AppSec: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Junior — typical entry: 1) Backend Senior + interest in security (programming depth already present, need security techniques), 2) Security Engineer Middle + interest in code-deep work, 3) Bug bounty hunter with track record (HackerOne reputation / private programs experience) → in-house AppSec. Junior → Middle jump — after the first end-to-end secure SDLC integration (SAST + SCA + threat model done for one product) + first high-severity finding triage. Middle → Senior — multi-product AppSec ownership + bug bounty program management + AppSec metrics ownership (typical mandate: reduce mean-time-to-remediate Critical findings to <7d). Senior → Staff / Principal / AppSec Architect — org-wide secure design patterns + security reference architectures + product security training development. Career flow: Backend Senior (3-5 years) + interest → AppSec Junior (1-2 years) → Middle (2-3 years) → Senior → either AppSec Architect, Bug Bounty / Security Researcher, API Security specialist, CISO Product Security track, or external security consultancy.

Top 5: ci/cd, cloud, python, aws, llm. SAST mastery: Semgrep mastery (rising 2026 — fast + custom rules in YAML + community rule packs — leader for new projects), SonarQube / SonarCloud (mature — code quality + security hybrid), CodeQL (GitHub Advanced Security — best for GitHub-native shops, semantic query language), Checkmarx + Veracode + Synopsys Coverity (enterprise). Russian: Positive Technologies PT Application Inspector. DAST mastery: OWASP ZAP (free standard — automation-friendly via ZAP API / Docker), Burp Suite Professional (PortSwigger — industry standard for manual pentesting + Burp Collaborator for blind vulnerabilities + Burp Extensions), Acunetix, StackHawk (modern DAST in CI), Detectify, Bright Security. SCA mastery: Snyk dominates 2026 (best UX + IDE plugins + auto-PR fixes), Dependabot (GitHub free baseline), Renovate (advanced — better for monorepos), Sonatype Nexus IQ, FOSSA (license compliance), JFrog Xray. IAST: Contrast Security (leader — runtime instrumentation, agent-based), HCL AppScan, Veracode IAST. API Security (rising 2024+): Salt Security (API discovery + posture leader), Noname Security, 42Crunch (OpenAPI-first — best for design-first approach), Traceable, Wallarm (Russian-origin + global), Cequence. OWASP API Security Top 10 framework knowledge. Threat Modelling tools: Microsoft Threat Modeling Tool (free desktop), OWASP Threat Dragon (open-source), IriusRisk (enterprise automation), Tutamen. STRIDE methodology (Microsoft — Spoofing / Tampering / Repudiation / Information Disclosure / Denial of Service / Elevation of Privilege) + PASTA (process-driven 7 stages) + LINDDUN (privacy-focused) + Attack Trees. Bug Bounty platforms: HackerOne (largest), Bugcrowd, Intigriti (European leader), YesWeHack (French), Synack (vetted premium). Russian: Standoff Bug Bounty (PT — largest in Russia), Bug Bounty Russia. RASP: Contrast Protect, Imperva RASP, Signal Sciences. WAF: Cloudflare WAF (dominates 2026), AWS WAF, Imperva, Fortinet FortiWeb, F5 Advanced WAF, Akamai App & API Protector. Russian: Wallarm + Kaspersky DDoS + Qrator. Crypto review tools: testssl.sh + Qualys SSL Labs + cryptosense. Auth / Authz: OAuth 2.1 + OIDC + SAML deep, JWT pitfalls deep (alg=none + key confusion + signature stripping + expired tokens), session management, OWASP ASVS. Language-specific vulnerability knowledge: Java (Log4Shell + JNDI + deserialization),.NET (BinaryFormatter + ViewState), Python (pickle + YAML + subprocess injection), JavaScript / TypeScript (prototype pollution + XSS context-aware encoding + npm supply chain), Go (path traversal + SSRF + TOCTOU), Rust (unsafe blocks audit), C / C++ (memory safety vulnerabilities). Languages for tooling: Python primary, JS / TS, plus reading knowledge of all target languages.

Security Engineer (general) — broad coverage of all security domains. Focus: SIEM operations + vulnerability mgmt + identity + network + compliance. See Security Engineer (general). DevSecOps Engineer — focus on security in CI/CD pipelines + IaC security + container runtime + supply chain integrity. Infrastructure-side. Programming-heavy for automation. See DevSecOps. AppSec Engineer (this page) — focus on product code security: SAST findings triage, threat modelling for features, security code review, secure design patterns, bug bounty triage, security training for developers, API security. Code-side (vs infra-side). Programming-deeper due to multiple languages requirement. Pentester / Ethical Hacker — focus on offensive — break things, find vulnerabilities through active exploitation. See Penetration Tester / Red Team. Often consultancy-based or in bug bounty. Reality 2026 (overlap heatmap): AppSec ↔ DevSecOps: 50% (both use SAST/SCA but focus differs). AppSec ↔ Pentester: 40% (both think offensively, but Pentester active exploitation + AppSec preventive). AppSec ↔ Security Engineer: 30% (AppSec deep in one domain, Security Engineer breadth). Career pivots: Backend Senior → AppSec Junior — 4-8 months (programming depth already there). Pentester / Bug Hunter → AppSec — 2-4 months (offensive intuition translates). DevSecOps Senior → AppSec — 2-4 months (security knowledge overlap). AppSec Senior → Product Security Architect — 2-4 years. Which company sizes use which role: Small startups — one person = everything (hybrid Security Engineer / DevSecOps / AppSec). Medium (50-500 engineers) — separate roles. Big Tech (engineers) — Product Security team (synonyms: AppSec / Product Security) is a separate organisation from Corporate Security.

Reference secure SDLC pipeline 2026 (security integrated into every stage of the software development lifecycle): 1) Security training (continuous) — developers go through OWASP Top 10 + secure coding workshops + language-specific vulnerability training. Tools: SecureFlag, Codebashing (Checkmarx), Avatao (interactive training). Mandate: annual refresh + onboarding includes 4+ hour security module. 2) Threat modelling (per new feature / major change) — STRIDE methodology session with product / engineering / AppSec. Document attack surface + mitigations. Tools: Microsoft Threat Modeling Tool / OWASP Threat Dragon / IriusRisk (enterprise automation). Output: threat model document attached to the design doc. 3) Secure design review — AppSec reviewer signs off on architecture decisions affecting security (auth flows, data handling, third-party integrations, crypto choices). 4) Pre-commit hooks — local Git hooks with secrets scanning (GitLeaks / TruffleHog) + IDE plugins (Semgrep / SonarLint / Snyk extensions flag vulnerabilities live). Reject commits with leaked secrets. 5) PR / MR creation — automated checks: SAST (Semgrep + CodeQL + SonarQube), SCA (Snyk + Dependabot — flag dependency vulnerabilities + auto-PR fix bumps), IaC security (Checkov), secrets scanning. PR blocks on critical findings. 6) Code review — security-flagged PRs automatically tag AppSec team. Manual security code review for features touching auth / crypto / data handling. 7) Merge to main — full security scan suite in CI: deeper SAST (longer running), DAST staging environment scans (OWASP ZAP / StackHawk against staging API + UI), IAST (Contrast Security runtime if installed), license compliance scan (FOSSA / Snyk License Compliance). 8) Pre-release pentest (for major features) — internal AppSec team or external pentest engagement. Standard pentest = 5-15 day engagement. 9) Bug bounty program — public or private program on HackerOne / Bugcrowd / Intigriti / Standoff (Russian). Triage incoming reports — typical SLA: initial response 24h, validation 5d, fix 30-90d depending on severity. 10) Post-release continuous — runtime monitoring (RASP — Contrast Protect), API security monitoring (Salt / Noname / 42Crunch), WAF log analysis (Cloudflare / AWS WAF), security metrics dashboard (mean-time-to-remediate per severity, AppSec posture score, % of features through secure design review). Cross-cutting: AppSec metrics tracked: MTTR (mean-time-to-remediate) for vulnerabilities, % of high-severity findings closed within SLA, security debt over time, OWASP SAMM / BSIMM maturity score, vulnerability density per KLOC. Compliance reporting: automated evidence collection for SOC 2 / ISO 27001 / PCI-DSS audits (Drata / Vanta / Secureframe). Senior AppSec owns this entire pipeline + tuning false-positive rates + balancing security vs developer velocity.

Yes, 46% of AppSec Engineer jobs are full-remote or hybrid. AppSec work is primarily code review + SaaS security tools + remote collaboration with engineering teams. Outsourcing shops — almost always remote on US AppSec projects. Russian banks + product companies — hybrid or remote after probation + security background check. Russian security vendors — hybrid or remote after background check. State companies — hybrid/office due to security clearances. Big Tech Product Security — hybrid-standard. Relocant hubs: Poland (security-friendly EU) / Germany / Canada / Serbia. English for international AppSec remote — must (security community / OWASP / Defcon / Black Hat / vendor docs Snyk / Veracode — English-speaking).

AppSec Engineer and Product Security Engineer are almost synonymous terms. Historical difference: AppSec Engineer is the broader term (any company), focused on security in the application layer. Same responsibilities (code review + threat modelling + secure design + bug bounty triage), but typically embedded in the product team (vs centralised AppSec team). At Meta, Product Security Engineer roles are premium-tier salary + RSU due to scale (billions of users impacted by a single security decision). Career choice: AppSec Engineer (general) if you want mid-sized companies + broader scope, Product Security Engineer (Big Tech specific) if you want Big Tech salary tier + impact on a mass user base + long hiring funnel. Bug Bounty Triager / Security Researcher (internal) — sub-specialty of Product Security focused on managing incoming bug bounty reports (triaging severity + reproducibility + fixing + paying bounties). Often a standalone role at companies with an active bug bounty (HackerOne reputation top-100).

Roadmap: 1) Backend Senior programming — without programming depth there is no AppSec. Minimum one language deeply (Python / Java / Go /.NET / JavaScript) + reading knowledge of 2-3 more. This is the foundation. 2) OWASP Top 10 mastery — read the official OWASP Top 10 (free PDF) + reproduce vulnerabilities in a local lab (DVWA + WebGoat + Juice Shop — all free). "The Web Application Hacker's Handbook" Stuttard / Pinto (canonical AppSec book — must-read). 3) OWASP ASVS (Application Security Verification Standard) — comprehensive checklist, read as reference. 4) Burp Suite mastery — PortSwigger Web Security Academy (free — best practical AppSec training 2026, must-do all labs). Get PortSwigger BSCP (Burp Suite Certified Practitioner) — premium AppSec cert. 5) SAST hands-on — Semgrep mastery (write custom rules in YAML for your own codebase patterns + run on open-source projects). CodeQL learning (GitHub Advanced Security — free for open-source repos). 6) SCA hands-on — Snyk free tier + Dependabot setup for your own GitHub project. Understand CVE / CVSS / EPSS prioritisation. 7) Threat modelling practice — STRIDE methodology + Microsoft Threat Modeling Tool. Apply to a pet project. Book: "Threat Modeling: Designing for Security" Adam Shostack (must-read for serious AppSec). 8) Bug bounty hands-on — register HackerOne / Bugcrowd / Intigriti / Standoff (Russian) account. Start with public programs + low-hanging fruit (CSRF + XSS + SSRF + IDOR on startup targets). Even small bounties build resume. 9) API Security (rising 2024+) — OWASP API Security Top 10 + 42Crunch labs (free). Practice API attacks via Burp + Postman. 10) Cryptography for developers — common pitfalls (alg=none JWT + ECB mode + insecure random + key reuse + length-extension attacks). Book: "Practical Cryptography for Developers" Nakov (free online). 11) Language-specific vulnerability deep dives — pick your chosen language + study its specific vulnerabilities (Java deserialization / Python pickle / Node.js prototype pollution / Go path traversal). 12) Offensive certs (highly recommended for AppSec credibility): OSCP (Offensive Security Certified Professional — broad offensive) → OSWE (Offensive Security Web Expert — AppSec-focused — premium for AppSec roles) → OSCE (advanced exploitation). 13) Pet project portfolio: a) full secure SDLC pipeline (12 stages) for your own project — document as portfolio; b) Semgrep custom rule pack for a specific vulnerability class; c) threat model document for a realistic web application; d) bug bounty reputation (HackerOne ≥50 reputation points via valid findings). International (EN): PortSwigger Web Security Academy (free — best resource 2026, must-do), SANS SEC542 Web App Penetration Testing (premium), "Real-World Bug Hunting" Peter Yaworski (canonical bug bounty book), "Web Application Security" Andrew Hoffman (O'Reilly 2020). Must-read books: "The Web Application Hacker's Handbook" Stuttard / Pinto (canonical despite age 2011), "Threat Modeling" Adam Shostack, "Real-World Cryptography" David Wong. Backend Senior + 6 months focused AppSec training + bug bounty findings → AppSec Junior. Backend Senior + 2-3 years AppSec → Middle. Total 3-5 years for Senior AppSec.

627 active open AppSec Engineer positions. Geography: Russia / Poland / remote. The real market is broader thanks to the international remote segment (Snyk / Veracode / Checkmarx / Synopsys / GitHub Advanced Security / HackerOne / Bugcrowd / Contrast Security — full-remote-friendly) + Big Tech Product Security. Time to close a Senior AppSec — 6-12 weeks (longer than general Security Engineer due to rare-skill combination — programming depth + multiple languages + security mindset + threat modelling experience).

A Senior AppSec Engineer owns the full application security cycle + technical leadership. Backend Senior level programming: one language deeply (Python / Java / Go /.NET / TypeScript) + reading knowledge of the others. Must understand language-specific vulnerability classes deeply. SAST mastery: Semgrep custom rule authoring (deep — write business-logic-specific security rules in YAML), CodeQL queries (semantic analysis — premium for GitHub-native shops), SonarQube custom rules. Tune false-positive rates (typical mandate: <10% false-positive ratio). DAST mastery: Burp Suite Professional advanced (Burp Extensions authoring + Burp Collaborator for blind vulnerabilities + Burp Intruder advanced + Macros for authenticated scanning), OWASP ZAP automation in CI. SCA mastery: Snyk integration tuning, dependency vulnerability prioritisation (CVSS + EPSS + exploitability score + actual usage analysis), license compliance handling. Threat modelling mastery: STRIDE methodology — lead sessions for major features, PASTA (process-driven) for critical systems, attack tree authoring, attack surface analysis. Secure design mastery: review architecture decisions affecting security (auth flows + crypto choices + data handling + third-party integrations), OWASP ASVS-based design review checklist. Auth / Authz deep: OAuth 2.1 + OIDC + SAML advanced (PKCE + token rotation + audience validation + RP-Initiated Logout), JWT pitfalls deep (alg=none + key confusion + JWS / JWE differences + signature stripping), session management patterns (HTTPOnly + SameSite + CSRF tokens + token binding). Cryptography review: TLS configuration review (cipher suite selection + perfect forward secrecy + certificate management), applied cryptography (proper random + symmetric vs asymmetric usage + key management + HSM integration). API Security mastery: OWASP API Security Top 10 — broken object level authorization (BOLA), broken authentication, excessive data exposure, lack of rate limiting, etc. Salt / Noname / 42Crunch integration patterns. Bug bounty program management: triage methodology (severity + reproducibility + impact assessment), researcher relationship management, public communication, payout decisions, CVE coordination. Vulnerability disclosure: design CVD programs, CVE assignment process (CNA role if applicable), advisory writing for customers. AppSec metrics ownership: MTTR per severity automation, AppSec posture scoring, OWASP SAMM / BSIMM maturity benchmarking, executive reporting to CISO. Compliance frameworks: SOC 2 + ISO 27001 + PCI-DSS audit support, automated evidence collection. Offensive security exposure: OSCP / OSWE / OSCE certifications strongly recommended — understanding the attacker perspective makes for a better defender. Programming for tooling: Python deep for custom security automation + linters / scanners development. System design for security: design secure architectures on the whiteboard, threat-model on feature design reviews, design Zero Trust application architecture. Soft: ADRs writing for security decisions, security training development for engineers (workshops + onboarding + AppSec book club), code review for security findings, executive communication (vulnerability reports to leadership), mentoring Middle AppSec engineers. English for Senior+ MUST — AppSec community / OWASP / Defcon / Black Hat / vendor docs are entirely English-speaking. Optional bonus: published CVEs (CVE owner — premium for frontier AppSec hiring), bug bounty reputation (HackerOne top-100 reputation), conference talks (DEF CON AppSec Village / OWASP AppSec / Black Hat), open-source contributions to security tools (Semgrep rules / OWASP ZAP / Snyk plugins) — sharply increase market value for Big Tech Product Security + premium security vendor hiring.