Security engineer

What it answers for

• Controls that are deployed, functioning and monitored rather than merely purchased.
• Changes that do not take production down in the name of securing it.
• Knowing which controls are currently degraded, before someone else finds out.

What it is measured on

• Coverage: how much of the estate the control actually reaches.
• False positives, which is the number that decides whether the control survives its first month.
• Time to deploy a change, since a control nobody can modify safely becomes a control nobody modifies.

Who else has a stake

• Every team whose traffic passes through something this role configured.
• The service desk, whose ticket volume moves with each tuning decision.
• Finance, since licence consumption is a consequence of engineering choices.

What it takes

• Real depth in at least one platform, and enough in the neighbouring ones to integrate them.
• Change discipline, because this role breaks production in a uniquely embarrassing way.
• The patience to tune rather than to disable.
• Scripting, since consistency at scale is not achieved by hand.

The published sources

• NICCS, CISA - the NICE Workforce Framework for Cybersecurity, which defines the work roles, tasks and skills used across public, private and academic sectors
• NIST Cybersecurity Framework - the Govern, Identify, Protect, Detect, Respond and Recover functions that most security programmes are organised against

Where it leads

• Security architectWho defends it
• Network security engineerWho defends it
• Security operations analystWho defends it
• Network operations specialistWho runs it

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

• Reading a design you did not writeInheriting a system somebody else designed is one of the most common situations in this work, and the first act is not to judge the design but to recover the constraints it was answering. Almost everything that looks wrong is a decision whose reason has left the building, and the parts that are genuinely wrong are indistinguishable from the parts that are not until you know which is which.
• What acceptance testing is actually forAcceptance testing is not a demonstration that the system works. Its real function is to write down what "working" was agreed to mean, while both parties still want to agree — so that the argument arriving eighteen months later has a document instead of two memories.
• The runbook nobody can follow, and whyRunbooks fail when they are written by the person who least needs them, at the moment they understand the system best, for a reader they imagine to be themselves. The fix is not more detail — it is writing for a specific reader in a specific state, and then letting that reader break it before you need it.
• Handover: the moment a project becomes an operationHandover is treated as a document transfer and is actually a transfer of judgement — and judgement is the one thing that cannot be handed over in a meeting. What can be transferred is the reasoning behind the decisions, the list of things that were left unfinished, and the name of somebody who will answer the phone.
• Baselines — knowing what normal looks like before you need toA baseline is not monitoring and not documentation. It is the answer to the only question that matters in the first ten minutes of an incident — has this always been like that — and it is the one artefact that can only be made when nothing is wrong.
• What a baseline cannot tell youA baseline records what happened during the period it was taken and silently promotes that period's conditions to the status of normal. It answers whether something changed, which is worth having — but it cannot tell you whether the thing it recorded was ever right, and the difference between those two questions is where confident wrong answers come from.
• Change windows, and the arithmetic of a rollbackA change window is not the time the change takes. It is the time the change takes plus the time to discover it went wrong plus the time to put it back — and the third number is the one nobody measures, which is why windows overrun and rollbacks get abandoned halfway.
• Naming, addressing, and the cost of getting them wrong earlyNaming and addressing are decided in an afternoon by whoever is free, and they outlast every other decision in the estate — not because they are technically hard to change, but because everything else quietly comes to depend on them. The cost is paid years later, by somebody else, in a currency nobody budgeted.

Read The Practice