Domain

Software Security

Software Security builds security into applications from the start. You'll secure the software development lifecycle, perform code reviews, and implement DevSecOps practices. This domain bridges development and security, ensuring applications are born secure rather than bolted on later.

SS9 certifications

Why SS matters

Software vulnerabilities are the leading cause of breaches. Shifting security left catches issues early when they're cheaper to fix. DevSecOps professionals bridge the gap between development velocity and security requirements. You'll be embedded in product teams, making security a feature, not a blocker.

Key areas

Secure coding practices
Application security testing (SAST, DAST)
DevSecOps implementation
Container and API security
Threat modeling
Secure SDLC design

Career path in SS

Entry level
Start as Junior AppSec Engineer, learning secure development practices
Mid level
Progress to Application Security Engineer, leading security testing
Senior level
Advance to Product Security Lead, building AppSec programs

Essential skills

Secure coding (OWASP Top 10)Code review and SAST toolsCI/CD security integrationContainer securityAPI security

Typical roles

Application Security Engineer DevSecOps EngineerSecurity ChampionProduct Security Engineer

Pay and outlook for these roles

US figures from the Bureau of Labor Statistics for the closest BLS occupation to each role. BLS doesn't report pay by specialty and counts most of these roles only within a wider occupation, so each card covers every job in it.

Information Security Analysts
SOC 15-1212
Median annual pay
$129k
10th to 90th percentile
$75k to $200k
Projected growth (2025–35)
21%
Projected openings per year
14,100
Closest occupation for
- Cloud Security Engineer
- Application Security Engineer
These figures cover the whole occupation. Each role page says how closely the role matches it.
Source: U.S. Bureau of Labor Statistics, Information Security Analysts: Occupational Outlook Handbook (Pay) (May 2025, United States). Retrieved 2026-10-18.
Source: U.S. Bureau of Labor Statistics, Table 1.2 Occupational projections, 2025–35, and worker characteristics, 2025 (2025–35, United States). Retrieved 2026-10-18.

Certifications for SS

Intermediate4

EC-Council

Intermediate

Certified Application Security Engineer - Java

Tests secure Java development across the whole lifecycle, from abuse cases and threat modeling to Spring Security, error handling and Tomcat hardening

Exam: $450
Study: 3-5 months