◆ Cybersecurity

What a security engineer
really does.

20 tasks, each one witnessed by the sources that watched the job — and behind every one, a prompt you can use tonight.

20evidenced tasks
435,370in the US (2025)
$116,580median pay / year
10systems it runs on
See the 20 tasks ↓Open in the atlasThe full career map →
This is what one task looks like here
Configure firewalls, SIEM, IDS/IPS
Deploy and validate perimeter firewall rulesets, tune the SIEM parsers…2 sources agree

The shape of the day

tap a movement to see its tasks

Which one is you, right now?

Pick the moment · no score, no sign-up
Which moment is you right now?
Whichever you pick, the task behind it opens below.

The work, task by task

20 tasks
Hands on the work18
Configure firewalls, SIEM, IDS/IPS+
Deploy and validate perimeter firewall rulesets, tune the SIEM parsers for endpoint telemetry, and confirm intrusion detection rules block the last three confirmed attack patterns, logging changes in the security ticket with evidence.
jdonet2 agree
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Identify security weaknesses+
Perform a system-wide weakness review focussing on web apps, privileged services, and third-party libraries, produce a ranked list of flaws with exploitability and remediation steps, and present top five items to the dev leads on Monday.
jdonet2 agree
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Implement and manage security controls+
Design and roll out role-based access controls for the finance app, review current ACLs, revoke excessive privileges, and deliver an access-change log and approval workflow to the data owner before the month-end close.
jdonet2 agree
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Implement solutions to control access to data and programs+
Implement multifactor enforcement and least-privilege groups for the shared development repositories, update authentication policies, test service account behaviour, and hand over a runbook and audit trail to the identity team by Friday.
escoonet2 agree
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Collaborate with IT and development teams+
Work with Tom in operations and Priya in development to walk through the new CI pipeline changes, identify where secrets are exposed, decide mitigations, and add the agreed actions to the project record before the sprint demo on Wednesday.
jd
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Stay updated with security trends and vulnerabilities+
Summarise this week's high-priority vulnerabilities affecting our stack, include exploitability and recommended mitigations, and circulate a one-page briefing to the tech leads and CTO by Monday morning.
jd
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Analyze security alerts and logs+
Triage the security alerts from last 24 hours, group by asset and confidence, assign incidents requiring investigation to Jake, escalate confirmed breaches to the incident lead, and append findings to the incident log before end of shift.
jd
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Manage encryption solutions and protocols+
Review our encryption configuration for data at rest and in transit, confirm algorithms, key lengths and rotation schedules meet the policy, document any nonconformance with mitigation steps and owner, and request approval from the CISO.
jd
when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed. Helpful?
Grow the practice1
Keep it safe1

What the work runs on

named inside the evidenced tasks
5 tasksAtlassian Confluencedocuments the access-change log and approval workflow for stakeholders
3 tasksAnsibleautomates consistent configuration and policy deployment across firewalls and monitoring systems
3 tasksAtlassian JIRArecords and tracks configuration changes and evidence against tickets
3 tasksChefmanages and enforces configuration and access policies across servers and services
3 tasksAmazon Web Services AWShosts identity services and access control mechanisms for cloud resources relevant to repository access
2 tasksBashautomates gathering and parsing vulnerability feeds and system inventories for reporting
2 tasksBorder Gateway Protocol BGPused here to validate suspicious network route changes during alert analysis
1 taskC++used for building or running native testing tools and fuzzers against services
Browse every evidenced software task →

The same task, four heights

this page is height one
ExecuteDo today's task, with fewer mistakesyou are here → ImproveMake it easy for the next person to acceptin the atlas → DecideWork out the right move when it is unclearin the atlas → BecomeLearn the pattern so it stops coming backin the atlas →

Can AI actually do this job?

the honest answer

It can

where it genuinely helps
  • Explain the theory behind the work
  • Draft, tidy and structure your writing
  • Rehearse a hard conversation before you have it
  • Build a study plan that fits your gaps

It cannot

where it stops, completely
  • Be in the room where a security engineer actually works
  • Carry the responsibility when the call is wrong — that weight stays yours
  • Notice what no one wrote down: the hesitation, the thing left unsaid
  • Live with the outcome

What the work pays

two countries, two different measures

United States

this exact occupation · BLS 2025
  • $116,580 a year — the middle: half earn more, half earn less
  • The lowest tenth earn near $55,940; the top tenth near $188,470
  • 435,370 people employed in this occupation

India

the occupation GROUP, not this job · PLFS via ILOSTAT 2025
  • ₹38,298 a month — the median for Professionals, the group this work sits in
  • India publishes pay by broad occupation group, so this covers many jobs besides this one. It is a shape, not a salary.
read this carefullyThese two numbers are not comparable and must not be converted into each other. One is a yearly figure for this job alone; the other is a monthly figure for a whole family of jobs. What travels between them is the pattern, not the amount: experience lifts pay almost everywhere.

Where the evidence lives

open any of it yourself
O*NETThe US Department of Labor's own record of this job5 of these tasks ESCOThe European skills and occupations register8 of these tasks Job descriptionsReal postings, in the wild11 of these tasks US Bureau of Labor StatisticsPay and employment, by occupation2025 figures UK NOS SEMETS372Performing computer system security assessments for engineering softwanational standard UK NOS SEMEM459Conducting computer system security assessments for engineering softwanational standard

Close to this work

4 nearby
CybersecurityCybersecurity Analyst20 evidenced tasks CybersecuritySoc Analyst20 evidenced tasks CybersecurityPenetration Tester20 evidenced tasks CybersecurityDigital Forensics Analyst20 evidenced tasks

Questions people actually ask

You’ll split time between monitoring alerts and doing hands-on work. Mornings often start with reviewing SIEM alerts and IDS/IPS logs, triaging incidents, and saying which ones need immediate response.

Afternoons are for tasks like patch management, updating AWS CloudFormation templates, running encryption checks, or writing Ansible/Chef playbooks. Expect meetings with developers or IT to explain findings and plan secure changes.

Common tools are SIEM platforms and IDS/IPS for logs and alerts, plus automation tools like Ansible or Chef to deploy configs. You’ll also see AWS (including CloudFormation) for cloud infra and Bash scripts for quick fixes.

You may also work with Confluence and JIRA for tracking and documentation, and test on systems such as macOS or services using BGP where network-level controls matter.

Use AI for summarizing large log sets, extracting patterns, or drafting incident reports, but never feed raw sensitive data (passwords, keys, full logs) into a public AI service. Treat AI outputs as suggestions, not final decisions.

Keep a human-in-the-loop for any remediation. Log any AI-assisted steps in JIRA or your audit record so you can reproduce and explain actions during a security review.

According to the U.S. Bureau of Labor Statistics (BLS) for 2025, 435,370 people worked in roles like this. The median pay is $116,580 per year, the lowest tenth is $55,940, and the top tenth is $188,470 per year.

Pay varies by region, experience, and whether you work cloud-heavy (AWS) or on-prem networks (BGP). Use the BLS as a baseline and check job postings in your city.

Begin with fundamentals: learn Linux/Bash, basic networking (TCP/IP, BGP), and one programming language like C++ or Python for simple tools. Then practice with Ansible for automation and an AWS free tier account to learn CloudFormation and IAM (access controls).

Do small projects: harden a macOS or Linux VM, set up an open-source SIEM, and log everything into Confluence/JIRA. That gives concrete evidence you can show during interviews.

Translating technical findings into clear, actionable items for non-technical teams. You need to explain what a vulnerability means, the risk level, and the exact steps to fix it in JIRA or a meeting.

Technically, mastering detection and triage in a SIEM (reading noisy logs, tuning rules) takes the most time. That skill combines pattern recognition, knowing systems like AWS, BGP, and practical scripting with Bash or Ansible.