What separates a good security engineer from a great one in 2025
New research and industry voices spell out what companies should demand when hiring the people who keep their systems safe, and why a checklist of certifications no longer cuts it.
Key points
- 43% of more than 625 security executives surveyed named third-party supplier risks as their single top priority.
- AI tools now handle vulnerability scanning and threat flagging that previously took security teams hours.
- The strongest security engineers move fluently across cloud infrastructure, application security and compliance without handing off work at every boundary.
- Criminals use the same AI writing and automation tools as defenders, making phishing emails harder to detect and social engineering attacks more precisely targeted.
The job of a security engineer, meaning the specialist who designs and builds the technical defences protecting a company's data and systems, has changed more in the past two years than in the previous ten. What companies need from those engineers has shifted just as fast.
CSO Online gathered views from practitioners at major organisations to map out what separates an exceptional hire from an average one. The picture that emerges is less about certificates and more about judgement.
Why do AI skills matter so much right now?
AI now does the repetitive detection work that used to fill a security engineer's day. Automated tools scan for weaknesses and flag suspicious behaviour in minutes. That frees engineers for harder decisions, but it also raises the bar for what they need to understand.
Attackers benefit from the same tools. Phishing emails, fake messages designed to trick staff into handing over passwords or sensitive data, are now better written and more precisely aimed than they were a year ago. Maruf Ahmed, cofounder and CEO of staffing firm Dexian, says the engineer's value now sits in interpreting what gets flagged and deciding what to do, not running the detection itself.
It's a shift our coverage of the maturing AI-SOC traced in June: autonomous triage is displacing routine analyst work, and the human roles that remain demand sharper judgement, not just faster fingers.
Praveen Margabandhu, who leads performance engineering at Navy Federal Credit Union, adds another dimension. A fraud detection system that's technically secure but too slow to catch a transaction in real time isn't actually secure. Elite engineers optimise for speed and protection together.
Is communication really a technical skill?
Multiple practitioners quoted in the reporting agree on one trait that rarely appears in job postings: explaining technical risk to executives who have no technical background. Margabandhu puts it directly. An engineer who can connect an authentication flaw to fraud exposure moves faster in a room full of executives than one who can only describe it in infrastructure terms.
Independent researcher Juan Mathews Rebello Santos argues that many security failures trace back not to missing tools but to a breakdown between technical teams and business leaders. That's consistent with what we found reporting on the skills gap on 6 July: companies keep buying certifications while the actual shortage is people who've practised under pressure and can explain what they found.
Should third-party risk change who you hire?
Third-party risk, the danger that arrives through suppliers and external software rather than systems a company directly controls, rounds out the picture. Nearly half of surveyed security leaders call it their top concern. Engineers who think only about securing what a company owns are already behind.
For ordinary employees, the practical read is this: the people your company hires to protect its systems now need to understand the business, not just the tools. If your workplace hasn't reviewed how it vets outside suppliers or updated staff training on AI-generated phishing, those are the two gaps most likely to bite first.
