---
key: "appsec-careers"
title: "Build an application security career: roles, skills, portfolio and certifications"
url: "https://softwaresecurity.com/frameworks/appsec-careers/"
api: "https://softwaresecurity.com/api/v1/articles/appsec-careers.json"
domain: "governance"
topic: "Governance \u0026 frameworks"
type: "Guide"
identifiers: []
tags: ["AppSec programs"]
stages: ["govern"]
roles: ["developer","appsec-engineer","security-leader"]
license: "CC-BY-4.0"
license_url: "https://creativecommons.org/licenses/by/4.0/"
code_license: "MIT"
---

# Build an application security career: roles, skills, portfolio and certifications

The main application security role tracks (AppSec engineer, product security engineer, security champion, platform security engineer, security architect), the skills expected at each level, how to build a portfolio a hiring team can verify using this site's labs, projects and fix cards, and what common certifications do and do not show.

Canonical URL: https://softwaresecurity.com/frameworks/appsec-careers/

## In short

Most AppSec jobs reward the same core: you can read code and find the bug, explain the fix to the engineer who owns it, and turn one finding into a control that stops the class. Pick a track (AppSec engineer, product security, platform security, security architect, or the champion role inside a product team), build those skills to the next level in the matrix below, and prove them with a portfolio a hiring team can check: fixed labs and projects, write-ups, threat models and reviewed pull requests. Certifications help most where they include a hands-on exam, and least as a substitute for code you can show.

- Do learn to read code well in at least two languages; secure code review is the skill most AppSec roles share.
- Do build a portfolio of things others can verify: lab fixes with passing tests, write-ups, threat models, merged security fixes.
- Do practise explaining a finding and its fix in writing; influence is what separates senior from mid level.
- Do pick certifications by what the exam tests: hands-on exams show you can do the work, multiple-choice exams show breadth.
- Don't test systems you are not authorized to test; use labs, your own code and programs with a published scope.

## Recommended defaults

| Setting | Value | Note | Source |
| --- | --- | --- | --- |
| OffSec OSCP and OSCP+ | PEN-200; 24-hour proctored hands-on exam | OSCP+ expires three years after issue; OSCP does not expire. | OffSec |
| OffSec OSWE | WEB-300; 48-hour proctored exam with a professional report | — | OffSec |
| Burp Suite Certified Practitioner | 4-hour exam, two applications, three stages each | Needs an active Burp Suite Professional subscription; valid five years. | PortSwigger |
| ISC2 CSSLP | Four years of required work experience; eight domains | — | ISC2 |
| Linux Foundation CKS | 2-hour performance-based exam; CKA required first | Valid two years. | Linux Foundation |

## Verify it

1. Score yourself against the skills matrix with one piece of evidence per skill, and ask a senior colleague to challenge the scores.
2. For each portfolio item, check that a stranger could verify it: a public repository, a passing CI run, a published write-up or a merged pull request.
3. Before booking a certification, read the issuer's exam format and confirm it tests the skill you want to show.
4. Run a mock interview with one code review and one threat modeling exercise from the question bank, timed.

## What you will learn

- Compare the main AppSec role tracks and what good looks like in each.
- Assess your skills against a level-based matrix with evidence.
- Build a portfolio a hiring team can verify.
- Choose certifications by what their exams actually test.

Audience: Developers moving into security, early-career AppSec engineers and managers who hire or level AppSec staff

Before you start:

- Experience writing or reviewing code in at least one language.
- For the script: Python 3.11 or later with PyYAML.

Time: About 29 minutes: 9 to read and 20 for the exercise

## What are the main AppSec role tracks?

Titles vary between companies, so read the job description for the work, not the name. Five tracks cover most roles; penetration testing and PSIRT work are close neighbors that share many skills.

| Track | Day to day | Works with | Good looks like |
| --- | --- | --- | --- |
| AppSec engineer | Code and design reviews, triaging scanner and bug bounty findings, writing guidance and secure defaults | Product engineers, champions, platform teams | Findings fixed by owners, recurring classes removed with libraries or rules |
| Product security engineer | Security of one product line end to end: threat models, requirements, release decisions, vulnerability response | Product managers, engineering leads, the PSIRT | Security built into the roadmap; few surprises at release |
| Security champion | Part-time role inside a product team: first-line reviews, triage, questions, link to AppSec | Their own team and the AppSec team | Team ships fewer repeat findings; questions answered the same day |
| Platform security / DevSecOps engineer | CI/CD and cloud guardrails, secrets, identity for workloads, scanning in pipelines | Platform, SRE and build teams | Secure paths are the easy paths; policy enforced by the platform |
| Security architect | Patterns and reference designs, major design reviews, cross-team decisions and standards | Principal engineers, CTO office, risk owners | Designs that remove whole classes of risk; decisions written down |
| Adjacent: PSIRT analyst, penetration tester | Handling vulnerability reports and advisories; testing systems within an agreed scope | Finders, customers, product teams | Accurate advisories on time; clear, reproducible reports |

## What skills are expected at each level?

Levels differ less in what you know than in scope and independence: an entry engineer finds and explains issues in one service with guidance, a senior engineer changes how several teams build, and a staff engineer changes the organization's defaults. The table is a starting point for a career ladder; adapt the wording to your company.

| Skill | Entry | Mid | Senior | Staff / principal |
| --- | --- | --- | --- | --- |
| Secure code review | Finds common classes with a checklist | Finds logic and authorization flaws unaided | Reviews high-risk changes across stacks | Sets review standards and tooling |
| Vulnerability classes | Explains and fixes the common ones | Knows root causes and variants per stack | Removes classes with libraries and rules | Shapes frameworks and defaults company-wide |
| Threat modeling | Contributes in sessions | Leads a session for one feature | Models systems and trains others | Defines the method and patterns |
| Testing tools (SAST, DAST, SCA) | Runs and triages results | Tunes rules, cuts false positives | Designs the pipeline | Chooses and measures the tool strategy |
| Identity and cryptography | Knows sessions, tokens and hashing basics | Reviews OAuth, JWT and key use | Designs auth and key management | Owns the identity and crypto standards |
| Cloud and CI/CD | Reads IAM and pipeline config | Hardens pipelines and workloads | Designs guardrails | Sets platform security direction |
| Vulnerability response | Triages advisories | Owns cases end to end | Runs the PSIRT process | Sets disclosure policy and metrics |
| Influence and writing | Clear tickets | Guidelines teams follow | Changes team behavior | Changes organizational priorities |

## How do you find your own skill gaps?

Score yourself honestly against a matrix, with one piece of evidence per skill, and let a script list the gaps and where to practise. The matrix below uses a 0 to 4 scale per skill and level, and points each skill at a page on this site. A sample self-assessment aiming at mid level reports gaps in code review, threat modeling and tools, and two skills with no evidence yet, which is often the more useful finding. Run it with `python skill_gaps.py skills.yaml me.yaml`.

```yaml
# Skills matrix: expected level per skill for each career level (0 none, 1 aware, 2 working, 3 strong, 4 expert).
levels: [entry, mid, senior, staff]
skills:
  secure-code-review:      {entry: 2, mid: 3, senior: 3, staff: 4}
  vulnerability-classes:   {entry: 2, mid: 3, senior: 4, staff: 4}
  threat-modeling:         {entry: 1, mid: 2, senior: 3, staff: 4}
  security-testing-tools:  {entry: 2, mid: 3, senior: 3, staff: 3}
  identity-and-crypto:     {entry: 1, mid: 2, senior: 3, staff: 3}
  cloud-and-ci-cd:         {entry: 1, mid: 2, senior: 3, staff: 3}
  vulnerability-response:  {entry: 1, mid: 2, senior: 3, staff: 3}
  influence-and-writing:   {entry: 1, mid: 2, senior: 3, staff: 4}
  program-and-metrics:     {entry: 0, mid: 1, senior: 2, staff: 3}
# Where to practise each skill on softwaresecurity.com.
practice:
  secure-code-review: /domains/appsec/code-review/security-code-review/
  vulnerability-classes: /fix/
  threat-modeling: /domains/appsec/threat-modeling/threat-modeling-methods/
  security-testing-tools: /domains/appsec/testing/sast-dast-workflow/
  identity-and-crypto: /learn/identity-lifecycle/
  cloud-and-ci-cd: /learn/supply-chain-assurance/
  vulnerability-response: /domains/appsec/vulnerability-response/psirt-operating-model/
  influence-and-writing: /frameworks/security-champions-program/
  program-and-metrics: /frameworks/appsec-metrics-and-slas/
```

## What does the gap script check?

It compares each skill's self-assessed level with the target level's expectation and flags any skill without evidence, even when the level is met. Keep `me.yaml` in a private repository and update it each quarter; the history is a useful conversation with a manager.

```python
"""Print the skills where a self-assessment falls short of a target level.

Usage: python skill_gaps.py skills.yaml me.yaml
"""
import sys

import yaml


def gaps(matrix, me):
    target = me["target"]
    for skill, expected in matrix["skills"].items():
        mine = me["self"].get(skill, {"level": 0, "evidence": ""})
        need = expected[target]
        if mine["level"] < need or not mine.get("evidence"):
            yield skill, mine["level"], need, bool(mine.get("evidence")), matrix["practice"].get(skill, "")


if __name__ == "__main__":
    matrix = yaml.safe_load(open(sys.argv[1], encoding="utf-8"))
    me = yaml.safe_load(open(sys.argv[2], encoding="utf-8"))
    print(f"Target level: {me['target']}")
    for skill, have, need, evidence, where in gaps(matrix, me):
        note = "" if evidence else " (no evidence yet)"
        print(f"{skill:24} have {have}, need {need}{note}  practise: {where}")
```

## How do you build an AppSec portfolio?

Hiring teams trust what they can check. A list of courses shows effort; a repository where a starter fails its security tests and your fix passes them shows skill. Build the portfolio from work that is public, authorized and verifiable.

- Labs and projects: fix the downloadable projects on /labs/ in a public repository with CI running their tests, and write a short note per project on the root cause and the fix.
- Fix cards: reproduce a fix card from /fix/ in a second stack and explain why the wrong fix fails.
- Learning paths: complete the path for your track, such as /learn/appsec-practitioner/ or /learn/supply-chain-assurance/, and keep notes.
- Threat models: model an open-source project's design using /domains/appsec/threat-modeling/threat-modeling-methods/ and share it with the maintainers if they want it.
- Code review and fixes: security fixes merged into open-source projects, with the maintainers' agreement, show you can work with owners.
- Vulnerability reports: report only within a published scope, through programs described in /domains/appsec/vulnerability-response/vdp-bug-bounty-pentest/, and publish only after coordinated disclosure.
- Writing: two or three clear write-ups of a weakness class, its variants and its fix in your languages.

## Which certifications are worth it, and what do they show?

Certifications answer different questions. Hands-on exams show you can do a defined task under time pressure; multiple-choice exams show breadth of knowledge; experience-gated credentials show time in the field. None shows that you can work with engineers to fix code, which is most of the job. The table lists common ones with details checked on the issuers' sites in October 2026; formats change, so re-check before booking.

| Certification | Issuer and exam | What it shows | What it does not show | Fits |
| --- | --- | --- | --- | --- |
| OSCP / OSCP+ | OffSec; PEN-200; 24-hour proctored hands-on exam on standalone machines and an Active Directory set | Persistence and practical exploitation of networks and hosts | Code review, secure design or web-app depth | Penetration testing; useful breadth for AppSec |
| OSWE | OffSec; WEB-300; 48-hour proctored exam, source-code (white-box) analysis, custom exploit and a professional report | Finding and exploiting web vulnerabilities by reading code | Fixing at scale, working with owners | AppSec engineer, web testing |
| Burp Suite Certified Practitioner (BSCP) | PortSwigger; 4 hours, two applications, three stages each; needs Burp Suite Professional; valid 5 years | Hands-on web exploitation across common classes | Code-level fixes, design | AppSec engineer, web testing |
| GIAC GWAPT | GIAC; proctored, 82 questions in 3 hours with hands-on CyberLive items; aligned with SANS SEC542 | Web application testing methodology | Secure design and remediation | Testing-focused AppSec |
| GIAC GWEB | GIAC; proctored, 3 hours; aligned with SANS SEC522 | Web application defense: input handling, XSS, SQL injection, authentication and sessions | Exploitation depth | Defensive AppSec, developers moving into security |
| GIAC GCSA | GIAC; proctored, 2 hours; aligned with SANS SEC540 | Cloud-native and DevSecOps security controls in CI/CD | Application code review | Platform security / DevSecOps |
| ISC2 CSSLP | ISC2; requires four years of work experience; eight secure software domains | Breadth across the secure software lifecycle | Hands-on skill | Product security, architect, program roles |
| ISC2 CISSP | ISC2; requires five years of work experience; eight domains | Broad security management knowledge | Application security depth | Leadership and architect roles; often a hiring filter |
| CompTIA PenTest+ | CompTIA; V3 (PT0-003); up to 90 multiple-choice and performance-based questions in 165 minutes | Testing process and tooling knowledge | Deep exploitation or code review | Entry-level testing |
| CompTIA Security+ | CompTIA; V7 (SY0-701) on 11 October 2026, with V8 (SY0-801) announced for on or around 17 November 2026 | Security fundamentals | AppSec-specific skill | Entry level; some government roles require it |
| Certified Kubernetes Security Specialist (CKS) | Linux Foundation with CNCF; 2-hour performance-based command-line exam; CKA first; valid 2 years | Practical Kubernetes hardening | Application code security | Platform security |
| AWS Certified Security - Specialty | AWS; 65 multiple-choice or multiple-response questions in 170 minutes; valid 3 years | AWS security services and design | Code review, other clouds | Cloud and platform security |

## How do AppSec interviews work, and how do you prepare?

Good AppSec interviews are practical: you read code, model a design, explain a fix and prioritize. Prepare with the guides linked below, out loud and against a clock, and write down your reasoning as you would in a ticket.

| Exercise | Example prompt | Prepare with |
| --- | --- | --- |
| Code review | Here is a 60-line handler; find the security bugs and propose fixes. | /domains/appsec/code-review/security-code-review/ and /fix/ |
| Threat modeling | Draw the data flows for a file-sharing feature and list the top threats. | /domains/appsec/threat-modeling/threat-modeling-methods/ and /domains/appsec/threat-modeling/threat-pattern-library/ |
| Explain a fix | A developer says parameterized queries are slower; respond. | /domains/appsec/secure-coding/sql-injection-python-sqlite3/ |
| Prioritize findings | Seven findings, one week: which first and why? | /frameworks/vulnerability-prioritization/ |
| Respond to a report | A researcher reports an IDOR on Friday evening; walk through your steps. | /domains/appsec/vulnerability-response/psirt-operating-model/ |
| Influence | A team keeps shipping the same bug; what do you change? | /frameworks/security-champions-program/ and /frameworks/developer-security-training/ |

## How do developers move into AppSec?



- Volunteer as your team's security champion; it is the most common route in, and the work is real AppSec work.
- Fix security findings in your own codebase and write up the root cause for your team.
- Learn one more language and one more stack than you use daily, through the fix cards in other stacks.
- Join design reviews with the AppSec team, and offer to write the threat model.
- Take one hands-on certification if your target employers value it, after you have a portfolio, not instead of one.

## How should hiring managers assess AppSec candidates?



- Use a work sample: a short code review and a design discussion, scored against a written rubric.
- Score explanation and collaboration as well as finding bugs; the job is getting fixes shipped.
- Treat certifications as signals of what the exam tested, not as requirements, unless a contract or regulation demands one.
- Value portfolio evidence such as merged fixes and write-ups over lists of tools.
- Use the skills matrix above for leveling, so offers and promotions use the same language.

## Guided practice

Sam, a fictional backend developer with four years of Python and Node.js experience, wants an AppSec engineer role within a year. Use the matrix, portfolio guidance and certification table to build a plan.

### Supplied material

```text
Sam (fictional):
- Work: Python and Node.js APIs; fixed two SQL injection findings last year; no threat modeling experience
- Has reviewed pull requests but rarely comments on security
- Budget allows one certification this year
- Target employers' job ads ask for: code review, threat modeling, CI security, "OSWE or BSCP preferred"
Self-assessment against the matrix (target mid): code review 2, vulnerability classes 2, threat modeling 0, tools 1, identity and crypto 1, cloud and CI/CD 1, vulnerability response 1, influence 2, program 0
```

### 1. Find the biggest gaps

Which skills are furthest from mid level?

Worked answer: Threat modeling (0 vs 2) and testing tools (1 vs 3) are two levels short. Code review, vulnerability classes, identity and cryptography, cloud and CI/CD, vulnerability response and program skills are one level short. Sam also has no recorded evidence for most skills.

### 2. Plan the portfolio

Choose three portfolio items that close those gaps and can be verified.

Worked answer: A public repository with the /labs/ projects fixed and CI running their tests; a threat model of an open-source API written with the threat modeling guide; and a write-up of the SQL injection fixes Sam already made, generalized with the fix cards for Python and Node.js.

### 3. Pick one certification

OSWE or BSCP for Sam, and why?

Worked answer: Either fits the ads. BSCP is a shorter hands-on web exam and needs Burp Suite Professional; OSWE is a 48-hour white-box exam with a report and matches Sam's code-reading strength. Choose by time and budget, after the portfolio is underway.

### 4. Build influence

How can Sam show influence before changing jobs?

Worked answer: Become the team's security champion, add security comments to reviews, and write one secure coding guideline the team adopts; record each as evidence in the matrix.

### 5. Prepare for interviews

Which two interview exercises should Sam rehearse first?

Worked answer: Code review of a short handler and threat modeling a feature, timed and out loud, using the security code review and threat modeling guides.

Deliverable: A 12-month plan for Sam: skills to raise with evidence, three portfolio items, one certification with a reason, and the interview exercises to rehearse.

Scope: Sam is fictional. Certification formats, prices and requirements change; check the issuer's current exam page before booking.

Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security.

## Sources

- [OffSec: PEN-200 and the OSCP/OSCP+ exam](https://www.offsec.com/courses/pen-200/)
- [OffSec: WEB-300 and the OSWE exam](https://www.offsec.com/courses/web-300/)
- [PortSwigger: Burp Suite Certified Practitioner](https://portswigger.net/web-security/certification)
- [PortSwigger: BSCP exam hints and guidance](https://portswigger.net/web-security/certification/exam-hints-and-guidance)
- [GIAC: Web Application Penetration Tester (GWAPT)](https://www.giac.org/certifications/web-application-penetration-tester-gwapt)
- [GIAC: Certified Web Application Defender (GWEB)](https://www.giac.org/certifications/certified-web-application-defender-gweb)
- [GIAC: Cloud Security Automation (GCSA)](https://www.giac.org/certifications/cloud-security-automation-gcsa)
- [ISC2: CSSLP](https://www.isc2.org/certifications/csslp)
- [ISC2: CISSP](https://www.isc2.org/certifications/cissp)
- [CompTIA: PenTest+](https://www.comptia.org/en-us/certifications/pentest/). V3 (PT0-003).
- [CompTIA: Security+ V8 (SY0-801), launch on or around 17 November 2026](https://www.comptia.org/en/certifications/security/v8/)
- [Linux Foundation: Certified Kubernetes Security Specialist (CKS)](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
- [AWS: Certified Security - Specialty](https://aws.amazon.com/certification/certified-security-specialty/)