10/08/2025
I bet you didn't know..... 95% of people assume the highest-paid security engineers devote most of their time to writing detection rules, patching vulnerabilities, or fixing CVEs. However, observing the best in the field reveals a different reality. Top security engineers primarily focus on the following activities: thoroughly reviewing architecture documentation, cloud configurations, and infrastructure pull requests; posing seemingly trivial questions to identify overlooked risks; collaborating with DevOps, product, and compliance teams to understand the underlying mechanics; and contemplating potential scenarios that could go wrong before formalizing threat models. Having spent several years in security and DevOps, I have consistently witnessed this pattern. There are instances where an entire afternoon is dedicated to whiteboarding potential attack vectors, such as misconfigured Kubernetes roles or seemingly innocuous changes with far-reaching consequences. The next day, during standup, the conversation might go: 'I didn't develop new detection logic yesterday; instead, I traced potential lateral movement pathways in the event of unenforced IAM boundaries.' The most effective security engineers prioritize activities that enhance the company's safety. While this may occasionally involve patching or automation, it more frequently entails connecting the dots, anticipating potential vulnerabilities, and posing uncomfortable questions before a breach occurs. Although this approach may not appear productive from an outside perspective, it is instrumental in preventing incidents, headlines, and sleepless nights. This distinction is what sets exceptional security engineers apart. Rather than reacting to threats, they proactively anticipate them.