Security Engineer Guide

AI-assisted development creates a security paradox: code is produced faster, which means vulnerabilities are introduced faster -- but AI-powered tooling also enables security scanning, threat detection, and remediation at a scale that manual processes never achieved. The data is stark: AI co-authored code has a 2.74x higher vulnerability rate than human-written code. As a security engineer, your job is to close that gap by embedding automated controls into the delivery pipeline while leveraging AI to strengthen your own detection and response capabilities. This guide provides the concrete controls, workflows, and standards to do that without becoming a bottleneck to engineering throughput.

What This Guide Covers

Section	What You Will Learn	Key Outcome
Secure Coding Guardrails	Mandatory checks, SAST/DAST configuration, prompt-level controls	Standardized secure coding checks for AI-generated code
Threat Modeling AI Code	Lightweight threat models, AI-specific attack surfaces, PR-level risk assessment	Threat modeling integrated into the PR workflow
Vulnerability Response SLAs	Severity classification, remediation timelines, escalation paths	Severity-based remediation workflow with clear ownership

Prerequisites

To apply this guide effectively, you should:

• Have experience in application security engineering or security operations for at least one product team
• Understand how AI code generation tools work at the prompt-to-output level (read the Developer Guide overview for context)
• Have admin or configuration access to your CI/CD pipeline's security scanning tools (SAST, DAST, SCA)
• Have authority to define and enforce security gates in the merge process
• Coordinate with your Development Manager on security review processes and with the CTO on security architecture decisions

Your Expanded Responsibilities

AI-assisted development expands the security engineer role in specific ways:

Traditional Responsibilities (Unchanged)

• Define and maintain application security standards
• Configure and tune SAST, DAST, and SCA scanning tools
• Conduct security reviews of architecture and code changes
• Manage vulnerability triage, tracking, and remediation
• Maintain incident response runbooks and coordinate security incidents

New Responsibilities (AI-Specific)

• Define additional security gates for AI-generated code in CI/CD pipelines
• Identify and catalog vulnerability patterns unique to AI-generated code (e.g., hallucinated API calls, insecure defaults, dependency confusion)
• Evaluate AI-suggested dependency choices against license and vulnerability databases
• Configure scan thresholds calibrated to the higher vulnerability rate of AI-assisted code
• Maintain secure prompt templates that prevent common security anti-patterns at generation time
• Report AI-specific vulnerability metrics to Development Manager and CTO

Key Relationships

Role	Your Interaction	Shared Concern
Developer	Define secure coding requirements, provide vulnerability pattern training, review security-sensitive PRs	Code security, dependency hygiene, secure prompt usage
Development Manager	Vulnerability metrics reporting, security gate escalation, remediation SLA tracking	Security posture dashboards, risk indicators, review processes
CTO	Security architecture decisions, tooling investment, risk acceptance decisions	Architecture integrity, threat landscape, compliance posture
Platform Engineer	Pipeline security integration, scanning tool deployment, secrets management	CI/CD security gates, infrastructure hardening, supply chain integrity
Compliance Officer	Evidence collection, audit preparation, regulatory mapping	Regulatory compliance, audit readiness, control documentation

Guiding Principles

1. Automate the gate, not the judgment. Automated scans catch known vulnerability classes at scale. Human review catches logic flaws, authorization errors, and design-level risks. Use both -- automate what is automatable, and reserve human attention for what requires context.

2. Calibrate controls to actual risk. AI-generated code has a measurably higher vulnerability rate. Adjust scan sensitivity and review requirements accordingly -- not with blanket paranoia, but with data-driven thresholds tied to severity and exposure.

3. Shift left to the prompt. The cheapest vulnerability to fix is the one never introduced. Invest in secure prompt templates and guardrails that prevent insecure patterns at generation time, before code ever enters a PR.

4. Treat dependencies as attack surface. AI tools frequently suggest outdated, abandoned, or vulnerable dependencies. Every AI-suggested dependency must pass the same SCA and license compliance checks as any manually chosen library -- enforced via PRD-STD-008.

5. Measure separately, act on the delta. Track vulnerability counts and severity distributions separately for AI-assisted and manually-written code. Use the delta to calibrate your controls and to give developers actionable feedback on where AI-generated code needs more scrutiny.

Primary Standards

• PRD-STD-004: Security Scanning -- mandatory SAST/DAST/SCA gate configuration
• PRD-STD-008: Dependency & License Compliance -- dependency vetting and license enforcement
• PRD-STD-002: Code Review -- security-focused code review requirements

Getting Started

1. Week 1: Read Secure Coding Guardrails and audit your current CI/CD pipeline for security gate coverage against PRD-STD-004
2. Week 1-2: Review Threat Modeling AI Code and define a lightweight threat model template for AI-assisted PRs targeting security-sensitive components
3. Week 2-3: Align scan thresholds and remediation timelines with Vulnerability Response SLAs; validate that severity classifications match your organization's risk tolerance
4. Week 3-4: Publish an approved secure-prompt pack in prompt-library/by-role/security-engineer/ and brief development teams on its usage and rationale

info

This guide focuses on the security engineering perspective. For the developer's approach to secure coding practices, see the Developer Guide. For quality-focused testing and defect analysis, see the QA Lead Guide. For compliance and regulatory mapping, see the Compliance Officer Guide.

Related Sections

• Role-Based Navigation Guide
• Production Standards
• Production Rollout Paths
• Transformation Track
• Reference Implementations

Next Steps

1. Start with Secure Coding Guardrails as the primary entry point for this role.
2. Review the role's key standards in Production Standards and identify your ownership boundaries.
3. If your team is implementing controls now, use Production Rollout Paths for sequencing and Reference Implementations for apply paths and downloadable repos.