diff --git a/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.js b/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.js
index bf4d20495c4..b1a4451744c 100644
--- a/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.js
+++ b/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.js
@@ -159,6 +159,12 @@ module.exports = angular.module('spinnaker.loadBalancer.aws.create.controller',
       }
     }
 
+    function availableGroupsSorter(a, b) {
+      return $scope.loadBalancer.securityGroups.includes(a.id) ? -1 :
+        $scope.loadBalancer.securityGroups.includes(b.id) ? 1 :
+          0;
+    }
+
     function updateAvailableSecurityGroups(availableVpcIds) {
       var account = $scope.loadBalancer.credentials,
         region = $scope.loadBalancer.region;
@@ -166,7 +172,7 @@ module.exports = angular.module('spinnaker.loadBalancer.aws.create.controller',
       if (account && region && allSecurityGroups[account] && allSecurityGroups[account].aws[region]) {
         $scope.availableSecurityGroups = _.filter(allSecurityGroups[account].aws[region], function(securityGroup) {
           return availableVpcIds.includes(securityGroup.vpcId);
-        });
+        }).sort(availableGroupsSorter); // push existing groups to top
         $scope.existingSecurityGroupNames = _.map($scope.availableSecurityGroups, 'name');
         var existingNames = defaultSecurityGroups.filter(function(defaultName) {
           return $scope.existingSecurityGroupNames.includes(defaultName);
diff --git a/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.spec.js b/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.spec.js
index e28ef283118..8e64c9983b0 100644
--- a/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.spec.js
+++ b/app/scripts/modules/amazon/loadBalancer/configure/createLoadBalancer.controller.spec.js
@@ -13,18 +13,29 @@ describe('Controller: awsCreateLoadBalancerCtrl', function () {
   );
 
   // Initialize the controller and a mock scope
-  beforeEach(window.inject(function ($controller, $rootScope, applicationModelBuilder) {
+  beforeEach(window.inject(function ($controller, $rootScope, $q, accountService, subnetReader, applicationModelBuilder, securityGroupReader, awsLoadBalancerTransformer) {
     this.$scope = $rootScope.$new();
+    this.securityGroupReader = securityGroupReader;
+    this.accountService = accountService;
+    this.subnetReader = subnetReader;
+    this.$q = $q;
     const app = applicationModelBuilder.createApplication({key: 'loadBalancers', lazy: true});
-    this.initialize = () => {
+    this.initialize = (loadBalancer = null) => {
+      if (loadBalancer) {
+        spyOn(awsLoadBalancerTransformer, 'convertLoadBalancerForEditing').and.returnValue(loadBalancer);
+      }
       this.ctrl = $controller('awsCreateLoadBalancerCtrl', {
         $scope: this.$scope,
         $uibModalInstance: {dismiss: angular.noop, result: {then: angular.noop}},
         infrastructureCaches: { get: () => { return {getStats: () => {return {}; } }; } },
         application: app,
-        loadBalancer: null,
-        isNew: true,
-        forPipelineConfig: false
+        loadBalancer: loadBalancer,
+        isNew: loadBalancer === null,
+        forPipelineConfig: false,
+        securityGroupReader: securityGroupReader,
+        accountService: accountService,
+        subnetReader: subnetReader,
+        awsLoadBalancerTransformer: awsLoadBalancerTransformer,
       });
     };
   }));
@@ -182,6 +193,34 @@ describe('Controller: awsCreateLoadBalancerCtrl', function () {
       expect(this.$scope.loadBalancer.isInternal).toBe(false);
       expect(this.$scope.state.hideInternalFlag).toBeUndefined();
     });
+
+    it('should put existing security groups in the front of the available list', function () {
+      const availableSecurityGroups = {
+        test: {
+          aws: {
+            'us-east-1': [
+              {name: 'a', id: '1', vpcId: 'vpc-1'},
+              {name: 'b', id: '2', vpcId: 'vpc-1'},
+              {name: 'c', id: '3', vpcId: 'vpc-1'},
+              {name: 'd', id: '4', vpcId: 'vpc-1'}]
+          }
+        }
+      };
+      const existingLoadBalancer = {
+        name: 'elb-1',
+        vpcId: 'vpc-1',
+        credentials: 'test',
+        region: 'us-east-1',
+        securityGroups: ['4'],
+        listeners: [],
+      };
+      spyOn(this.securityGroupReader, 'getAllSecurityGroups').and.returnValue(this.$q.when(availableSecurityGroups));
+      spyOn(this.accountService, 'getAccountDetails').and.returnValue(this.$q.when([{name: 'test'}]));
+      spyOn(this.subnetReader, 'listSubnets').and.returnValue(this.$q.when([{account: 'test', region: 'us-east-1', vpcIds: ['vpc-1']}]));
+      this.initialize(existingLoadBalancer);
+      this.$scope.$digest();
+      expect(this.$scope.availableSecurityGroups.map(g => g.name)).toEqual(['d', 'a', 'b', 'c']);
+    });
   });
 
 });