--- title: "Application Security (AppSec) Engineer - Cybr" description: "Interested in an Application Security Engineering career path? We have an in-depth breakdown of the knowledge/skills/abilities/tools you need." url: https://cybr.com/career-paths/application-security-appsec-engineer/ --- # Application Security (AppSec) Engineer Application Security Engineers are responsible for securing data, systems, and applications. They ensure that an organization’s applications and services follow best security practices and align with their organization’s risk profile. [View the learning roadmap](#learning-paths) [Graphical roadmap](https://github.com/Cybr-Inc/appsec-engineer-roadmap) On this page ## Career roadmap 1. 01 [Summary](#summary) 2. 02 [Jobs](#jobs) 3. 03 [Learning Paths](#learning-paths) 01 / Summary ## What an AppSec Engineer needs to know How to use the information on this page: We gathered information from real job postings across numerous organizations, third-party research papers, and interviews with AppSec professionals to compile a comprehensive and actionable career path. This information serves as a roadmap to help you identify where to focus your learning efforts to become an AppSec Engineer. Everyone is different. You might be starting from zero, or you may already be beyond the basics. We present this information to help you throughout your career, and we will keep it as up-to-date as possible. Contact us if we missed something important or if something needs an update. ### Fundamentals 01 The fundamentals are core areas, skills, languages, or tools that you should know. You do not need to master them all. Some are recommended, while others are useful but have a lower priority. You also do not need to know every tool, language, or skill in a section. For example, learn one or two programming languages well. This foundation makes it easier to learn the others later. #### Programming languages - Recommended - JavaScript - Python - Java - PHP - .NET - Great to know - Go - Ruby - Bash #### Programming tools - Git #### Experience with - Software Development Lifecycle (SDLC) - Test-Driven Development (TDD) #### Strong understanding of - Recommended - OWASP Top 10 vulnerabilities and methodologies - CWE Top 25 - [The Twelve-Factor App](https://12factor.net/) - Great to know - MITRE ATT&CK - HackerOne Top 10 vulnerabilities #### Security testing - Writing test cases - Manual testing - Automated testing - Experience with testing tools - Dynamic and static testing - Source code reviews #### Networking - Networking basics as they relate to development - DNS - HTTP(S) - Ports #### Linux and server administration - Setting up web application servers - Creating development, staging, and production environments #### Ability to - Create threat models - Perform security risk assessments - Perform vulnerability assessments #### Communication skills - Writing reports - Effective presentations - Explaining technical concepts to non-technical people - Documentation ### Specializations 02 These are areas of specialization that you can focus on. Exposure to each area is useful, but most people naturally favor one area. #### Areas - Web applications - Mobile applications - Serverless applications ### Differentiating skills 03 These skills tend to increase pay and job market desirability. People usually acquire them after the fundamentals and specializations, so they are not starting points. #### Skills - Cloud - DevSecOps - Exploit development ### Career Paths 04 Job titles vary, but jobs related to AppSec skills tend to fit one or more of these categories. These categories show paths that these skills can support over time. #### Roles - Software Developer - Application Security Engineer - Web Pentester - Bug Bounty Hunter (full time or part time) - Consulting - DevOps Engineer ### Certifications 05 Can certifications give you an edge? Are they required to get jobs? Let’s take a look. #### Are they worth it? - Many jobs require them, or at a minimum look favorably upon them. #### Most often requested in AppSec job postings - CISSP - GIAC - CEH - CSSLP - OSCP - CCSK (or CSEP) - CRISC 02 / Jobs ## What employers ask for This information was collected and summarized from real online job postings. Demand in source review **High** Search term: Application Security Engineer There are many open jobs for this specific search term at various experience levels, from beginner to senior. Application Security skills also rank highest for skills shortages across multiple recent third-party reports. This job-market snapshot comes from the source page and is not live labor-market data. Day-to-day work ### Common responsibilities - Find application security weaknesses - Security-related testing with test cases and manual or automated dynamic and static methods - Documentation - Properly classify and communicate the severity and impact of vulnerabilities - Develop solutions to remediate findings - Manage vulnerabilities from identification through remediation and reporting - Provide security guidance to engineering teams - Application pentesting Core profile ### Common requirements - Bachelor’s degree (frequently, but not always seen) - Experience with - AppSec - Pentesting - Vulnerability management - Programming languages most often seen - Java - PHP - .NET - Python - JavaScript - Experience with - Source code reviews - Vulnerability detection - Root cause analysis - Experience with testing tools most often seen - Invicti (formerly Acunetix 360) - Checkmarx - Sysdig - Mend (formerly WhiteSource) - Fortify - Excellent verbal and written communication skills, including explaining technical concepts to non-technical audiences - Project management skills - Working on multiple projects at the same time - Managing priorities - Managing deadlines - Deep understanding of - OWASP Top 10 - CWE Top 25 - Good to know - MITRE ATT&CK - Experience with threat modeling and security risk assessment - Experience with TDD and SDLC practices Senior roles ### Preferred experience - Exploit development - Certifications - CISSP - GIAC - CEH - CSSLP - OSCP - CCSK or CSEP - CRISC - DevSecOps experience - Implementing CI/CD pipelines - Managing secrets - Cloud experience - Architecture - Design patterns - Security risks - IAM (Identity and Access Management) - Network security - Understanding of encryption - Secrets management - Authentication - Data masking - Implementation - Automation tooling - Ansible - Puppet - Jenkins - Terraform - API security - Bug Bounty experience - CTF experience 03 / Learning roadmap ## Learning Paths There are many ways to enter this field or follow this career path. This roadmap highlights the main skills and knowledge needed to excel. It runs from fundamentals to more advanced and specific topics. Start at the top and work down, or adjust the order to fit your experience. The order is a recommendation based on our experience, community feedback, and active job postings. Stage 1 ### Foundations 01 **Learn Programming Languages** - Very important for web (pick one or two and focus) - Java - PHP - .NET - Python - JavaScript - C - Very important for mobile - Swift - Android Java - Important - Ruby - SQL - Useful - Angular - Vue.js - React - Bash - Go - Programming tools - Git - Programming concepts - Data structures, trees, sorting, and related topics [Coding Interview University study plan](https://github.com/jwasham/coding-interview-university) - [CS50 Lectures from Harvard](https://www.youtube.com/playlist?list=PLhQjrBD2T3828ZVcVzEIhsHVgjANGZveu) - Encoding and decoding 02 **Basic Server Administration** - Operating systems - Important - Linux - Useful - Windows - Web servers (pick one and learn it well) - Important - Apache - Nginx - Useful - Tomcat - IIS - Caching - Important - Redis - Useful - Memcache - Databases (dabble in both SQL and NoSQL) - SQL - MySQL/MariaDB - PostgreSQL - MSSQL - NoSQL - MongoDB - Cassandra - AWS DynamoDB Stage 2 ### AppSec Security Path 01 **Networking Fundamentals** - TCP/IP fundamentals - DNS fundamentals - HTTP - FTP 02 **Software Development Lifecycle (SDLC)** - Planning and requirement analysis - Defining requirements - Designing the product architecture - Building and developing the product - Testing the product - TDD (Test-Driven Development) - Security testing - Writing test cases - Manual testing - Automated testing - Testing tools - Dynamic and static testing - Source code review - Deploying to market and maintaining - Waterfall vs. Agile vs. Rapid development 03 **Vulnerabilities** - Web - OWASP Top 10 for Web - OWASP Top 10 for APIs - OWASP Top 10 for Serverless - HackerOne Top 10 - Mobile - OWASP Top 10 for Mobile - CWE Top 25 - MITRE ATT&CK - Vulnerability assessment (pentesting) - Tooling - Methodologies - Google Dorking 04 **Cloud** - Concepts - Identity and Access Management - Data Protection - Infrastructure and Network - Monitoring and Logging - Security Risks - AWS - Azure - GCP 05 **Exploit Development** No topics are listed here yet. 06 **Cryptography Fundamentals** - TLS - HTTPS - Implementation - Authentication and data masking - Hashing 07 **AppSec Frameworks** - Web - OWASP ASVS - Mobile - OWASP MASVS - OWASP SAMM - OWASP Proactive Controls - Threat Modeling and Security Risk Assessment 08 **DevSecOps** - Infrastructure as Code - Configuration management - Ansible - Puppet - Chef - Salt Stack - Containers - Docker - LXC - Infrastructure provisioning - Terraform - AWS CloudFormation - Azure Resource Manager templates - CI/CD - Jenkins - CircleCI - Travis CI - GitLab CI - GitHub Actions - Secrets Management 09 **Logging & Monitoring** - Error logging and monitoring - Performance logging and monitoring - Web - Mobile - Cloud Some linked resources are free, while others are paid. Cybr is not responsible for activity on external websites. This living document can change at any time. Contact us if an important topic is missing. Continue learning ## Cybr Courses Related to this Career Path [View more courses](https://cybr.com/courses/) - [The Practical Guide to sqlmap](https://cybr.com/courses/the-practical-guide-to-sqlmap-for-sql-injection/) - [Cybr’s XSS Course](https://cybr.com/courses/cross-site-scripting-xss-the-practical-guide/) - [Introduction to Application Security course](https://cybr.com/courses/introduction-to-application-security-appsec/) - [Introduction to OS Command Injections Course](https://cybr.com/courses/introduction-to-os-command-injections/) - [Networking Fundamentals Course](https://cybr.com/courses/networking-fundamentals/) - [Injection Attacks Course](https://cybr.com/courses/injection-attacks-the-free-guide/)