Application Security (AppSec) Engineer

Application Security Engineers are responsible for securing data, systems, and applications. They ensure that an organization’s applications and services follow best security practices and align with their organization’s risk profile.

View the learning roadmap Graphical roadmap

01 / Summary

What an AppSec Engineer needs to know

How to use the information on this page: We gathered information from real job postings across numerous organizations, third-party research papers, and interviews with AppSec professionals to compile a comprehensive and actionable career path. This information serves as a roadmap to help you identify where to focus your learning efforts to become an AppSec Engineer. Everyone is different. You might be starting from zero, or you may already be beyond the basics. We present this information to help you throughout your career, and we will keep it as up-to-date as possible. Contact us if we missed something important or if something needs an update.

Fundamentals

01

The fundamentals are core areas, skills, languages, or tools that you should know. You do not need to master them all. Some are recommended, while others are useful but have a lower priority. You also do not need to know every tool, language, or skill in a section. For example, learn one or two programming languages well. This foundation makes it easier to learn the others later.

Programming languages

  • Recommended
    • JavaScript
    • Python
    • Java
    • PHP
    • .NET
  • Great to know
    • Go
    • Ruby
    • Bash

Programming tools

  • Git

Experience with

  • Software Development Lifecycle (SDLC)
  • Test-Driven Development (TDD)

Strong understanding of

  • Recommended
  • Great to know
    • MITRE ATT&CK
    • HackerOne Top 10 vulnerabilities

Security testing

  • Writing test cases
  • Manual testing
  • Automated testing
    • Experience with testing tools
  • Dynamic and static testing
  • Source code reviews

Networking

  • Networking basics as they relate to development
    • DNS
    • HTTP(S)
    • Ports

Linux and server administration

  • Setting up web application servers
  • Creating development, staging, and production environments

Ability to

  • Create threat models
  • Perform security risk assessments
  • Perform vulnerability assessments

Communication skills

  • Writing reports
  • Effective presentations
  • Explaining technical concepts to non-technical people
  • Documentation

Specializations

02

These are areas of specialization that you can focus on. Exposure to each area is useful, but most people naturally favor one area.

Areas

  • Web applications
  • Mobile applications
  • Serverless applications

Differentiating skills

03

These skills tend to increase pay and job market desirability. People usually acquire them after the fundamentals and specializations, so they are not starting points.

Skills

  • Cloud
  • DevSecOps
  • Exploit development

Career Paths

04

Job titles vary, but jobs related to AppSec skills tend to fit one or more of these categories. These categories show paths that these skills can support over time.

Roles

  • Software Developer
  • Application Security Engineer
  • Web Pentester
  • Bug Bounty Hunter (full time or part time)
  • Consulting
  • DevOps Engineer

Certifications

05

Can certifications give you an edge? Are they required to get jobs? Let’s take a look.

Are they worth it?

  • Many jobs require them, or at a minimum look favorably upon them.

Most often requested in AppSec job postings

  • CISSP
  • GIAC
  • CEH
  • CSSLP
  • OSCP
  • CCSK (or CSEP)
  • CRISC

02 / Jobs

What employers ask for

This information was collected and summarized from real online job postings.

Demand in source review High

Search term: Application Security Engineer

There are many open jobs for this specific search term at various experience levels, from beginner to senior. Application Security skills also rank highest for skills shortages across multiple recent third-party reports.

This job-market snapshot comes from the source page and is not live labor-market data.

Day-to-day work

Common responsibilities

  • Find application security weaknesses
  • Security-related testing with test cases and manual or automated dynamic and static methods
  • Documentation
  • Properly classify and communicate the severity and impact of vulnerabilities
  • Develop solutions to remediate findings
  • Manage vulnerabilities from identification through remediation and reporting
  • Provide security guidance to engineering teams
  • Application pentesting

Core profile

Common requirements

  • Bachelor’s degree (frequently, but not always seen)
  • Experience with
    • AppSec
    • Pentesting
    • Vulnerability management
  • Programming languages most often seen
    • Java
    • PHP
    • .NET
    • Python
    • JavaScript
  • Experience with
    • Source code reviews
    • Vulnerability detection
    • Root cause analysis
  • Experience with testing tools most often seen
    • Invicti (formerly Acunetix 360)
    • Checkmarx
    • Sysdig
    • Mend (formerly WhiteSource)
    • Fortify
  • Excellent verbal and written communication skills, including explaining technical concepts to non-technical audiences
  • Project management skills
    • Working on multiple projects at the same time
    • Managing priorities
    • Managing deadlines
  • Deep understanding of
    • OWASP Top 10
    • CWE Top 25
    • Good to know
      • MITRE ATT&CK
  • Experience with threat modeling and security risk assessment
  • Experience with TDD and SDLC practices

Senior roles

Preferred experience

  • Exploit development
  • Certifications
    • CISSP
    • GIAC
    • CEH
    • CSSLP
    • OSCP
    • CCSK or CSEP
    • CRISC
  • DevSecOps experience
    • Implementing CI/CD pipelines
    • Managing secrets
  • Cloud experience
    • Architecture
    • Design patterns
    • Security risks
  • IAM (Identity and Access Management)
  • Network security
  • Understanding of encryption
    • Secrets management
    • Authentication
    • Data masking
    • Implementation
  • Automation tooling
    • Ansible
    • Puppet
    • Jenkins
    • Terraform
  • API security
  • Bug Bounty experience
  • CTF experience

03 / Learning roadmap

Learning Paths

There are many ways to enter this field or follow this career path. This roadmap highlights the main skills and knowledge needed to excel. It runs from fundamentals to more advanced and specific topics. Start at the top and work down, or adjust the order to fit your experience. The order is a recommendation based on our experience, community feedback, and active job postings.

Stage 1

Foundations

01 Learn Programming Languages
  • Very important for web (pick one or two and focus)
    • Java
    • PHP
    • .NET
    • Python
    • JavaScript
    • C
  • Very important for mobile
    • Swift
    • Android Java
  • Important
    • Ruby
    • SQL
  • Useful
    • Angular
    • Vue.js
    • React
    • Bash
    • Go
  • Programming tools
    • Git
  • Programming concepts
02 Basic Server Administration
  • Operating systems
    • Important
      • Linux
    • Useful
      • Windows
  • Web servers (pick one and learn it well)
    • Important
      • Apache
      • Nginx
    • Useful
      • Tomcat
      • IIS
  • Caching
    • Important
      • Redis
    • Useful
      • Memcache
  • Databases (dabble in both SQL and NoSQL)
    • SQL
      • MySQL/MariaDB
      • PostgreSQL
      • MSSQL
    • NoSQL
      • MongoDB
      • Cassandra
      • AWS DynamoDB
Stage 2

AppSec Security Path

01 Networking Fundamentals
  • TCP/IP fundamentals
  • DNS fundamentals
  • HTTP
  • FTP
02 Software Development Lifecycle (SDLC)
  • Planning and requirement analysis
  • Defining requirements
  • Designing the product architecture
  • Building and developing the product
  • Testing the product
    • TDD (Test-Driven Development)
    • Security testing
      • Writing test cases
      • Manual testing
      • Automated testing
        • Testing tools
      • Dynamic and static testing
      • Source code review
  • Deploying to market and maintaining
  • Waterfall vs. Agile vs. Rapid development
03 Vulnerabilities
  • Web
    • OWASP Top 10 for Web
    • OWASP Top 10 for APIs
    • OWASP Top 10 for Serverless
    • HackerOne Top 10
  • Mobile
    • OWASP Top 10 for Mobile
  • CWE Top 25
  • MITRE ATT&CK
  • Vulnerability assessment (pentesting)
    • Tooling
    • Methodologies
    • Google Dorking
04 Cloud
  • Concepts
    • Identity and Access Management
    • Data Protection
    • Infrastructure and Network
    • Monitoring and Logging
    • Security Risks
  • AWS
  • Azure
  • GCP
05 Exploit Development

No topics are listed here yet.

06 Cryptography Fundamentals
  • TLS
  • HTTPS
  • Implementation
  • Authentication and data masking
  • Hashing
07 AppSec Frameworks
  • Web
    • OWASP ASVS
  • Mobile
    • OWASP MASVS
  • OWASP SAMM
  • OWASP Proactive Controls
  • Threat Modeling and Security Risk Assessment
08 DevSecOps
  • Infrastructure as Code
    • Configuration management
      • Ansible
      • Puppet
      • Chef
      • Salt Stack
    • Containers
      • Docker
      • LXC
    • Infrastructure provisioning
      • Terraform
      • AWS CloudFormation
      • Azure Resource Manager templates
    • CI/CD
      • Jenkins
      • CircleCI
      • Travis CI
      • GitLab CI
      • GitHub Actions
    • Secrets Management
09 Logging & Monitoring
  • Error logging and monitoring
  • Performance logging and monitoring
  • Web
  • Mobile
  • Cloud

Some linked resources are free, while others are paid. Cybr is not responsible for activity on external websites. This living document can change at any time. Contact us if an important topic is missing.

Continue learning

Cybr Courses Related to this Career Path

View more courses