Every security engineer, regardless of experience level, eventually reaches a point where they pause and ask:
What kind of engineer am I?
Not just what tools you use. Not just what your current title says.
But how do you show up?
How do you solve problems?
How do you instinctively approach complexity?
I’ve seen this question (and its answer) surface over and over again in Slack threads during IRs, in 1:1s with mentees, in hallway conversations, in the quiet frustration of mid-career engineers trying to “level up” but not quite sure how.
And after half a decade in the field—from building threat detection pipelines at prominent startups to leading IR and threat detection at one of the largest tech companies on Earth—I’ve come to believe that most of us in security tend to move within a few core archetypes.
Not boxes. Not labels.
Gravity wells.
You may have blended skills, but there’s usually a center of mass—a force that pulls you toward a particular way of thinking, contributing, and growing. And once you can name that?
That’s when your career starts to gain direction.
Join a vibrant cybersecurity community of over 7000 people who are constantly engaging in conversations and supporting one another, covering topics from cybersecurity and college to certifications, resume assistance, and various non-professional interests like fitness, finance, anime, and other exciting subjects.
Watch the full video breakdown below:
Archetypes: A Language for How We Work
Across every security team I’ve been on, I’ve seen five archetypes show up again and again.
These are less about job titles and more about your operating posture.
How you move through problems, what you prioritize, and what kind of work gives you energy.
The Guardian
You’re the shield. The one who jumps on high-severity alerts before anyone else blinks.
You see logs like other people see spreadsheets in patterns, stories, and subtle shifts. Your radar is constantly scanning for badness.
You live in detection pipelines, SOAR playbooks, and IR processes.
You bring signal out of noise. And when things are chaotic, you’re the one who restores order.
Superpower: Translating alerts into action. Noise into signal. Chaos into clarity.
Growth Edge: Learning to zoom out. Don’t just be good at building detection rules or IR workflows. Learn to ask why this detection matters to the business in the first place.
The Architect
You’re the builder. Quietly designing the walls that stop attackers before they ever reach the door.
You speak the language of Identity and Access Management, Infrastructure-as-code, network segmentation, service mesh, secure architectural patterns, and secure-by-default everything.
You don’t want to just to fix incidents; you want to make sure they never happen again.
You design systems to be resilient by nature.
Superpower: You bring legibility to complexity. You think long-term and build for scale.
Growth Edge: Realizing that great architecture accounts for messy real-world constraints.
The Mercenary
You move fast. You ship. You patch holes and write scripts while others are still setting up their IDEs.
You care about real-world effectiveness, not perfection. You make things work, and your team leans on you when time’s running out.
You might not care about elegance, but your solutions get results.
Superpower: You create momentum when others are stuck. You execute under pressure.
Growth Edge: Learning to build for handoff. Speed without structure can turn into tech debt that no one wants to inherit.
The Researcher
You go deep. You reverse engineer malware, trace attack paths, test theories in your lab at 2 AM, not because anyone asked you to, but because you have to know.
You’re the kind of person who asks “why” five times in a row, not to be difficult, but to get to the truth.
You don’t just spot indicators. You uncover root causes. And then you sometimes document it beautifully.
Superpower: Depth. Insight. Rigor. You go where others won’t, and you bring back answers.
Growth Edge: Learning to package your insights for the broader team. If it stays in your notebook, it doesn’t scale. You don’t scale either.
The Diplomat
You’re the bridge. You know how to speak engineering, product, compliance, and executive. You translate technical risk into something others can act on.
You don’t just point out flaws, you create alignment.
Your tools aren’t just SIEMs or bash/python scripts. They’re conversations, whiteboards, and narratives. You help people care about security before it’s a crisis.
Superpower: Influence without authority. You drive change by aligning people, not just fixing systems.
Growth Edge: Staying close to the tech when you spend more time in meetings. You can’t lead security conversations if you’re out of touch with the work itself.
But What If You’re New?
Maybe you’re early in your journey. Perhaps you’re pivoting into security from another field.
You might be thinking: How am I supposed to know my archetype if I’m still trying to figure out what a “SIEM” even is?
Fair.
But here’s the thing—your archetype isn’t based on what tools you’ve mastered. It’s based on your instincts.
Here’s how you start to uncover it:
Look at your energy, not just your skillset.
What kinds of problems do you enjoy solving—even when you’re off the clock? When do you lose track of time?
Pay attention to your curiosity trail.
What do you fall down rabbit holes about? Is it misconfigured identities? Detection logic? Threat intel? Architecture? That’s your fingerprint.
Notice your default team role.
In group settings (even outside of security), do you tend to gravitate toward fixing things? Explaining things? Organizing? Building? Those patterns show up early.
Experiment through exposure.
You don’t have to pick an archetype right now. Try a little of everything. Build a detection. Automate a workflow. Dig into a threat emulation lab. Your gut will tell you what sticks.
Trust your gut.
The Framework Behind It All
These archetypes aren’t just cute metaphors. They map directly to how we grow and operate in teams.
I-shaped engineers go deep in one area. Think of a Guardian who’s a detection ninja but doesn’t engage outside their lane.
T-shaped engineers have depth in one skill, but range across others. Think of an Architect who also understands compliance, detection, and incident response.
π-shaped engineers (pi-shaped) have two deep specialties—often one technical and one interpersonal, such as a Diplomat who also oversees incident response functions and conducts threat modeling sessions with developers.
Most of us start I-shaped. And that’s okay.
You need real depth before you can scale your impact.
But over time, that horizontal bar becomes crucial. It’s what allows you to collaborate, influence, and adapt across domains.
Security is a team sport, and threats are multi-layered.
Our skillsets should be too.
Becoming the Polymorph
There’s one more archetype that doesn’t exist on a slide deck or job description. It’s not something you start with—it’s something you grow into.
I call it: The Polymorph.
Polymorphs don’t just dabble across domains; they move fluidly between them. One day, they’re tuning detections.
Next, they’re designing a new cloud security model.
Then they’re mentoring a junior engineer, building a SOAR workflow, or briefing execs.
They do it not to impress, but because they’ve built range on top of real depth.
In career frameworks, this is the π-shaped engineer fully realized.
In practice? These are your Staff+ & Principal engineers.
The people you call when there’s a fire, or when you’re planning something ambitious. They don’t just get work done. They make the whole team better.
But here’s the truth:
No one starts as a Polymorph.
You grow into it, step by step.
So, How Do You Get There?
You begin where you are.
Begin by identifying the archetype that feels most natural to you. Build deep credibility and a real, authentic experience in that domain.
Then stretch.
Study how that area connects to others. Take on projects that intimidate you. Volunteer for work that’s outside your lane. Learn to explain what you know in ways others can use. Pair up with people who think differently. Build things. Break things. Share everything.
And eventually, you’ll wake up one day and realize:
You’re not just a Guardian anymore.
Or just a Researcher.
You’re not easily labeled.
You’ve become the kind of engineer that teams build around.
Want to Grow Into a Specific Archetype?
Here’s a quick nudge for each path:
Guardian → Understand detection-as-code. Triage real alerts. Learn log pipelines. Tune until a signal emerges.
Architect → Master IAM. Learn Terraform. Understand zero trust. Build preventative security by default.
Mercenary → Script small win projects. Learn security automation. Triage fast. Automate quicker. Ship working code.
Researcher → Build a purple team lab. Read threat reports. Emulate real TTPs. Write deep dives—even if no one asks.
Diplomat → Sharpen your storytelling. Join cross-functional efforts. Translate risk. Lead with empathy.
Final Thoughts
If you’re still here, let’s pause and make this personal:
What archetype feels like home right now?
Which one challenges you, but pulls at your curiosity?
Where are you still I-shaped?
What would it take to become more T-shaped—or grow toward π?
Are you moving toward becoming a Polymorph?
And if so, what’s one small step you’ll take this month?
Because at the end of the day, growth in security is about knowing yourself, building with purpose, and becoming the kind of engineer your future self would want on their team.