Build an application security career: roles, skills, portfolio and certifications

Titles vary between companies, so read the job description for the work, not the name. Five tracks cover most roles; penetration testing and PSIRT work are close neighbors that share many skills.

Levels differ less in what you know than in scope and independence: an entry engineer finds and explains issues in one service with guidance, a senior engineer changes how several teams build, and a staff engineer changes the organization's defaults. The table is a starting point for a career ladder; adapt the wording to your company.

Score yourself honestly against a matrix, with one piece of evidence per skill, and let a script list the gaps and where to practise. The matrix below uses a 0 to 4 scale per skill and level, and points each skill at a page on this site. A sample self-assessment aiming at mid level reports gaps in code review, threat modeling and tools, and two skills with no evidence yet, which is often the more useful finding. Run it with python skill_gaps.py skills.yaml me.yaml.

# Skills matrix: expected level per skill for each career level (0 none, 1 aware, 2 working, 3 strong, 4 expert).
levels: [entry, mid, senior, staff]
skills:
  secure-code-review:      {entry: 2, mid: 3, senior: 3, staff: 4}
  vulnerability-classes:   {entry: 2, mid: 3, senior: 4, staff: 4}
  threat-modeling:         {entry: 1, mid: 2, senior: 3, staff: 4}
  security-testing-tools:  {entry: 2, mid: 3, senior: 3, staff: 3}
  identity-and-crypto:     {entry: 1, mid: 2, senior: 3, staff: 3}
  cloud-and-ci-cd:         {entry: 1, mid: 2, senior: 3, staff: 3}
  vulnerability-response:  {entry: 1, mid: 2, senior: 3, staff: 3}
  influence-and-writing:   {entry: 1, mid: 2, senior: 3, staff: 4}
  program-and-metrics:     {entry: 0, mid: 1, senior: 2, staff: 3}
# Where to practise each skill on softwaresecurity.com.
practice:
  secure-code-review: /domains/appsec/code-review/security-code-review/
  vulnerability-classes: /fix/
  threat-modeling: /domains/appsec/threat-modeling/threat-modeling-methods/
  security-testing-tools: /domains/appsec/testing/sast-dast-workflow/
  identity-and-crypto: /learn/identity-lifecycle/
  cloud-and-ci-cd: /learn/supply-chain-assurance/
  vulnerability-response: /domains/appsec/vulnerability-response/psirt-operating-model/
  influence-and-writing: /frameworks/security-champions-program/
  program-and-metrics: /frameworks/appsec-metrics-and-slas/

It compares each skill's self-assessed level with the target level's expectation and flags any skill without evidence, even when the level is met. Keep me.yaml in a private repository and update it each quarter; the history is a useful conversation with a manager.

"""Print the skills where a self-assessment falls short of a target level.

Usage: python skill_gaps.py skills.yaml me.yaml
"""
import sys

import yaml


def gaps(matrix, me):
    target = me["target"]
    for skill, expected in matrix["skills"].items():
        mine = me["self"].get(skill, {"level": 0, "evidence": ""})
        need = expected[target]
        if mine["level"] < need or not mine.get("evidence"):
            yield skill, mine["level"], need, bool(mine.get("evidence")), matrix["practice"].get(skill, "")


if __name__ == "__main__":
    matrix = yaml.safe_load(open(sys.argv[1], encoding="utf-8"))
    me = yaml.safe_load(open(sys.argv[2], encoding="utf-8"))
    print(f"Target level: {me['target']}")
    for skill, have, need, evidence, where in gaps(matrix, me):
        note = "" if evidence else " (no evidence yet)"
        print(f"{skill:24} have {have}, need {need}{note}  practise: {where}")

Hiring teams trust what they can check. A list of courses shows effort; a repository where a starter fails its security tests and your fix passes them shows skill. Build the portfolio from work that is public, authorized and verifiable.

• Labs and projects: fix the downloadable projects on /labs/ in a public repository with CI running their tests, and write a short note per project on the root cause and the fix.
• Fix cards: reproduce a fix card from /fix/ in a second stack and explain why the wrong fix fails.
• Learning paths: complete the path for your track, such as /learn/appsec-practitioner/ or /learn/supply-chain-assurance/, and keep notes.
• Threat models: model an open-source project's design using /domains/appsec/threat-modeling/threat-modeling-methods/ and share it with the maintainers if they want it.
• Code review and fixes: security fixes merged into open-source projects, with the maintainers' agreement, show you can work with owners.
• Vulnerability reports: report only within a published scope, through programs described in /domains/appsec/vulnerability-response/vdp-bug-bounty-pentest/, and publish only after coordinated disclosure.
• Writing: two or three clear write-ups of a weakness class, its variants and its fix in your languages.

Certifications answer different questions. Hands-on exams show you can do a defined task under time pressure; multiple-choice exams show breadth of knowledge; experience-gated credentials show time in the field. None shows that you can work with engineers to fix code, which is most of the job. The table lists common ones with details checked on the issuers' sites in October 2026; formats change, so re-check before booking.

Good AppSec interviews are practical: you read code, model a design, explain a fix and prioritize. Prepare with the guides linked below, out loud and against a clock, and write down your reasoning as you would in a ticket.

• Volunteer as your team's security champion; it is the most common route in, and the work is real AppSec work.
• Fix security findings in your own codebase and write up the root cause for your team.
• Learn one more language and one more stack than you use daily, through the fix cards in other stacks.
• Join design reviews with the AppSec team, and offer to write the threat model.
• Take one hands-on certification if your target employers value it, after you have a portfolio, not instead of one.

• Use a work sample: a short code review and a design discussion, scored against a written rubric.
• Score explanation and collaboration as well as finding bugs; the job is getting fixes shipped.
• Treat certifications as signals of what the exam tested, not as requirements, unless a contract or regulation demands one.
• Value portfolio evidence such as merged fixes and write-ups over lists of tools.
• Use the skills matrix above for leveling, so offers and promotions use the same language.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. OffSec: PEN-200 and the OSCP/OSCP+ exam
2. OffSec: WEB-300 and the OSWE exam
3. PortSwigger: Burp Suite Certified Practitioner
4. PortSwigger: BSCP exam hints and guidance
5. GIAC: Web Application Penetration Tester (GWAPT)
6. GIAC: Certified Web Application Defender (GWEB)
7. GIAC: Cloud Security Automation (GCSA)
8. ISC2: CSSLP
9. ISC2: CISSP
10. CompTIA: PenTest+. V3 (PT0-003).
11. CompTIA: Security+ V8 (SY0-801), launch on or around 17 November 2026
12. Linux Foundation: Certified Kubernetes Security Specialist (CKS)
13. AWS: Certified Security - Specialty

Reference information

Tags

AppSec programs

SDLC phase

Security program

Role

DevelopersAppSec engineersSecurity leaders

Download this guide as Markdown

Continue exploring