability deadlines, customer questionnaires and new tools. They learn your stack and your buyers. Many companies keep a provider for monitoring and hire the engineer in-house.
Describe your stack and give them a real customer security questionnaire, then ask what they would fix first and what they would ask the business. An hour is enough. It shows how they rank risk and talk to people who are not specialists, which certifications hide. Then ask about an audit or incident they handled and check it with a former engineering lead.
Ten working days from a signed brief to a shortlist of three to five calibrated candidates, each with our review exercise scored and past work checked with a former engineering or IT lead. Interview speed decides the rest: good security engineers rarely run one process at a time, so a decision within two weeks of the first interview keeps them.
Tell us which tools hold customer data, what buyers or auditors have asked for and who owns security today. We come back within one business day with how we would run the search and what the seat pays.
We build shortlists from people doing this work now, often before a seat is advertised. Set up a job alert for security roles, or send your CV and we will come to you when a seat opens.
The security engineer is one of eight seats in this function. If the gap sits elsewhere, start there.