What employers ask for in Security Engineer jobs

We read 26 current Security Engineer postings from 24 companies' own career sites on November 4, 2026 and counted, posting by posting, what they ask candidates for.

Does your resume say what these postings ask for? Paste a Security Engineer job link and your resume to see which keywords you're missing — free, no signup.

Check my resume free Tailor it to a job with AI →

26postings read

24companies

5 yrsmedian minimum experience (20 postings state one)

54%say remote (12% hybrid)

Tools and technologies

Share of postings that name each one.

Python65% · 17 of 26
AWS50% · 13 of 26
Go35% · 9 of 26
Burp Suite23% · 6 of 26
DAST23% · 6 of 26
GCP23% · 6 of 26
JavaScript23% · 6 of 26
Azure19% · 5 of 26
Java19% · 5 of 26
Kubernetes19% · 5 of 26
Rust15% · 4 of 26
TypeScript15% · 4 of 26
Ruby12% · 3 of 26
Semgrep12% · 3 of 26
C/C++8% · 2 of 26

Skills and methods

Threat modeling58% · 15 of 26
Application security35% · 9 of 26
OWASP Top 1035% · 9 of 26
SAST31% · 8 of 26
CI/CD27% · 7 of 26
Penetration testing27% · 7 of 26
Incident response23% · 6 of 26
DevSecOps19% · 5 of 26
Vulnerability management19% · 5 of 26
Cloud security15% · 4 of 26

Soft skills

Communication62% · 16 of 26
Collaboration8% · 2 of 26
Problem-solving8% · 2 of 26

Experience

20 of 26 postings state a minimum number of years; the median is 5 years.

0–2 years0% · 0
3–4 years35% · 7
5–7 years55% · 11
8+ years10% · 2

Where and with what degree

Remote54%
Hybrid12%
On-site8%
Not stated27%
Degree required19%
Degree preferred31%

Using this on your resume

Applicant tracking systems match words. If you have the tools above, name them the way the posting does ("Python", not a synonym).
Every posting is different: check the one you apply to, not just the average. The free match shows what a specific posting asks for that your resume doesn't mention.
Only claim what you've done. ApplyLoop's AI rewrite works from your own resume, and a review pass checks the result for skills your resume doesn't support.

Postings we read

Read on November 4, 2026; some may have closed since.

Company	Role
Abnormalsecurity	Application Security Engineer II – Abnormal AI
Anthropic	Staff+ Application Security Engineer
AvePoint	Junior Security Engineer
Brex	Staff Application Security Engineer – Career Opportunities
Bugcrowd	Application Security Engineer
CAIS	Lead Application Security Engineer
Figma	Security Engineer
Forward financing	Senior Application Security Engineer
Generalmatter	Security Engineer
GuidePoint Security	Application Security Engineer – Mid-Atlantic region (Remote in VA, MD, PA, NC, DE, NJ, or DC)
iCapital	Application Security Engineer – Assistant Vice President
ITHAKA	Platform Security Engineer
Oneleet	Application Security Engineer
Patreon	Security Engineer
Quanata	Application Security Engineer [Remote-US]
Ripple	Open Role – Senior Security Engineer
Robinhood	Senior Offensive Security Engineer
Samsara	Staff Application Security Engineer – San Francisco, CA, United States
Sonyinteractiveentertainmentglobal	Senior Application Security Engineer
Stripe	Stripe Careers – Cloud Security Engineer
Stripe	Stripe Careers – Security Engineer
Strive Health	Application Security Engineer
Via	Application Security Engineer
Wizinc	Security Engineer – Product – Wiz Careers
Xai	Application Security Engineer
Xai	Application Security Engineer (X Money) – Greenhouse

How we counted

We searched company career sites hosted on Greenhouse, Lever, Ashby, Workable and SmartRecruiters for current postings titled “security engineer”, “application security engineer”, “cloud security engineer”, at most two per company, and read each one. An AI model listed what each posting asks for; we kept an item only when the posting contains it word for word, and list it here when at least two postings ask for it. Seniority levels are mixed. Updated November 4, 2026.