← Back to Guides

2026-03-22

How to Hire a Security Engineer: AppSec + InfoSec

How to Hire a Security Engineer: AppSec + InfoSec

The cybersecurity talent war is real. Organizations are competing fiercely for security engineers who understand both offensive and defensive security landscapes, and the competition shows no signs of slowing down. Whether you're building a security team from scratch or scaling an existing one, hiring the right AppSec (application security) and InfoSec (information security) engineers requires a different playbook than standard software engineering recruitment.

This guide walks you through everything you need to know to attract, evaluate, and hire top-tier security engineering talent.

Why Hiring Security Engineers Is Different

Before we dive into the mechanics of recruitment, understand this: security engineers operate in a different hiring ecosystem than general software engineers. Here's why:

  • Specialized knowledge: Security engineering requires deep, domain-specific expertise that takes years to develop
  • Verification complexity: You can't easily test security knowledge in a 45-minute interview without exposing your actual infrastructure
  • Market scarcity: The demand for security engineers far exceeds supply—the 2024 ISC² Cybersecurity Workforce Study reported a global cybersecurity workforce gap of 4.9 million positions
  • Salary expectations: Security engineers command premium salaries because their expertise directly prevents costly breaches
  • Cultural fit matters more: Security-minded engineers often have strong opinions about risk tolerance and process—they need to align with your organization's security culture

Understanding these differences upfront prevents you from recruiting security engineers like you'd recruit backend developers. You'll need adjusted timelines, different evaluation criteria, and a stronger value proposition.

Understanding the Two Flavors: AppSec vs. InfoSec

Not all security engineers are the same. The two primary specializations have overlapping skills but distinct focuses.

Application Security (AppSec) Engineers

AppSec engineers focus on securing software throughout its lifecycle—from design and development through deployment and maintenance.

Key responsibilities: - Code review and static analysis - Threat modeling and security architecture design - Vulnerability assessment and penetration testing of applications - Integration of security into CI/CD pipelines - Security training and mentoring for development teams - Vulnerability remediation and patching

Required skills: - Deep knowledge of OWASP Top 10 vulnerabilities - Code review expertise (language-agnostic or specific to your stack) - Understanding of secure SDLC practices - Experience with security tools (SAST, DAST, dependency scanning) - Ability to communicate security risks to developers

Best suited for: Organizations with heavy software development operations; SaaS companies; fintech and healthcare software providers; companies where custom code is a core business asset.

Information Security (InfoSec) Engineers

InfoSec engineers (also called infrastructure or network security engineers) focus on protecting systems, networks, and data at rest and in transit.

Key responsibilities: - Network segmentation and firewall management - Identity and access management (IAM) implementation - Incident response and forensics - Compliance and regulatory framework implementation - Security monitoring and threat detection - Hardening systems and infrastructure

Required skills: - Network architecture and protocols understanding - Cloud security (AWS, Azure, GCP) - Linux/Windows hardening and administration - Identity management systems - SIEM and security monitoring tools - Compliance frameworks (SOC 2, ISO 27001, PCI-DSS, HIPAA)

Best suited for: Enterprise organizations; companies handling sensitive data; regulated industries; organizations with distributed infrastructure; companies operating in high-risk verticals.

Security Engineer Salary Benchmarks (2026)

Compensation is often the first hurdle. Knowing competitive salary ranges helps you structure offers that actually land candidates.

Experience Level Base Salary (US) Total Comp (with equity/bonus) Market Context
Entry-Level (0-2 years) $110K - $140K $130K - $170K Fresh certifications or bootcamp grads
Mid-Level (2-5 years) $140K - $180K $170K - $240K Proven track record in security roles
Senior (5-10 years) $180K - $240K $240K - $320K Leadership, specialized expertise
Staff/Principal (10+ years) $240K - $350K+ $320K - $500K+ Architectural decisions, mentorship

Geographic variation is significant. San Francisco, New York, and Seattle security engineers command 20-35% premiums compared to tier-2 cities. Remote-first companies often hire based on market rates where the candidate is located.

Additional compensation factors: - Signing bonuses: $15K-$50K depending on seniority - Performance bonuses: 10-25% of base salary typical in security roles - Equity: Critical for early-stage companies; less emphasized at mature enterprises - Certifications: CEH, CISSP, OSCP holders often negotiate 10-15% increases

Key Skills to Evaluate

When screening candidates, look for both hard technical skills and soft skills. Security engineering uniquely requires both sides.

Hard Technical Skills

For AppSec roles: - Proficiency in at least 2-3 programming languages (the most common are Python, Java, Go, JavaScript) - Static code analysis and vulnerability scanning tools (Checkmarx, Synopsys, SonarQube, Semgrep) - Dynamic application security testing (Burp Suite, OWASP ZAP) - Container security (Docker, Kubernetes security controls) - Web application firewalls and WAF rules - Secure code review methodology

For InfoSec roles: - Network protocols and TCP/IP deep knowledge - Cloud platforms (AWS IAM, Azure AD, GCP security) - SIEM tools (Splunk, ELK, Sumo Logic) - Firewall and VPN technologies - Directory services (Active Directory, LDAP) - Intrusion detection/prevention systems (Snort, Zeek) - Encryption and PKI concepts

Soft Skills (Often Overlooked)

  • Communication: Translating security requirements into business language
  • Problem-solving: Thinking like an attacker while defending like an architect
  • Persistence: Security is a marathon; ability to advocate for security in political environments
  • Attention to detail: One missed vulnerability can be catastrophic
  • Collaboration: Working across dev, ops, and business teams
  • Learning agility: Security landscape changes rapidly; candidate must stay current

How to Source Security Engineering Talent

Most security engineers aren't aggressively job hunting. They're either happily employed in security roles or still learning security in other roles. Your sourcing strategy needs to reflect this reality.

1. GitHub and Code Repository Analysis

Security engineers leave distinctive traces in their GitHub repositories:

What to look for: - Security-focused open-source projects (authentication libraries, encryption tools, vulnerability scanners) - Contributions to established security projects (OWASP, CoreSecurity, penetration testing frameworks) - Code demonstrates secure practices (input validation, proper secret handling, cryptography knowledge) - Regular contributions (commitment to continuous learning)

Zumo analyzes GitHub activity to identify engineers with security expertise patterns—look for candidates with consistent contributions to security-adjacent codebases or projects solving security problems.

2. Security Communities and Conferences

Unlike general software engineering, security talent congregates in predictable places:

  • DEF CON, Black Hat, RSA Conference: Attendee lists are goldmines; consider sponsoring villages
  • OWASP local chapters: Regular attendees are security-motivated
  • Bug bounty platforms: HackerOne and Bugcrowd host thousands of security-minded engineers
  • Security subreddits and forums: r/netsec, r/cybersecurity, Stack Exchange Security tag
  • LinkedIn security groups: Niche but populated with practitioners

3. Certifications as Initial Filters

While certifications don't guarantee competence, they signal commitment to security:

  • CEH (Certified Ethical Hacker): Entry to mid-level, practical focus
  • CISSP (Certified Information Systems Security Professional): Mid to senior, comprehensive
  • OSCP (Offensive Security Certified Professional): Highly respected, hands-on penetration testing
  • GIAC certifications (GPEN, GSEC, GCIH): Technical, employer-valued
  • Cloud certifications (AWS Security, Azure Security Engineer): Increasingly relevant
  • CompTIA Security+: Common baseline for government/contractor roles

Don't make certifications a hard requirement, but do use them as sourcing filters. Certified candidates are easier to recruit through LinkedIn because they publicly display credentials.

4. Your Network and Referrals

Referral programs are gold for security hiring. Offer security engineers a $3K-$7K referral bonus (higher than standard tech referrals) for successful hires. Security engineers know other security engineers—leverage this network aggressively.

Evaluating and Vetting Security Engineers

The technical interview process for security engineers differs substantially from software engineering interviews.

The Screening Call (30 minutes)

Focus on motivation and background, not technical depth yet:

  • "Walk me through your journey into security. What drew you to this specialization?"
  • "Tell me about the most interesting security vulnerability you've discovered or remediated"
  • "What's your experience with [your specific stack/environment]?"
  • "How do you stay current with security threats and trends?"
  • "What's your experience with our compliance/regulatory requirements?" (HIPAA, PCI-DSS, SOC 2, etc.)

Red flags: Candidate hasn't read any security blogs in the last year; can't articulate why security matters; dismissive of compliance requirements.

The Technical Assessment (60-90 minutes)

This is where vetting gets tricky. Never ask candidates to actually attack your systems or infrastructure. Instead:

Option A: Code review exercise Provide deliberately vulnerable code (this can be public, intentionally flawed code samples). Ask the candidate to: - Identify vulnerabilities and their severity - Explain the impact of each issue - Propose fixes using secure coding practices - Rate the overall security posture

Option B: Architecture review Present a system design and ask: - Where are the security gaps? - How would you threat model this? - What's your defense-in-depth strategy? - Which security tools would you integrate?

Option C: Incident response simulation Describe a security incident scenario: - "Logs show suspicious database queries from your app server at 3 AM. Walk me through your response." - "A developer commits a private API key to GitHub. What's your immediate action plan?"

Evaluate not just correctness, but reasoning. Security is nuanced. A candidate who explains their thinking process is more valuable than one who gives a "correct" answer without context.

The culture and values interview (30 minutes)

With hiring manager or security leadership:

  • "Tell me about a time security and business priorities conflicted. How did you handle it?"
  • "Describe your approach to balancing security rigor with developer experience"
  • "How do you handle pushback when recommending security controls?"
  • "What does a healthy security culture look like to you?"

This interview matters because security engineers with poor communication skills can cause more harm than good (by creating friction, being dismissed by teams, or implementing controls that get bypassed).

Reference checks (specific to security roles)

Ask previous managers: - How did this person balance security thoroughness with shipping velocity? - Can you describe an incident this person responded to? - How did they communicate security risk to non-technical stakeholders? - Would you hire them again for a security role?

Red Flags and Deal-Breakers

Some warning signs specific to security hiring:

Red Flag Why It Matters
Candidate talks about hacking competitors' systems casually Legal and ethical concerns
Resume shows long gaps in security knowledge (no certs, contributions, or learning) Security evolves rapidly; gaps suggest stagnation
Dismissive of compliance or regulations Fundamental misalignment with role requirements
Can't explain their past security decisions clearly Communication weakness threatens team effectiveness
All previous roles were in security defense, no offensive experience (or vice versa) Both perspectives strengthen engineers; one-sided experts hit blind spots
No personal projects or learning investments outside work Security requires continuous self-education; passive learners lag

Building Your Security Team Composition

Most organizations need both AppSec and InfoSec specialists, even if they start small. Consider this composition:

For a startup (5-50 engineers): - 1 security generalist who can do both AppSec and InfoSec - Hire someone with slightly stronger AppSec bent if you must prioritize

For a growth-stage company (50-200 engineers): - 1 AppSec engineer focused on application security and developer enablement - 1 InfoSec engineer focused on infrastructure, compliance, and incident response - 1 security engineer or operations analyst to handle tooling and monitoring

For an enterprise (200+ engineers): - 2-3 AppSec engineers (one senior, one mid-level, one junior/intern) - 2-3 InfoSec engineers with specializations (cloud security, incident response, compliance) - 1 security architect or principal engineer (strategic planning) - 1 security operations analyst or SOC engineer

Timeline Expectations for Security Hiring

Security hiring takes longer than standard engineering roles. Plan accordingly:

  • Sourcing phase: 2-4 weeks (longer if you don't already know the community)
  • Screening: 1-2 weeks (small applicant pools mean less filtering)
  • Technical evaluation: 1-2 weeks (more rigorous, candidates are often slower to respond)
  • Interviewing: 1-2 weeks (4-5 rounds typical for senior roles)
  • Offer and negotiation: 1-3 weeks (candidates often negotiate harder)
  • Notice period: 2-4 weeks (average is 3 weeks)

Total timeline: 8-18 weeks is realistic for mid-level or senior security engineers. This is substantially longer than recruiting software engineers. Budget accordingly in your hiring plan.

Competitive Advantages in Security Recruiting

Stand out to security talent by emphasizing:

  • Security budget and tool investments: "We invest in best-in-class security tooling (Snyk, Datadog, Vault, etc.)"
  • Autonomous security responsibilities: "You'll own application security strategy, not just review pull requests"
  • Learning and certification support: "Annual security conference budget, certification exam reimbursement"
  • Incident response experience: "We've had real security incidents; you'll learn and improve defenses"
  • Work-life balance in security roles: Contrary to popular belief, security engineers appreciate reasonable hours (alerting shouldn't page on weekends for non-critical issues)
  • Cross-functional influence: "Security recommendations go directly to engineering leadership"

Resources for Security Hiring

To deepen your sourcing and evaluation process:

  • OWASP Top 10: Must-read for AppSec evaluation
  • NIST Cybersecurity Framework: Foundation for InfoSec hiring
  • PortSwigger Web Security Academy: Free resource candidate should know
  • HackTheBox and TryHackMe: Platforms where security candidates practice
  • GitHub's security advisory database: See what real vulnerabilities look like
  • Cloud provider security certifications: AWS, Azure, GCP all offer security-specific paths

How Zumo Helps With Security Engineering Recruitment

Zumo helps recruiters identify security engineers by analyzing GitHub activity patterns. You can identify candidates who:

  • Contribute to security-focused projects and repositories
  • Maintain security tools or libraries
  • Participate in security-focused code review patterns
  • Have demonstrated commitment to learning security through open source

Rather than relying solely on LinkedIn searches or referrals, Zumo's GitHub analysis surfaces security engineers who are actively learning and contributing—often before they're actively job hunting.

FAQ

What's the difference between a security engineer and a security analyst?

Security analysts typically focus on monitoring, alerting, and incident response using existing tools. Security engineers build, design, and improve security systems and processes. Engineers usually require deeper technical expertise and command higher salaries ($20K-$50K more typically). For this hiring guide, we're focused on engineers—architect-level security talent.

Should we require CISSP for security engineer hires?

Not necessarily for junior or mid-level roles. CISSP requires 5+ years of security experience anyway, so it filters too aggressively for growing teams. For senior hires or architect roles, CISSP is valuable. OSCP or CEH is more practical for technical evaluation at all levels.

How do we evaluate security skills without a security expert on our hiring team?

You have three options: (1) Hire a security consultant to help evaluate technical interviews initially, (2) bring in a trusted security vendor partner to validate candidates, or (3) ask finalists to present a security architecture proposal for feedback from your team (security-minded engineers explain their thinking clearly). Option 3 isn't perfect, but it works better than you'd expect.

Can we hire AppSec engineers without infrastructure/DevOps experience?

Yes, but with limitations. AppSec engineers who understand CI/CD pipelines and container orchestration (Kubernetes, Docker) are significantly more effective. If your first AppSec hire doesn't have this, consider pairing them with a DevOps engineer during implementation planning.

What salary do we need to be competitive for a senior security engineer in 2026?

At minimum: $200K-$240K base + 10-20% bonus + meaningful equity (if startup). In top markets (Bay Area, NYC, Seattle), add 20-30% to those figures. If you're trying to hire a CISSP-certified principal engineer, expect $280K-$350K+ total compensation. Underestimating security engineer salary is the #1 reason security hiring fails.

Start Building Your Security Team

Hiring security engineers requires patience, specificity, and competitive compensation. The talent pool is smaller than for general engineering roles, but the impact of having great security engineering on your organization is exponential—preventing breaches, reducing risk, and enabling your development team to move with confidence.

Ready to source security engineers more efficiently? Zumo analyzes GitHub activity to identify engineers with demonstrated security expertise and project involvement, helping you build sourcing lists faster. See how security engineers show up in their code contributions and open-source work.

For more on technical hiring strategies, check out our hiring guides for specific programming languages and roles.