San Francisco and the Bay Area remain the global epicentre of tech compensation, AI, and venture-backed startups. Total comp at growth-stage companies routinely exceeds $300k.
What San Francisco teams look for in a security engineer
4 core · 4 nice to have
Core stack
AppSecCloud securityThreat modellingOWASP
Nice to have
IAMSIEMPenetration testingZero Trust
What a security engineer owns on day one
Embed security into the SDLC and CI/CD
Lead threat modelling and architecture reviews
Own vulnerability management and incident response
Coach engineering teams on secure-by-default patterns
Hire in San Francisco in three weeks
The same playbook our customers run for every hire.
Day 0
Book a chat
A short call and we set up the role with you.
Day 1
Applicants within hours
We advertise the role and our AI sources people who fit.
Day 2–10
Interview rounds
We handle scheduling across timezones.
Day 14–21
Offer & onboard
Local notice periods averaged in. Hire ships in 21 days.
Hiring security engineers in San Francisco
How much do security engineers earn in San Francisco?
Pay for security engineers in San Francisco varies with sector and seniority. San Francisco and the Bay Area remain the global epicentre of tech compensation, AI, and venture-backed startups. Total comp at growth-stage companies routinely exceeds $300k.
Which companies in San Francisco hire security engineers?
Notable San Francisco tech employers include OpenAI, Stripe, Airbnb, Anthropic and Databricks, alongside many smaller scale-ups.
Is hybrid or remote work common for security engineers in San Francisco?
Hybrid (2–3 days in office) is the most common pattern in San Francisco, though fully remote roles remain widely available. We surface working-pattern preferences on every Haystack profile.
What total comp should I budget for US engineers?
Base salary plus 15–25% bonus and 0.05–0.5% equity is standard at growth-stage companies. FAANG and well-funded startups in SF/NYC push total comp 30–50% above base.
Do I need a US entity to hire?
Most companies use an EOR (Employer of Record) for the first few hires, then incorporate once headcount justifies it. Haystack can introduce vetted EOR partners.
The security engineer hiring playbook
Security Engineer specialist or generalist - which should you hire?
The honest answer depends on the half-life of your security engineer surface area. If you expect to keep investing in AppSec and Cloud security work over the next 18-24 months, a specialist security engineer will out-deliver a generalist on day-30 throughput and stakeholder confidence.
If your team is under ten people, or security engineer responsibilities are spread across two or three roles already, hire a strong generalist who has shipped this work in anger at least twice. The cross-disciplinary pattern recognition will pay for itself the first time priorities collide.
On Haystack we surface both - filtered by whether the candidate self-identifies as a security engineer specialist and verified against their last two roles. We benchmark live salary data on every offer.
What strong security engineers actually bring
A great security engineer is not the one with the longest CV - it is the one who has owned a hard AppSec call and changed how they work because of how it landed. Across the engineering hires we have placed in 2025-2026, the same patterns keep showing up.
An opinion on what NOT to do with AppSec, backed by an example where adding it would have hurt the team.
Security Engineers who pair Cloud security depth with cross-functional fluency - they bring product, design and data into their decisions, not just engineering.
A written 30/60/90 plan in week one, anchored to AppSec delivery milestones rather than ramp-up vanity metrics.
Versioned, observable security engineer work - measurable outputs, structured logs of decisions, and a clear rollback path on every change.
Red flags when interviewing security engineers
Every discipline has its own pattern of plausible-sounding answers that fall apart in production. For security engineers, these are the patterns that most often correlate with a six-month regret hire on the employer side.
Defines "senior security engineer" purely by years of experience, not by the scope of decisions they own.
Lists Cloud security on the CV but cannot describe a single trade-off they hit in production - all framework, no friction.
Treats the security engineer role as a job title rather than a problem to solve - no opinion on what they would change about how the discipline is typically practised.
Only ever worked on greenfield security engineer projects - inheriting a messy, half-built system is a different muscle.
A sample take-home for security engineer candidates
When teams ask us how to evaluate a security engineer beyond a CV and a chat, we recommend a 90-minute paid take-home that mirrors real work, not a trivia quiz. The brief below is one we have refined with employers hiring across engineering teams.
Give the candidate a small, intentionally imperfect artefact tied to "embed security into the sdlc and ci/cd". Their task is to add a second capability - tied to "lead threat modelling and architecture reviews" - while keeping existing behaviour intact. Then grade in three parts.
Correctness: the new work satisfies the brief and at least one edge case the candidate flags themselves.
Judgement: did they refactor, wrap or work around the existing imperfection? Any of the three is fine - we are listening for the reasoning, not the verdict.
Communication: a short written note explaining what they would do differently with another week, what they noticed about AppSec, Cloud security and Threat modelling, plus working exposure to OWASP, IAM and SIEM, and the assumptions they made along the way.
What to expect in the first 30 days from a Haystack security engineer hire
By week one, the new security engineer should have shipped a small, low-risk artefact to production or a stakeholder - a docs fix, a small process change, a first review on someone else's work. The goal is to validate the loop, not to ship anything heroic.
By week two, the security engineer is shadowing the active workstreams, attending standups in observe-mode, and asking pointed questions about why specific decisions were made. If they are not asking those questions, the hire is going to plateau.
By day 30, they own one cleanly-scoped slice of the security engineer surface area, have published a public ramp-up doc, and are the named point of contact for stakeholders inside that slice. Every Haystack employer gets a structured onboarding template, so you are not reinventing the playbook each hire.
Hire security engineers elsewhere in US
Same vetted pipeline, localised salary and market context.
