Security QA: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Top-5: cloud, devsecops, ceh, analytical skills, web application security assessment. DAST (dynamic analysis — attack on running application): OWASP ZAP (free, open-source), Burp Suite (main working tool of security tester — proxy, scanner, manual attacks). SAST (static code analysis for vulnerable patterns): Semgrep (popular, simple rules), SonarQube, Checkmarx, CodeQL (GitHub). SCA (third-party library analysis for known vulnerabilities — CVE): Snyk, Dependabot, OWASP Dependency-Check, Trivy (also containers). Scanners and utilities: Nuclei (template checks), Nmap (network scanning), sqlmap (SQL injections), Postman / Burp for API security testing. DevSecOps: embedding SAST / DAST / SCA in CI/CD pipeline (shift-left). Knowledge more important than tools: OWASP Top 10 and API Security Top 10, OWASP ASVS / WSTG (testing methodology), understanding of web technologies and HTTP, basics of cryptography and authentication (OAuth / JWT / sessions), threat model. Useful scripting (Python) for check automation.

Three adjacent roles at the intersection of QA and security. Security QA — embeds regular security testing into development and release process: runs SAST / DAST / SCA, checks features for typical vulnerabilities (OWASP Top 10), logs security defects on par with functional. Works inside QA / SDLC, focus — not to miss known vulnerability classes in each release. Penetration Tester — conducts deep attack simulations: looks for ways to break in, exploitation chains, non-standard vectors; works in campaigns (per project / period), writes report with confirmed findings. Deeper, more creative, more expensive (see /research/security/pentest). AppSec Engineer (Application Security) — responsible for application security systematically: processes, policies, threat modeling, security architecture, developer training, tool selection and implementation, secure SDLC (see /research/security/appsec). Boundary: Security QA — "security as part of QA process"; Pentester — "deep break-in check"; AppSec — "building security of development overall". Career flow usually: QA → Security QA → AppSec Engineer or Penetration Tester. Security QA — the most accessible entry to this chain from testing.

OWASP (Open Worldwide Application Security Project) — non-profit community creating open materials on application security. OWASP Top 10 — regularly updated list of ten most critical categories of web application vulnerabilities: for example, broken access control, injections (including SQL injections and XSS), insecure configuration, vulnerable components, authentication errors, cryptographic failures and others. This is the basic "dictionary" of Security QA — what must be known and checked. There's also OWASP API Security Top 10 (for API), OWASP ASVS (security verification levels standard), OWASP WSTG (testing methodology). Shift-left security — the "shift to the left" principle: check security not at the end (before release or after), but as early as possible in the lifecycle — at the code and build stage. In practice this is DevSecOps: SAST / SCA scanning runs automatically in CI/CD on every commit, DAST — on test stand, vulnerabilities are caught before prod, when they're cheap to fix. Security QA precisely embeds these automatic checks into the pipeline — this is the core of modern approach to secure development 2026.

Three complementary types of automated security analysis. SAST (Static Application Security Testing) — static analysis of source code for vulnerable patterns, without running the application. Pros — catches problems early (at code stage), points to specific line. Cons — many false positives, doesn't see runtime and configuration problems. Tools: Semgrep, SonarQube, Checkmarx, CodeQL. DAST (Dynamic Application Security Testing) — dynamic analysis of running application from outside, as an attacker would do (sends malicious requests, watches reaction). Pros — finds real exploitable problems, sees runtime and configuration. Cons — needs deployed application, doesn't point to code line, covers only what it reached. Tools: OWASP ZAP, Burp Suite. SCA (Software Composition Analysis) — analysis of third-party dependencies (libraries, packages) for known published vulnerabilities (CVE). Critical because most of modern application code is other people's libraries. Tools: Snyk, Dependabot, Trivy, OWASP Dependency-Check. Why all three: they cover different layers — own code (SAST), application behavior (DAST), third-party code (SCA) — and none replaces the others. Mature Security QA / DevSecOps process integrates all three in CI/CD; manual check and pentest complement automation where it's blind (logical vulnerabilities, complex chains).

Yes, 0% of Security QA vacancies — remote or hybrid. Security testing well done remotely with access to test stands and tools (via VPN). Nuance — part of companies in financial and government sector prefer office or hybrid for security reasons. Russian banks, cybersecurity vendors and large products offer different formats. English — important: significant part of security materials (OWASP, reports, CVE, tool documentation) and international market — English. Security area overall — one of the most remote-friendly and at the same time highly-paid.

The best path to Security QA is through regular testing plus accumulating security knowledge (this is a convenient bridge from QA to the expensive security area). Roadmap: 1) QA base — test design, types of testing, bug reports (if not already working as tester). 2) Web technologies and HTTP — how requests / responses, headers, cookies, sessions, REST / API work; without this it's impossible to test security. 3) OWASP Top 10 — learn each category: what it is, how to find, how to defend; then OWASP API Security Top 10. 4) Practice on training grounds — OWASP Juice Shop, DVWA, PortSwigger Web Security Academy (free and excellent — teaches right on Burp Suite), TryHackMe, Hack The Box. 5) Burp Suite and OWASP ZAP — master as main tool (PortSwigger Academy is ideal for this). 6) SAST / DAST / SCA — understand the difference and try Semgrep, ZAP, Snyk. 7) DevSecOps — how security checks are embedded in CI/CD. 8) Basics of authentication and cryptography — OAuth, JWT, sessions, hashing. 9) Scripting — Python for automation. Resources: PortSwigger Web Security Academy (must, free), OWASP materials (Top 10, WSTG, Cheat Sheets), courses (Otus «Application Security», HackerU, profile programs), certifications (as orientation — eJPT for entry, further Burp Suite Certified Practitioner, OSCP — for moving into pentest). In Security QA resume practical findings and solved labs are valued, not only tool list.

2 active open jobs on security testing in Zorky CRM sample — narrow specialization. Real market is wider: security responsibilities are often embedded in vacancies «QA Engineer», «AppSec Engineer», «security testing specialist», «application security engineer» — search by exact term «Security QA» doesn't catch everything. Geography: Russia / remote / Poland. Sources: hh.ru, Habr Career, getmatch, LinkedIn (international segment), Telegram (security and QA channels, profile AppSec communities). Demand concentrates in fintech, cybersecurity, government sector and large products; in RF additionally grows due to regulator requirements and number of incidents. Time to fill Senior vacancy — 6-10 weeks (security expertise shortage). Shortage and regulatory pressure make the segment stably growing and well-paid.

Senior Security QA combines engineering discipline of testing with expertise in security. Vulnerabilities: deep knowledge of OWASP Top 10 and API Security Top 10 — not at the list level but understanding the mechanics of each (how it's exploited, how to find, how to defend), classes of logical vulnerabilities and access control problems. Tools: expert command of Burp Suite (including manual attacks, not only scanner) and OWASP ZAP; SAST / DAST / SCA (Semgrep, SonarQube, Snyk, Trivy) and, most importantly, ability to filter out false positives. Web and protocols: confident understanding of HTTP, REST / GraphQL, authentication and sessions (OAuth, JWT, SSO), basics of cryptography. DevSecOps: design and embedding of security checks in CI/CD (shift-left), security gates, work with vulnerabilities as managed flow. Threat modeling: basic threat modeling — understanding where the system's attack surface is and what to check first. Process: building security testing in SDLC, methodology (OWASP WSTG / ASVS), triage and prioritization of findings by real risk. Programming: code reading (for SAST results and vulnerability understanding), Python scripting for automation. Infrastructure: basics of networks, containers (Docker / Kubernetes) and clouds — attack surface is wider than application. Communication: ability to explain to developers the essence of vulnerability and risk, teach team secure coding, without alarmism prioritize. English — mandatory (OWASP, CVE, reports, international market). Senior Security QA effectively works at the intersection with AppSec — this is the natural next step of career.