Yup, security is very different from regular eng. You should definitely look into how to design detection libraries for various things like image store, anomaly detection for different traffic patterns, and also general response infrastructure. I think the system design interviews will be fairly high level, but you should know how to architect these things and I think one of the more key things is generally being familiar with the terminology: https://www.sans.org/security-resources/glossary-of-terms/