Job posts for this role ask most for Python, Java, Go and C/C++ to write the code, OAuth 2.0, OpenID Connect, SAML and LDAP for logins and access, Prisma Cloud and Terraform for cloud security, and TCP/IP and firewalls for network work. The full story of what each skill is used for is on the skills page.

Among product companies, security software engineers are hired most where security is what the customer buys. Almost all of these are B2B companies.

Cybersecurity is by far the biggest hiring hotspot, because here the security is the product (who they hire). Zscaler, Palo Alto Networks, Akamai, F5 and Cloudflare build network security, firewalls and SASE, the firewalls and cloud gateways that stand between a company and the internet. Okta, One Identity, CyberArk and Quest Software build the login and access systems of identity and access management (IAM), and this is the home of identity and access work. Qualys, Rapid7 and SecPod build scanners for vulnerability management and penetration testing. JumpCloud, Sophos, Trellix and SentinelOne work in endpoint security and device management, protecting laptops, phones and servers, and they are among the most open of the security companies to a junior. Proofpoint and Barracuda build email security and anti-phishing, guarding against attacks that trick people by email, and Securonix builds tools for SIEM and security operations (SOC).

Outside the security companies, the hiring hotspots are the companies that build platforms other software depends on. Canonical, Red Hat and DigitalOcean, which are cloud providers and OS makers whose platforms other software runs on, hire security software engineers to protect them. Kaseya, Ivanti and ConnectWise secure the tools for IT service management (ITSM) and IT operations software. Cisco, Aviatrix and Infoblox build network and cloud security into enterprise networking. Rubrik, Cohesity and NetApp, which handle enterprise storage and backup, protect their customers' data against ransomware, and they take juniors more readily than most. NVIDIA and AMD, two of the processor and GPU makers, secure their chips and the software that runs on them.

A few more pockets are worth knowing, mostly application security. Mastercard, Global Payments and Visa secure the card networks and payment processing systems that move card payments. GE HealthCare and Philips secure the medical software for medical imaging and radiology AI. Online marketplaces, like eBay, Meesho and Coupang, hire for identity and fraud-facing security. Autodesk and Rockwell Automation hire a few and are open to juniors. Media, travel and most business software companies hire few security software engineers.

In big tech, Microsoft is the hiring hotspot. It hires security software engineers more heavily than any other big tech company, mostly for application security across Azure, Windows and its other products (who they hire). Google hires them for application and network security, and it is the most open of the three to a junior (who they hire). Amazon hires a few for application security.

Among the GCCs, security software engineers protect the parent's own systems, mostly through application security and identity and access.

The banks hire the most of any GCC group. Inside the banks and financial institutions, JPMorganChase, Commonwealth Bank and Synchrony build security into new platforms, and Bank of America, Wells Fargo and NatWest Group secure the bank's wider systems (who they hire). Inside the retailers and consumer-goods companies, Walmart, Tesco, H&M and Lowe's hire them heavily. Walmart hires most of the retailers' security software engineers, mostly for identity and access, and almost all of them senior (who they hire). Marriott Tech Accelerator and CBRE hire a few too. The healthcare GCCs hardly hire any. More on security across the GCCs is in the GCCs' other roles.

The services world hires few security software engineers for the size of its hiring, because its security practices hire consultants and analysts rather than engineers. Accenture has the most openings, mostly application security and identity work, and it is more open to juniors than most employers (who they hire). Mid-sized IT services firms, like Persistent Systems, Virtusa, UST and Happiest Minds, hire them for identity and access projects, setting up products such as SailPoint and Okta for clients. The IT services giants, like IBM, TCS and Infosys, and the quiet foreign majors, like CGI and DXC Technology, hire a few. The consulting firms' engineering arms hardly hire any. More on all of them is in the services world's smaller roles.

The staffing companies and hiring platforms place few security software engineers.

Security software engineers are rarely hired by media, travel and most business software companies, by the healthcare GCCs, or by the consulting firms' engineering arms. The staffing firms and hiring platforms place few as well.