It is also possible to add and remove security groups when an instance is running. Currently this is only available through the command-line tools. Here is an example:
$ nova add-secgroup <server> <securitygroup> $ nova remove-secgroup <server> <securitygroup>