Engineering

Security Engineer Role Prompt

Make AI act as a security engineer — threat modeling, secure design, risk assessment, and defensive recommendations — instead of a generic assistant.

Open in Role Prompt Generator

Overview

Ask an AI about security and you get a checklist; ask it to act as a security engineer and you get the way the role actually thinks — assume breach, rank findings by likelihood times impact, and treat unusable controls as their own vulnerability. This generates a role prompt that fixes the AI as a senior security engineer: threat modeling, secure design, and vulnerability analysis turned into prioritized, actionable fixes — and it stays defensive, recommending mitigations rather than producing exploit code. Open it in the Role Prompt Generator to adjust the seniority level, industry, and focus areas.

How to use this resource

Open the example in the tool

It loads with realistic inputs already filled in.
Swap in your own details

Adjust the inputs and options to match your case.
Generate and copy

Produce the output and paste it where you need it.

Why This Works

A role fixes the AI's reasoning framework, so findings are ranked by likelihood times impact, not by how scary they sound
Seniority changes behavior — a senior security engineer reports the realistic attack path and a specific remediation, not a generic warning
Focus areas concentrate the model where it matters: threat modeling and vulnerability analysis

Best for

Threat-modeling a feature before it ships
Getting a risk-ranked security review of a design
Turning vague security concerns into prioritized, actionable fixes

Not for

Producing exploit code or offensive tooling — this role stays defensive
General implementation work — use the Software Engineer role prompt

FAQ

Will the security engineer role prompt write exploit code or hacking tools?

It stays defensive by design: the output expectations explicitly say to recommend mitigations and detections and to not produce working exploit code, and notFor rules out offensive tooling. Run in your own assistant, it reports the threat and a specific remediation rather than a runnable exploit. You still own how you act on any finding.

What format do the security findings come back in from this role prompt?

Each finding is structured as the threat, the realistic attack path, the severity, and the specific remediation, per the output expectations. That contract is baked into the generated prompt, so results arrive as prioritized fixes rather than a flat vulnerability list. NewPrompt generates the prompt; your own assistant produces the actual findings, which you review before acting.

Why does this prompt rank security issues by likelihood times impact instead of severity?

The perspective section sets risk as likelihood times impact and tells the model to triage every finding through it before raising an alarm, so issues get ranked by real exposure, not by how scary they sound. It also weighs blast radius, what an attacker reaches once a control fails. That reasoning framework travels into your assistant when you run the generated prompt.

Can I point the security review at authentication or crypto instead of the default focus areas?

Yes. The template ships with Focus areas set to Threat Modeling and Vulnerability Analysis, and the description says to open it in the Role Prompt Generator to adjust seniority level, industry, and focus areas. Swap those focus fields to your target, then generate and copy. The tool outputs the retuned prompt; you still run it in your own assistant.

Customize This Resource

Opens these inputs in Role Prompt Generator. Generate to get the full role prompt — then adjust level, style, and focus areas.

Open in Role Prompt Generator

Prompt Template

Copy it as-is, or use Open in Role Prompt Generator to load it pre-filled and customize it with your own context.

Role: Senior Security Engineer — Technology

You are a senior security engineer with 7+ years of experience in finding and reducing risk before attackers do — threat modeling, secure design, and defensive recommendations. You work primarily in Technology contexts.

Perspective — how you see problems:
- Assume breach — design so that one compromised component does not hand over everything
- Security is risk management, not absolutism; rank by likelihood times impact, not by how scary it sounds
- The user is not the enemy — a control that is unusable gets bypassed, which is its own vulnerability

Responsibilities — what you own in this conversation:
- Threat-model the system: what is worth stealing, who would try, and where the trust boundaries are
- Review designs and code for the failure classes that actually cause breaches, not just lint-level findings
- Translate findings into prioritized, actionable fixes — severity, exploitability, and remediation

Decision criteria — weigh every recommendation against:
- Risk as likelihood times impact — triage every finding through it before raising an alarm
- Blast radius — what does an attacker reach once this control fails
- Defensibility — is the mitigation maintainable, or will it rot into a false sense of safety

Focus areas for this session: Threat Modeling, Vulnerability Analysis.
Weight your attention toward these — go deeper here than anywhere else.

Working style:
- Name the biggest risk and its mitigation in every recommendation.
- Push back when the request itself is the problem — propose the better question.
- Mention the second-order effects a less experienced person would miss.
- Consider scalability and technical-debt implications alongside the immediate ask.

Instructions:
- Stay in this role for the entire conversation.
- If a request falls outside this role's expertise, say so rather than improvising an answer.
- Ground advice in the perspective and decision criteria above — they are your reasoning framework, not decoration.

Output expectations:
- Report findings as: the threat, the realistic attack path, the severity, and the specific remediation.
- Stay defensive — recommend mitigations and detections; do not produce working exploit code.

More resources from Role Prompt Generator

Resource

Product Manager Role Prompt

A complete 'act as a product manager' role prompt — the perspective, responsibilities, and decision criteria a real PM brings, not just the job title.

Product

Resource

Startup Advisor Role Prompt

An expert startup advisor role prompt — stage-aware, capital-efficiency-minded, and built to name the riskiest assumption in any plan instead of cheering it on.

Operations

Resource

Authentication Strategy Prompt

Choose how users prove who they are — sessions vs tokens, passwords vs passwordless, SSO and MFA — decided on your real constraints, not the default tutorial.

Engineering

Resources that pair well

Resource

Bug Triage Assistant

Convert scattered bug notes, Slack messages, or user complaints into structured engineering tasks with reproduction steps, severity, and root cause hypothesis.

Engineering

Resource

Fix a Vague Prompt

'Make it good', 'be detailed', 'keep it interesting' — vague prompts get vague output. The fix is mechanical: replace every fuzzy word with a checkable instruction.

Prompt Engineering

Resource

Agent Task Template

A reusable AI agent task template with variables for objective, context, available tools, constraints, success criteria, failure handling, and output format.

AI Agents

Related tools

Tool

Role Prompt Generator

Generate expert role prompts — perspective, responsibilities, and decision criteria, not just "act as".

Prompt Builders

Projects that use this resource

Project

Build an API Backend with AI

The full path to a backend you can put clients on — define the requirements, design the architecture, API contract, data model, and access control, then build it reviewed, tested, secured, and shipped.

9 stages Software Development

Project

Build a Marketplace with AI

The full path to a two-sided platform — define the buyer-and-seller requirements, model the data, design the API, build roles and permissions, wire integrations, design the UI, then test, secure, and ship it.

10 stages Software Development

Workflows that use this resource

Workflow

AI Security Review Workflow

Review code for what an attacker would do, not just what tests catch — anchor the model as a security engineer, run a threat-focused review, then back the findings with auth and input tests.

3 steps 30–50 minutes

Guides for this resource

Guide

How to Threat Model a Feature With AI

Threat model a feature while it is still a design: name what it protects, follow the data until it crosses a trust boundary, and write abuse cases against the real flow rather than a list of security-sounding nouns.

Software Development with AI

Tip: Save time by exploring related resources and tools that integrate with this resource.