Security engineers live in a world of stack traces, threat models, Terraform plans, and dense technical documentation. Their work requires both deep technical expertise and broad situational awareness — they need to quickly understand systems they've never built, identify vulnerabilities that may be subtle or indirect, and communicate findings clearly to engineers who may not share their security frame.
Anthropically's Security Engineering team has become one of the heaviest and most sophisticated Claude Code users in the company. They're responsible for securing the software development lifecycle, supply chain security, and development environment security — and they've built workflows that make Claude Code central to nearly every part of their work. Notably, they account for 50% of all custom slash command implementations across Anthropic's entire monorepo — a striking signal of how deeply they've integrated Claude Code into their practice.
Complex Infrastructure Debugging
When something breaks in a complex distributed system, the first challenge is simply understanding what you're looking at. Stack traces from modern infrastructure can run hundreds of lines, spanning multiple services, with the actual root cause often buried several layers deep.
The Security Engineering team feeds these stack traces directly into Claude Code alongside relevant documentation, then asks Claude to trace the control flow and identify where things went wrong. What previously took 10–15 minutes of manual scanning now takes roughly 5 minutes — a consistent 50–67% reduction in initial triage time.
This isn't just about speed. It's about confidence. When you're dealing with a security incident, having a second perspective that can rapidly parse dense output and point to the likely culprit reduces the cognitive load that leads to errors under pressure.
Terraform Code Review and Analysis
Infrastructure-as-code has made security review both more tractable and more consequential. Terraform plans can be precise and auditable — but they can also be dense, and a misread plan can mean deploying infrastructure with significant security implications.
The team has developed a simple but effective pattern: copy a Terraform plan into Claude Code and ask, "What's this going to do? Am I going to regret this?"
This conversational framing elicits exactly the kind of analysis a security-minded reviewer would want: what's being created or modified, what permissions are being granted, what network exposure is implied, what could go wrong. Claude can cross-reference the plan against known security anti-patterns and flag anything that looks unusual.
The result is a tighter feedback loop for security approval — changes get reviewed faster, and reviewers have more confidence that they haven't missed something.
Documentation Synthesis and Runbooks
Security teams accumulate documentation from many sources: vendor docs, internal wiki pages, post-incident write-ups, compliance requirements, architecture decision records. In practice, this documentation is often scattered and hard to use in the moment when you need it.
The Security Engineering team uses Claude Code to ingest multiple documentation sources and produce consolidated markdown runbooks and troubleshooting guides. These condensed documents serve two purposes: they're useful as standalone references, and they can be loaded into Claude Code as context for future debugging sessions.
This creates a compounding benefit: the better the runbooks get, the more useful Claude Code becomes for the next incident. Documentation becomes an active part of the team's incident response toolchain rather than something you search through while the clock is running.
Test-Driven Development Workflow
The traditional development workflow — write a design doc, write some code, realize it's messy, refactor, give up on adding tests because everything changed — is a common failure mode. Security engineers, who particularly need high-confidence code, have found that Claude Code enables a better path.
Instead of diving into implementation, they start by asking Claude to produce pseudocode for the approach, then guide Claude through a test-driven development process: write tests first, confirm they fail, implement to make them pass, verify. Claude checks in periodically rather than running autonomously the whole way.
This keeps the code testable by construction and produces clearer implementations than the traditional write-first approach. For security-sensitive code, the difference in reliability is meaningful.
Context Switching and Project Onboarding
Security engineers often rotate across different parts of the codebase — they need to understand a system's architecture to review it effectively, then move on to the next thing. This makes rapid onboarding a core skill.
The team stores specifications and review notes as markdown files within the codebase itself, then uses Claude Code to read, review, and execute them. When rotating onto a new project, an engineer can share the relevant specification with Claude Code and ask it to help navigate the codebase to verify the spec against reality.
Team members have reported being able to contribute meaningfully to projects within days rather than weeks — a significant compression of the traditional onboarding timeline that often takes a month or more for complex security reviews.
Team Impact
- Incident resolution time reduced from 10–15 minutes to approximately 5 minutes for initial triage
- Faster security review cycle for Terraform changes — reviewers have higher confidence with AI-assisted analysis
- Team members contribute meaningfully to new projects within days rather than weeks
- Security Engineering accounts for 50% of all custom slash command implementations in Anthropic's monorepo
- Improved documentation quality and usability through synthesized runbooks that serve as active incident response tools
Top Tips From the Security Engineering Team
Use custom slash commands extensively. The fact that Security Engineering accounts for half of all custom slash commands across the monorepo is a signal worth paying attention to. These commands encode team-specific workflows — common review patterns, recurring debugging sequences, standard documentation templates — and they make Claude Code dramatically more efficient for your specific context. Invest time in building them.
Let Claude talk first. Tell Claude to work autonomously and commit its work as it goes, then check in periodically. Resist the urge to micro-manage every step. Claude often finds solutions through paths you wouldn't have thought of — but only if you give it room to work.
Leverage Claude for documentation that's immediately usable. Provide writing samples and formatting preferences specific to where the doc will live (Slack, Google Docs, your internal wiki). Claude can match the style and format so the output doesn't need extensive editing before it's useful — which means documentation actually gets written and shared rather than sitting on a to-do list.