Tier0: Pure security research shops, like Google Project Zero and alike. YOu can only get this job after doing PhD in Computer Security at top-tier university lab, and have publications on stuff like linux kernel fuzzing, have 10+ linux CVEs under your belt, and listed as contributor to a well-known open-source security tool.
Tier1: top security vendors: crowdstrike zs qualys pan cisco and etc. R&D (or Business Unit) departments responsible for developing security product features and maintaining security content.
Tier2: FAANG and adjacent cloud-native companies, job title "security software engineer" or "security engineer" or "$platform_name engineer" or "cloudsec/appsec engineer"
Tier3: pre-IPO unicorns which are hiring for Product Security and AppSecurity positions
... Tier10+: all other public companies, regular S&P500 infosec department.
the general rule is the higher the salary the more demanding the job will be and the tougher is competition to get that job
That was also my short experience in the area, and it was boring AF, almost soulcrushing. Maybe I just got unlucky, but it feels that a lot of security engineering positions are like that.
Would anyone happen to know of what search terms should one use to find open positions that are focused on security tool building rather than deploying a purchased solution?