Build the defenses
Application & Product Security
Find and prevent vulnerabilities in the software a company builds, side by side with its developers.
The job, briefly
Application security, often called AppSec or product security, keeps exploitable flaws out of the code an organization ships. AppSec engineers threat model new features, review code for security bugs, run and tune scanners, triage reports from bug bounty programs and penetration tests, secure the software supply chain and help developers fix what turns up. The job lives inside the development process, so working well with engineers matters as much as finding bugs.
Day to day
- Threat model new features with the teams building them: what data moves where, who can call what and how it could be abused
- Review pull requests and designs for injection, broken access control, authentication flaws and misused cryptography
- Run and tune static analysis, dependency scanning and dynamic testing so developers see real issues instead of floods of false alarms
- Triage bug bounty and pentest reports: reproduce each one, rate its severity and work with the owning team on the fix
- Secure the build pipeline and dependencies with signed artifacts, pinned versions, SBOMs and review of risky packages
- Teach developers through secure coding guidance, office hours and short sessions built on real bugs from your own codebase
Worked examples
Write up an access control finding
Reviewing a new invoices API, you notice that the endpoint returning one invoice checks that the caller is signed in but not that the invoice belongs to their organization. You confirm it in staging by fetching another test tenant's invoice, then write the finding: the endpoint, steps to reproduce, the impact (any customer can read any other customer's invoices by guessing IDs), a severity rating and the fix, an ownership check in the shared authorization layer rather than in this one handler. You add a regression test before closing it.
Threat model a file upload feature
A team wants users to upload documents to their profiles. In a short session you sketch the flow and ask the questions that matter: can someone upload an HTML or SVG file that runs script when viewed, what happens with a huge or malformed file, where are files stored and who can list them, and is an uploaded file name trusted anywhere? The outcome is a short list of requirements built in from the start: type checks, size limits, private storage with signed URLs and a separate domain for serving user content.
Make the scanner worth listening to
Developers ignore the static analysis tool because it reports hundreds of findings per repository. You sample the output, find two rules behind most of the noise, rewrite or disable them, add custom rules for the bug classes your bounty program actually receives and set the pipeline to block merges only on high-confidence results. Developers start fixing what it flags, because it is now usually right.
Who does well here
AppSec suits developers who are curious about how things break, and penetration testers who would rather fix vulnerabilities at the source than report the same ones again and again. You need to read code comfortably in your company's languages and to persuade developers without slowing them down. People who like teaching do well, because the biggest gains come from changing how a whole engineering team writes code.
Signs it suits you
- You have written production software and know how pull requests, reviews and releases really work
- You enjoy hunting for the input or edge case that makes code misbehave
- You can disagree with a developer about risk and keep a good working relationship
- You would rather remove a whole class of bugs with a library or a pattern than fix them one at a time
Requirements
- Development experience, or at least the ability to read and reason about code in common languages such as JavaScript or TypeScript, Python, Java, Go or C#
- A working knowledge of web vulnerabilities: the OWASP Top 10, how authentication and sessions work and how APIs are attacked
- Familiarity with Git, CI/CD pipelines and how your languages manage dependencies
Useful skills
A route in
- 1If you are a developer, become your team's security person: fix the scanner findings nobody wants, join incident reviews and volunteer for security-sensitive features
- 2Work through PortSwigger's free Web Security Academy, which covers every major web vulnerability class with hands-on labs
- 3Review open-source code and practise threat modeling on applications you know; a responsible disclosure or a CVE in your name is strong evidence
- 4Consider the Burp Suite Certified Practitioner, OSWE or GWAPT once the skills are there, though a portfolio counts for as much
- 5Use bug bounty programs to practise on real targets, strictly within each program's rules
- 6Apply for application security, product security and DevSecOps roles, ideally inside your own company first, where you already know the codebase
Myths and reality
Myth: AppSec means running a scanner and forwarding the results.
Reality: Scanners catch a slice of the problems, and their raw output mostly goes ignored. The value lies in judgment: knowing which findings matter, finding the logic and access control bugs no tool sees and fixing the patterns that produce whole classes of bugs.
Myth: You must be an elite hacker to work in AppSec.
Reality: Strong developers often make better AppSec engineers than pure testers, because they know how code is written, reviewed and released. Offensive skill helps, but the core is reading code carefully and helping a team fix it.
Myth: Security's job is to say no.
Reality: AppSec teams that block releases without offering a way forward get routed around. The effective ones provide secure defaults, shared libraries and paved roads, and keep hard stops for genuinely dangerous changes.
Salary
Salary ranges on open AppSec roles currently center on $171k–$346k/yr. The median sits at $218000, measured over the 118 openings that publish a range.
Questions career changers ask
Do I need to be a developer to get into application security?
Not strictly, but it is the most common background, and you will need to read code well. Testers who specialize in web applications also move across, as the offensive security guide describes. Either way, learn how real development teams operate: code review, CI pipelines, release schedules and the pressure behind them.
What is the difference between AppSec and penetration testing?
A web penetration tester examines an application from the outside for a fixed period and reports what they find. An AppSec engineer works inside the company across the whole life of the software: designs, code, pipelines, dependencies and the fixes. Testers find bugs; AppSec engineers also try to stop the next ones from being written.
What does DevSecOps mean in a job posting?
Usually a role centered on security in the delivery pipeline: wiring scanners into CI, securing build systems and secrets, managing dependency risk and making secure configuration the default. It overlaps heavily with AppSec and with cloud security, and the mix depends on the employer.
How much does software supply chain security matter now?
It has become a standard part of the job. Attacks through compromised packages and build systems pushed teams to track dependencies with SBOMs, pin and verify what they install, sign build artifacts and follow frameworks such as SLSA. Expect interview questions on it.
Neighboring paths
Penetration Testing & Red Team
Break into systems with written permission, then show the owners exactly how and what to fix.
Security Engineering
Design, build and run the security controls and tooling the rest of the company relies on.
Cloud Security
Put guardrails, identity policies and monitoring around workloads on AWS, Azure and Google Cloud.