Application Security Engineer

AppSec Engineers embed with engineering teams to ship secure software: threat modelling, secure code review, SAST/DAST/SCA tooling, security champions programme, and vulnerability response. The role is the highest-leverage way to scale security across an engineering org. ## Career milestones ### Year 0 — Software Engineer with security interest _Salary: £50k–£70k_ Production engineering experience in at least one stack. ### Year 1–2 — Application Security Engineer _Salary: £70k–£95k_ Threat model new services, review high-risk PRs, tune SAST, run security champions. ### Year 3–5 — Senior AppSec Engineer _Salary: £95k–£130k_ Own appsec programme, build paved-road libraries, lead vuln response, present at internal eng all-hands. ### Year 5+ — Staff / Principal AppSec Engineer _Salary: £130k–£180k+_ Set product security strategy, own bug bounty, represent firm at OWASP/BSides, mentor senior engineers. ## Core skills - OWASP Top 10 + ASVS fluency - Threat modelling (STRIDE, attack trees) - Secure code review in 2+ languages (Python, JS/TS, Go, Java, Rust) - SAST (Semgrep, CodeQL), DAST (Burp Suite Pro), SCA (Snyk, Dependabot) - Authentication and session management (OAuth 2.0, OIDC, JWT pitfalls) - Bug bounty triage and CVSS scoring - Security champions programme design - Developer empathy and code-as-comms ## Recommended certifications - `security-plus` - `oscp` ## First 90 days in the role Ship a Semgrep ruleset with 5–10 high-signal rules for your most-used framework. Threat-model one new high-risk service and present findings to its team. Identify 3 engineering leads who will become your first security champions. ## Common pitfalls Becoming the 'no' team. AppSec engineers who block PRs without offering an alternative get routed around. Build paved roads — secure-by-default libraries, copy-paste examples, and 1:1 office hours.