Books › Security Engineer roadmap
Best books for Security Engineers
Application and product security from the design table to production. The first set builds security thinking in design and code review (threat modelling, secure design, how web applications are attacked). The build set covers running systems securely, cryptography you must be able to judge, cloud security and detection engineering. The lead set zooms out to why systems fail and how to test resilience. Pen-testing depth lives on a different roadmap.
12 books in 3 stages, about 4,590 pages (at least 115 hours of reading). The notes are ours, with no ratings or sales claims.
How to choose your books
A short method, so you read the right book for where you are instead of the longest list.
Find your stage
Getting started · 4 books
Security thinking at design and code level: threat models, secure patterns and how an attacker reads an application.
Jump to this stage ↓Doing the job · 6 books
Owning security in production: reliable system design, cryptography, cloud accounts and detection rules that can be tested and tuned.
Jump to this stage ↓Senior and leading · 2 books
Systems-level reasoning: why dependable systems fail, and how to test controls through experiments rather than assumptions.
Jump to this stage ↓
If you are unsure, start one stage lower than you think. Books in a later stage assume the working knowledge the earlier ones give you.
Begin with one book
Our starting pick
Alice and Bob Learn Application Security
by Tanya Janca · 2020
A plain-language tour of securing software across design, code, test and deploy. It maps the territory before the denser books in this list.
See the book ↓Then pick by your situation
Choose the next book by the problem in front of you, not by its place in the list.
If you are about to run your first design review
read Threat Modeling (getting started)
If you review code and keep patching the same bug class
read Secure by Design (doing the job)
If you are asked to judge or choose cryptographic building blocks
read Real-World Cryptography (doing the job)
Check it against what Security Engineer postings ask for
These skills come from our analysis of live Security Engineer job postings. If one is new to you, its book list sits one click away.
- AWS Occasional
- Python Occasional
- Kubernetes Occasional
- GCP Occasional
- Go Occasional
- Azure Rare
- Terraform Rare
Each step on the scale reflects how often live job postings name the skill, tool or credential, based on our analysis of those postings.
Set a time budget
| Stage | Books | Pages | Reading | At 3 hrs a week |
|---|---|---|---|---|
| Getting started | 4 | 2,110 | 53 hrs | 18 wks |
| Doing the job | 6 | ≥ 1,480 | ≥ 37 hrs | ≥ 12 wks |
| Senior and leading | 2 | ≥ 1,000 | ≥ 25 hrs | ≥ 8 wks |
| All 3 stages | 12 | ≥ 4,590 | ≥ 115 hrs | ≥ 38 wks |
Treat this as a ceiling, not a target. Read one book at a time, apply it, then move on; read reference-style books in sections. Totals are approximate.
Judge any book before you buy it
Age
This list runs from 2001 (Security Engineering) to 2023 (Practical Threat Detection Engineering). Older books earn their place by teaching principles that do not change. For tools and platforms, buy the latest edition.
Level
Check the stage before the title. A book from a later stage will make sense only once you have faced the problems it solves.
Format
The longest book here, Security Engineering, runs about 1000 pages. Read very long books as references: pick the chapter that matches the problem you have.
Fit
Ask what you will do differently the week after you finish. If you cannot answer, the book is for a different moment. Come back to it when the situation arrives.
Getting started
Security thinking at design and code level: threat models, secure patterns and how an attacker reads an application.
Start hereAlice and Bob Learn Application Security
by Tanya Janca · 2020
~300 pages~8 hrs to read
A plain-language tour of securing software across design, coding, testing and deployment. A good first book for engineers moving into application security from development.
View book →
Designing Secure Software: A Guide for Developers
by Loren Kohnfelder · 2021
~310 pages~8 hrs to read
Teaches security thinking at the design stage, with mitigations and secure design patterns. Read it early to build the habit of reviewing architecture, not just finished code.
View book →
Threat Modeling: Designing for Security
by Adam Shostack · 2014
~590 pages~15 hrs to read
The standard practitioner text on finding threats before they ship, covering STRIDE, attack trees and diagramming. Use it to run your first design reviews and threat modeling sessions.
View book →
The Web Application Hacker's Handbook
by Dafydd Stuttard, Marcus Pinto · 2007
~910 pages~23 hrs to read
A detailed walkthrough of how web applications are attacked, from injection to authentication flaws. Useful for learning to read code and APIs the way an attacker would.
View book →
Doing the job
Owning security in production: reliable system design, cryptography, cloud accounts and detection rules that can be tested and tuned.
Building Secure and Reliable Systems
by Heather Adkins, Betsy Beyer, Paul Blankinship, Piotr Lewandowski, Ana Oprea, Adam Stubblefield · 2020
~560 pages~14 hrs to read
Google's engineers on designing, implementing and operating systems that stay secure and reliable, including least privilege, review, recovery and incident response. For engineers owning production systems.
View book →
Secure by Design
by Dan Bergh Johnsson, Daniel Deogun, Daniel Sawano · 2019
~410 pages~10 hrs to read
Shows how domain-driven design choices make whole classes of vulnerabilities harder to write. Useful when you review code and want to push fixes into the design, not patch each bug.
View book →
Real-World Cryptography
by David Wong · 2021
Explains the cryptographic building blocks that real systems use, such as TLS, key exchange, signatures and authentication. Read it to choose and apply primitives correctly instead of rolling your own.
View book →
Serious Cryptography: A Practical Introduction to Modern Encryption
by Jean-Philippe Aumasson · 2017
~310 pages~8 hrs to read
Covers how modern ciphers, hashes and key exchange work and where implementations fail. A deeper companion for engineers who need to judge cryptographic designs during reviews.
View book →
Practical Cloud Security: A Guide for Secure Design and Deployment
by Chris Dotson · 2019
~200 pages~5 hrs to read
Covers identity, data protection, network design and monitoring in cloud environments. Read it when you take ownership of cloud account architecture and need a vendor-neutral framework.
View book →Practical Threat Detection Engineering
by Megan Roddie, Jason Deyalsingh, Gary J. Katz · 2023
Covers building, validating and maintaining detection rules and the pipeline around them. For engineers who write detections and need them to be testable and tuned.
View book →
Senior and leading
Systems-level reasoning: why dependable systems fail, and how to test controls through experiments rather than assumptions.
Security Engineering: A Guide to Building Dependable Distributed Systems
by Ross Anderson · 2001
~1000 pages~25 hrs to read
A broad reference on why systems fail, spanning protocols, access control, usability and economics. Senior engineers can use it to reason about trade-offs and organizational risk.
View book →
Security Chaos Engineering: Sustaining Resilience in Software and Systems
by Kelly Shortridge, Aaron Rinehart · 2023
Argues for resilience through experimentation and treats failure as expected. Useful for security leads shaping how teams test controls and respond to incidents.
View book →
Book links go to Amazon and are affiliate links. As an Amazon Associate I earn from qualifying purchases.
Frequently asked questions
Which book should a Security Engineer read first?
Alice and Bob Learn Application Security by Tanya Janca. A plain-language tour of securing software across design, code, test and deploy. It maps the territory before the denser books in this list.
Do I need to read all 12 books?
No. The list is a menu, not a syllabus. Find your stage (getting started: 4, doing the job: 6, senior and leading: 2), begin with one book (we suggest Alice and Bob Learn Application Security), then pick the next book by the problem you are facing at work. Come back to the others when the situation they cover arrives.
How long does it take to read these books?
The 9 books with a known page count add up to about 4,590 pages, roughly 115 hours at 1.5 minutes a page. At three hours a week that is about 38 weeks; at six hours a week, about 19. The list is meant to be read over time, one book at a time, not in one run.
Are these books up to date?
They range from 2001 (Security Engineering) to 2023 (Practical Threat Detection Engineering). Older titles are included because they teach principles that have not changed; for tools and platforms, we favour recent editions. Check the edition before you buy.
Related reading
Some links are affiliate links: we earn a small commission if you buy, at no cost to you. It does not change what we list.