Security engineering is the process of incorporating security controls into an information system so that the controls become an integral part of the system’s operational capabilities. It is similar to other systems engineering activities in that its primary motivation is to support the delivery of engineering solutions that satisfy pre-defined functional and user requirements, but it has the added dimension of preventing misuse and malicious behavior. Those constraints and restrictions are often asserted as a security policy.

Ross John Anderson was a British researcher, author, and industry consultant in security engineering. He was Professor of Security Engineering at the Department of Computer Science and Technology, University of Cambridge where he was part of the University's security group.