Security Engineer Career Guide 2026: AI, Salaries & Hiring

Overview

If you're a security engineer job hunting in 2026, the numbers you'll run into look contradictory. ISC2 estimated that organizations needed 4.8 million additional cybersecurity professionals globally in 2024, up 19% year over year (ISC2 Cybersecurity Workforce Study, 2024). That estimate describes an unmet workforce need, not 4.8 million advertised vacancies. In 2025, 41% of cybersecurity teams named AI/ML their most pressing skill need, ahead of cloud security at 36% (ISC2 2025 Cybersecurity Workforce Study, 2025).

That workforce need does not automatically make hiring easy. ISC2 also reported budget cuts, layoffs, and hiring freezes, while employers continued to prioritize candidates with specific skills over general credentials. The result is a market with genuine staffing pressure and selective hiring at the same time.

That's the real story of security engineering in 2026, and it isn't "AI will take your job." It's a structural argument, the same one that reshaped software engineering when AI coding agents went mainstream.

AI is generating attack surface faster than most organizations can secure it. At the same time, it's automating away the rote parts of the job that used to justify a headcount line. A model can now do a passable version of log triage, first-pass alert scoring, and boilerplate compliance checklists. Reasoning about a prompt-injection vector in a customer-facing chatbot, or the privilege boundary an autonomous agent shouldn't be allowed to cross, is a different kind of work entirely.

Operating a security information and event management (SIEM) platform still matters, but it is no longer sufficient on its own for many engineering roles. Candidates can differentiate themselves by reasoning about newer AI-introduced risks: model supply-chain integrity, agentic tool misuse, and prompt injection as a first-class vulnerability class rather than a curiosity.

This guide walks through what a security engineer actually does in 2026, which turns out to be less unified than the title suggests. It covers how AI has changed daily work, the skills and certifications employers screen for, salary data, and companies that hire security engineers. It also covers the AI-security scenarios that some employers now include in interviews. Finally, it explains where a tool like jobstrack.io fits into competing for high-visibility roles despite the broader workforce need.

Key Takeaways

• ISC2 estimated that organizations needed 4.8 million additional cybersecurity professionals globally in 2024, up 19% year over year. This is an estimate of unmet workforce need, not a count of current job openings (ISC2 Cybersecurity Workforce Study, 2024)
• 41% of cybersecurity teams named AI/ML their most pressing skill need in 2025, followed by cloud security at 36%. These categories maintained their positions as the top two needs from 2024 (ISC2 2025 Cybersecurity Workforce Study, 2025)
• In Veracode's controlled test, 45% of AI code-generation tasks introduced a known security flaw when the models received no security-specific guidance. The study used 80 tasks across four languages and four vulnerability types (Veracode Spring 2026 GenAI Code Security Update, 2026)
• Security engineers earn a Glassdoor median base of $172,800, with senior security engineers at Google and Meta reaching approximately $484K-$574K in total compensation (Glassdoor, 2026; Google and Meta compensation data, 2026)
• Organizations with a severe security skills shortage absorb $1.76M more in average breach costs than well-staffed peers, the clearest evidence that understaffing, not automation, is the real cybersecurity risk in 2026 (IBM Cost of a Data Breach Report, 2025)

What Does a Security Engineer Actually Do in 2026?

"Security engineer" is now an umbrella covering at least five distinct specializations that used to be far more interchangeable. Application Security (AppSec) owns SAST/DAST tooling and secure code review, now increasingly extended to reviewing AI-generated code specifically. Cloud Security owns IAM, network segmentation, and posture management across AWS, GCP, and Azure.

Detection & Response, sometimes called detection engineering, owns the SIEM, threat hunting, and incident response. Identity & Access / Zero Trust engineering owns the architecture that assumes no request is trusted by default. And AI/ML Security (model security, LLM red teaming, AI governance) is a genuinely new lane that didn't exist as a hiring category at all two years ago.

Candidates routinely confuse the security engineer title with three adjacent roles that run different interview tracks entirely. SOC Analyst is more junior and more triage-focused, with less engineering ownership. Penetration Tester or Offensive Security is assessment-focused, anchored to OSCP, and evaluated on a different rubric than an engineering role. GRC/Compliance is policy- and audit-focused, anchored to CISSP or CISA, with comparatively little hands-on technical work. Most postings titled "Security Engineer" in 2026 blend AppSec, cloud security, and some detection engineering. Increasingly, they also include a line reading "experience securing AI/LLM-powered features," which simply wasn't in job descriptions two years ago.

How Is AI Changing the Role's Day-to-Day Work?

Security engineers are now expected to audit AI-generated code for vulnerabilities and govern how their own company's developers use AI coding tools. They're also defending large language model (LLM) features and autonomous agents with tool access. An InterviewStack analysis of 5,379 active Cybersecurity Engineer postings found that 16.3% explicitly requested newer generative-AI skills in June 2026 (InterviewStack.io, 2026). That shows up in three concrete ways.

Auditing AI-Generated Code Is Now a Standing Responsibility

This isn't a special project anymore; it's a line item. In Veracode's Spring 2026 update, only 55% of tested code-generation tasks produced secure code when the models received no security-specific guidance. The remaining 45% introduced a known security flaw (Veracode Spring 2026 GenAI Code Security Update, 2026).

Veracode used 80 coding tasks across Java, JavaScript, C#, and Python, covering SQL injection, cross-site scripting, log injection, and insecure cryptography. That controlled setup does not mean 45% of all production AI-generated code is vulnerable. It does show why teams should run AI-assisted commits through static and dynamic application security testing and human review rather than treating generated code as secure by default.

Shadow AI and AI Governance Is Now Part of the Job

Security engineers increasingly own the policy and tooling question of which AI tools employees can use, with which data. Organizations with high levels of shadow AI usage face $670K in additional average breach costs versus low or no shadow AI usage.

Organizations without AI or automation in their security operations paid $5.52M in average breach cost. Those using AI/automation extensively paid $3.62M instead, a $1.9M gap (IBM Cost of a Data Breach Report, 2025). That gap is reframing "should we adopt AI defensive tooling" from an optional initiative into a board-level line item.

A Genuinely New Attack Surface: Prompt Injection and Agentic Tool Misuse

Prompt injection ranks as the most frequently cited risk across the Open Worldwide Application Security Project's (OWASP) agentic-AI vulnerability categories (OWASP GenAI Security Project, 2026). New vocabulary has entered job descriptions and interview preparation as a result: the OWASP Top 10 for LLM Applications, MITRE ATLAS, the NIST AI Risk Management Framework, and agentic tool-use privilege boundaries.

AI/ML skills are showing up in cybersecurity engineer postings often enough to change what a competitive resume looks like. In InterviewStack's June 2026 snapshot of 5,379 active postings, AI Agents was the leading newer AI term:

Source: [InterviewStack.io](https://interviewstack.io/blog/how-ai-is-changing-cybersecurity-engineer-2026), analysis of 5,379 active Cybersecurity Engineer postings in June 2026. This is a single-job-board snapshot, not a census of the entire market. The broader growth in AI mentions across job postings is also documented by [Indeed Hiring Lab](https://www.hiringlab.org/2026/01/22/january-labor-market-update-jobs-mentioning-ai-are-growing-amid-broader-hiring-weakness/), 2026.

What we're seeing in job postings: Put the 4.8 million workforce gap next to the 41% AI-skill-gap finding and a sharper read emerges than either stat gives you alone. The shortage isn't evenly distributed across "security engineer" as a title. It's concentrated in the sliver of that title that can reason about AI-introduced risk. A market can be simultaneously desperate for headcount and brutally selective about who fills it. 2026 security hiring is the clearest example of that dynamic we've seen in this cluster.

This is also spinning off new job titles: AI Red Teamer, ML Security Engineer, AI Trust & Safety Analyst, LLM Security Architect. Most traditional security engineers don't need to retitle themselves into one of these roles. They do need working fluency in the underlying concepts to clear a 2026 screen. Interviewers are now asking about them by name, not treating them as a specialist's problem.

What Skills Do Companies Screen For in 2026?

Postings in 2026 filter on a stable core plus one fast-rising addition. Cloud security and IAM remain the highest-frequency non-negotiable, followed by AppSec tooling, Python scripting, detection engineering and SIEM depth, and Zero Trust architecture. AI/LLM security fundamentals now sit on top of that stack as the fastest-growing, most differentiating category.

Cloud Security (Non-Negotiable)

AWS, GCP, and Azure IAM, network segmentation, and cloud security posture management remain the single most consistently required skill set across security engineer postings. This hasn't changed much year over year; it's simply the baseline every other skill gets layered onto.

Application Security

SAST/DAST tooling and secure code review, now expanded to include AI-code review workflows specifically. Where this skill used to mean "run the scanner and triage findings," it increasingly means "build the pipeline that assumes AI-assisted commits carry a higher defect rate and catches it before merge."

Python and Scripting

Automation and tooling proficiency in Python holds the same non-negotiable status in security engineering that it does in the DevOps/SRE career guide. You can't build detection tooling, response automation, or a security data pipeline without it.

Detection Engineering and SIEM

Splunk, Elastic, or a cloud-native equivalent, plus the judgment to build detections that catch real threats without drowning the team in false positives. This is where the "operate the tool correctly" version of the job still lives. It's also where AI-assisted anomaly detection is compressing headcount needs fastest.

Zero Trust and IAM Depth

Identity-centric architecture that assumes no request is trusted by default. This sits between table stakes and premium depending on seniority: expected knowledge at mid-level, expected mastery at senior and staff levels.

AI/LLM Security Fundamentals (Fastest-Rising)

Prompt injection defense, OWASP LLM Top 10 familiarity, and working knowledge of AI governance frameworks. This is the category that didn't exist as a distinct hiring filter two years ago and is now the one recruiters mention unprompted.

The distinction that matters for positioning: cloud security, Python, and AppSec basics are filter-you-out skills; missing them keeps you out of the pipeline entirely. AI/LLM security and threat modeling for agentic systems are pay-you-a-premium skills; having them moves you to the top of an otherwise crowded stack. Kubernetes and Terraform depth do the same thing for DevOps/SRE candidates.

What Do Security Engineers Earn in 2026?

Glassdoor reports a US median base salary of $172,800 for Security Engineers, with the 25th-75th percentile running from $140,357 to $215,454 (Glassdoor Security Engineer Salaries, 2026).

Large technology companies look materially different, the same bifurcation the DevOps/SRE guide documents for reliability roles. Google security engineers range from $188K in total compensation at L3 to $484K at L6, with a $250K median (Levels.fyi Google Security Engineer, 2026). Meta security software engineer compensation reaches approximately $574K at E6 (Levels.fyi Meta Security Software Engineer, August 2026).

Broad US Market Estimates

Large-Company Total Compensation

AI Security Engineer pay is still based on a small reported sample and varies sharply by employer. Glassdoor reports a $190K median total-pay estimate and a $152K-$239K range as of August 2026 (Glassdoor AI Security Engineer Salaries). Treat that as a directional benchmark rather than a universal premium.

The underlying compensation logic mirrors the one that explains SRE pay. Breach cost and blast radius scale with company size and data sensitivity, so pay scales with them too. A fintech or healthcare security engineer manages materially higher-stakes risk than an equivalent-title role at a low-data-sensitivity SaaS company. The market prices that difference directly into the offer.

Which Certifications Actually Matter for Security Engineers in 2026?

Certification value in security is fragmented and role-specific. In security, the right certification depends entirely on which of the five specializations covered earlier you're targeting. There's no single credential that clears every screen.

Worth the Investment

The OffSec Certified Professional (OSCP) is aligned with offensive and penetration-testing roles, though it is rarely sufficient without demonstrated assessment experience. The AWS Certified Security - Specialty or Certified Cloud Security Professional (CCSP) can support a cloud-security-focused profile. The Certified Information Systems Security Professional (CISSP) is aimed at experienced practitioners targeting senior, architecture, or leadership roles. Full certification requires five cumulative years of experience across at least two domains, although an approved degree or credential can waive one year. Candidates who pass before meeting the experience requirement may become an Associate of ISC2 while they complete it (ISC2 CISSP Experience Requirements).

Security+ or CySA+ can provide useful entry-level signals when paired with labs, internships, or other evidence of hands-on work. Their value depends on the role and employer rather than on the number of credentials listed on a resume.

Emerging and Increasingly Relevant

Certifications and structured training tied to the OWASP LLM Top 10 and MITRE ATLAS for AI/LLM security are still young as a credentialing market. Hands-on demonstrated work (a documented LLM red-teaming writeup, a CTF with an AI-security category) currently carries more weight than any single AI-security certification brand. That's because the brands themselves haven't had time to establish a track record yet.

Not Worth the Investment

Broad vendor-neutral entry certifications like CompTIA A+ or Network+ add little once you're targeting engineer-level roles rather than IT support. Stacking multiple overlapping certifications instead of pairing one role-matched credential with demonstrated hands-on work is a common and avoidable mistake. Hiring managers notice a resume with five certs and no portfolio faster than you'd expect.

A practical sequence is to pick a specialization, earn one credential that matches it, and build demonstrable experience. Pursue the full CISSP once you meet its experience requirement or use the Associate of ISC2 route if you pass the exam earlier. For security engineers eyeing a leadership track, the engineering manager career path is worth reading before making that move.

Which Companies Are Hiring for This Role Right Now?

Demand is broad, but the profile of what's screened for differs sharply by company. The EU AI Act's transparency obligations began applying in August 2026. Requirements for high-risk systems in specified sensitive areas apply from December 2027, while requirements for high-risk systems embedded in regulated products apply from August 2028 (European Commission AI Act Timeline, 2026). These staged requirements give employers a longer planning horizon for AI governance and security work than an August 2026 high-risk deadline would imply.

Companies like OpenAI and Anthropic sit at the intersection this guide keeps returning to. The technical overlap between adversarial ML and model security is direct enough that candidates coming from the ML/AI engineer career guide are increasingly competitive for these roles. That's true even without a traditional security background, provided they can demonstrate the threat-modeling half of the job convincingly.

How Does the Interview Process Work for This Role in 2026?

Interview structures vary by employer. Most loops still assess technical fundamentals, threat modeling or system design, and incident response or behavioral judgment. Some AI-forward employers now add a dedicated AI/LLM security scenario or fold one into the system-design stage.

Technical Screening or Assessment

A common screening prompt is: "Walk me through triaging a suspected credential-stuffing attack." A strong answer moves from the detection signal, such as a spike in failed logins from distributed IPs, through containment and root-cause analysis without skipping steps to reach the fix.

Threat Modeling or Security System Design

This is the security equivalent of a systems-design-for-reliability round: design a secure architecture for X, or threat-model a given system. Strong answers reason from the top three ways the system could be attacked before describing the nominal architecture. That's the same "design failure modes first" discipline that separates strong candidates in reliability interviews too.

AI/LLM Security Scenario at Some Employers

A dedicated AI-security round is not universal. At employers building LLM-powered products, these questions may appear as a separate stage or inside threat modeling. A representative prompt is: "Walk me through how you'd test a customer-facing RAG chatbot for prompt injection risks. What attacks do you prioritize and why?" Another is: "A developer wants to ship an autonomous agent with tool access to internal databases. What are your security objections, and what controls would you require?" Prepare to use frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework when structuring an answer.

Incident Response and Behavioral Judgment

"Walk me through your last significant incident." "How do you decide what gets escalated?" Postmortem-writing questions. Same structure and intent as an on-call philosophy round in a reliability interview, adapted to breach response rather than availability incidents. Have a specific incident story ready: the symptoms, the investigation, the resolution, and what you changed afterward.

Prepare for AI-security scenarios by working through the OWASP Top 10 for LLM Applications and MITRE ATLAS directly rather than assuming application-security fundamentals transfer automatically. They partially do. The gap is usually in reasoning about tool-use privilege boundaries, which many traditional application-security roles have not covered.

How Do You Stand Out From Other Candidates in the Field?

Quantify Your Impact in Resume Bullets

Every resume bullet should state what you secured, what the actual risk or exposure was, and the measurable reduction. That's the same impact-quantification discipline that separates strong DevOps/SRE resumes from generic ones. Weak: "Performed security code reviews." Strong: "Built an automated SAST gate for AI-assisted commits that caught 3 injection-class vulnerabilities before merge, reducing critical AppSec findings in production by 40% over two quarters."

A few more worked examples of the same pattern: "Implemented a Zero Trust IAM rollout across 12 internal services, reducing standing privileged-access grants by 65% and eliminating a class of lateral-movement risk flagged in the prior year's pen test." "Ran a prompt-injection red-team exercise against our customer-facing chatbot, identified 4 exploitable paths, and shipped input-sanitization controls that closed all 4 before the feature reached general availability."

From our own resume reviews: The resumes that get callbacks in security hiring almost never lead with tool names. They lead with a before-state, an intervention, and a measured after-state, the same three-part structure a postmortem uses. If your bullet reads like a job description rather than a postmortem, a hiring manager will skim past it in the same five seconds they'd skim past anyone else's.

Build a Public Security Portfolio

Beyond quantified impact, build a public security portfolio: a documented CTF writeup, a small open-source security tool, a published and responsibly disclosed vulnerability, or an LLM red-teaming writeup demonstrating OWASP LLM Top 10 fluency. This functions the same way a public infrastructure project does for SRE candidates. It's proof of work an interviewer can inspect directly, rather than a claim they have to take on faith.

Bug bounty participation works even better as a credential than most candidates realize. Even modest, documented bounty payouts are third-party-verified proof of offensive capability that no resume claim can replicate. Someone else's triage process already validated the finding before you ever put it on a resume.

For candidates coming from a software engineering background or from the DevOps/SRE career guide, the move into security is a domain expansion, not a skills reset. That includes those navigating the AI coding agent disruption reshaping software engineering. Distributed systems knowledge, debugging instincts, and infrastructure fluency all transfer directly. The new surface area is adversarial: learning to think like someone trying to break the system you built, rather than someone trying to keep it running.

jobstrack.io

Learn how to create job alerts for Security Engineer roles.

Start tracking on jobstrack.io

Why Does Your Application Arrive Too Late for Most Security Roles?

Application timing is not a guarantee of recruiter response, and employers do not publish a standardized conversion benchmark. It still affects which review cohort an application enters.

Source: jobstrack.io operational observations, 2025. These are directional patterns rather than a controlled response-rate study.

Here's the paradox worth naming explicitly. The estimated global workforce need is large, while individual openings at reputable, AI-forward companies can still attract strong interest quickly. Aggregate staffing pressure does not remove competition for a specific role.

Direct career-page monitoring can help you find a posting before or soon after aggregators index it. Applying early does not replace role fit or a tailored application, but it can improve your chance of entering an earlier review cohort. jobstrack.io tracks company career pages directly and alerts you when a new role goes live.

Frequently Asked Questions

Is AI going to replace security engineers?

No. ISC2 estimated that organizations needed 4.8 million additional cybersecurity professionals globally in 2024, although that figure is not a count of open jobs (ISC2, 2024). AI can automate repetitive security work, while AI-written code and AI-powered features introduce risks that still require human judgment. The role is changing toward review, architecture, governance, and response rather than disappearing.

Do security engineers need to learn AI/machine learning in 2026?

You don't need to become an ML engineer. But you do need working fluency in how AI systems fail from a security perspective: prompt injection, model supply-chain risk, and agentic tool-use privilege boundaries. These concepts are now referenced by name in interviews at AI-forward companies, and 41% of cybersecurity teams already rank AI/ML as their top skill gap (ISC2 2025 Cybersecurity Workforce Study, 2025).

Is CISSP or OSCP better for a security engineer?

They serve different tracks. OSCP is the stronger signal for offensive and pentest-adjacent roles and hands-on technical depth. CISSP matters more for senior, architecture, or leadership-track roles, but it requires 5 cumulative years of paid experience across 2+ of its 8 domains, so it's not an early-career play. Most security engineers are better served pairing one role-matched certification with demonstrated hands-on experience, then pursuing CISSP once seniority is in reach.

What's the highest-paying security engineering specialization right now?

AI/LLM security is among the best-paid emerging tracks, but the dataset is still small. Glassdoor reports a $190K median total-pay estimate and a $152K-$239K range for AI Security Engineers as of August 2026. Senior roles at large technology companies and frontier labs can exceed that range, but candidates should compare scope, location, and equity rather than assuming a fixed specialization premium.

How is the security engineer interview different in 2026 versus a few years ago?

Most employers still assess technical fundamentals, security system design or threat modeling, and incident response or behavioral judgment. Some AI-forward employers also test whether candidates can threat-model a RAG chatbot or an autonomous agent with tool access. That scenario may be a dedicated round or part of an existing system-design interview, so candidates should confirm each employer's process rather than assume a fixed four-round loop.

The Bottom Line

The market rewards security engineers who treat AI as a new class of both risk and tooling. The evidence points in one direction: ISC2 estimated a need for 4.8 million additional cybersecurity professionals globally in 2024, 41% of teams named AI/ML their top skill need in 2025, Veracode found known security flaws in 45% of its controlled code-generation tasks, and IBM associated severe staffing shortages with $1.76 million in additional average breach cost. These figures measure different things, but together they show why AI-security skills and sound engineering judgment matter.

Information security analyst employment is projected to grow about 29% between 2024 and 2034, with roughly 16,000 annual openings, according to the U.S. Bureau of Labor Statistics (BLS Occupational Outlook Handbook, 2024-2034 projection). That is much faster than the 3% average projected across all occupations.

The concrete action sequence: pick one of the five specializations covered earlier, and earn the certification that matches it rather than the one that sounds most impressive. Then build one public artifact that proves you can do the work rather than just describe it, and apply within 24 hours of a role going live.

For adjacent paths worth reading next, see the DevOps/SRE career guide for the infrastructure-security overlap. See the ML/AI engineer career guide for the model-security intersection this guide keeps circling back to. Understaffing is the real risk in 2026, not automation. That's precisely why the engineers who show up prepared for the job the market actually has, rather than the one it had two years ago, are the ones getting hired fastest.

jobstrack.io

Track Security Engineer openings when they go live on company career pages.

Create your job alerts

References

• ISC2 (2024): ISC2 Publishes 2024 Cybersecurity Workforce Study First Look. Primary source for the global cybersecurity workforce gap sizing, including the 4.8 million-person estimate and 19% year-over-year growth rate. View Report
• ISC2 (2025): 2025 Cybersecurity Workforce Study. Skill-need data showing AI/ML at 41% and cloud security at 36%, maintaining their positions as the top two needs from 2024. View Report
• ISC2: CISSP Experience Requirements. Primary source for the five-year, two-domain experience prerequisite, one-year waiver, and Associate of ISC2 route. View Requirements
• Veracode (2026): Spring 2026 GenAI Code Security Update. Controlled testing across 80 coding tasks, four languages, and four vulnerability types; 45% of tasks introduced a known security flaw without security-specific guidance. View Report
• IBM (2025): Cost of a Data Breach Report. Breach-cost premiums tied to security skills shortages, shadow AI usage, and AI/automation adoption in security operations. View Report / Additional Findings
• OWASP GenAI Security Project (2026): Exploit Round-up Report, Q1 2026. Ranks prompt injection as the most frequently cited risk across OWASP's agentic-AI vulnerability categories. View Report
• InterviewStack.io (2026): How AI Is Changing the Cybersecurity Engineer Role in 2026. Single-job-board analysis of 5,379 active Cybersecurity Engineer postings in June 2026. Read Article
• Indeed Hiring Lab (2026): January 2026 US Labor Market Update. Corroborates the broader trend of AI mentions growing fast in job postings industry-wide. Read Article
• European Commission (2026): AI Act Application Timeline. Official dates for transparency obligations and phased high-risk-system requirements. View Timeline
• U.S. Bureau of Labor Statistics: Occupational Outlook Handbook, Information Security Analysts. Federal employment growth projections (2024-2034) and annual opening estimates. View Data
• Glassdoor (2026): Security Engineer Salary Report. Base salary data for US security engineer roles, including the median and percentile range. View Data
• Levels.fyi (2026): Google and Meta Security Engineer Compensation Data. Crowdsourced total compensation by level for Google and Meta security engineering roles.
• Glassdoor (2026): AI Security Engineer Salary Report. Estimated total-pay range and median for the emerging AI Security Engineer title; the reported sample remains small. View Data
• jobstrack.io (2025): Directional operational observations about how direct career-page monitoring affects when candidates discover newly posted roles. Not a controlled response-rate study.

Image Credits

• Photo by Samon Yu from Pexels, Man in a Control Room Overseeing Multiple Monitors Displaying Various Scenes.
• Photo by Field Engineer from Pexels, Field Engineer Examining Hardware and Working on a Laptop.
• Photo by Ismail Enes Ayhan on Unsplash, Server Room Aisle With Metal Equipment Racks.
• Hero image: Photo by Sasun Bughdaryan on Unsplash, Unlocked Padlock on a Computer Keyboard.