Career role

Application Security Engineer

Application Security Engineers secure software throughout the development lifecycle. You'll review code for vulnerabilities, implement secure coding practices, and work closely with developers to build security in from the start.

IntermediateAlso known as AppSec Engineer, Software Security Engineer

Plan my route to this role

Why choose this role?

Perfect blend of development and security. High demand as organizations realize they can't bolt on security after development. Excellent pay and the chance to prevent vulnerabilities at the source.

Work environment

Setting: Software companies, fintech, enterprises with large development teams
Schedule: Standard business hours aligned with development teams
Remote work: Highly flexible, many fully remote positions
Experience: Mid-level (3-6 years in development or security)

Education requirements

Bachelor's degree in Computer Science or Software Engineering preferred

Key responsibilities

Conduct secure code reviews
Perform application penetration testing
Implement security in SDLC (DevSecOps)
Develop security libraries and frameworks
Train developers on secure coding
Manage application security tools (SAST, DAST, SCA)

Required skills

Programming (Java, Python, JavaScript, C#)OWASP Top 10 and web vulnerabilitiesSecure coding practicesApplication security testing toolsUnderstanding of SDLC and Agile

Career path

Previous roles
Software Developer Security Engineer Penetration Tester
This role
Application Security Engineer
Time to next level: 3-5 years
Next roles
Senior AppSec EngineerAppSec ArchitectSecurity Engineering Manager

Certifications we recommend

Our editorial picks, based on what each exam covers. They don't show how often employers ask for a certification.

Entry1

CompTIA

Entry

CompTIA Security+

Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles

Exam: $439
Study: 3-6 months

Intermediate1

EC-Council

Intermediate

Certified Ethical Hacker

Tests recognition of attack techniques across nine domains in a 125-question exam, with an optional six-hour hands-on Practical leading to CEH Master

Exam: $950
Study: 4-6 months

Advanced1

OffSec

Advanced

OffSec Certified Professional

Proctored 24-hour practical with an Active Directory set; passing now awards lifetime OSCP plus a three-year OSCP+

Exam: $1,699
Study: 3-6 months

Expert1

ISC2

Expert

Certified Information Systems Security Professional

Proves five years of security experience across eight broad domains, endorsed by a peer and tested on an adaptive exam of up to 150 items

Exam: $749
Study: 6-12 months

Annual pay

10th percentile: $75k
Median: $129k
90th percentile: $200k

Information Security Analysts (SOC 15-1212)

BLS doesn't publish figures for application security engineers on their own, and O*NET classes information security engineers under computer occupations, all other. These figures cover information security analysts, the closest security occupation BLS reports on its own.

Source: U.S. Bureau of Labor Statistics, Information Security Analysts: Occupational Outlook Handbook (Pay) (May 2025, United States). Retrieved 2026-10-18.

Occupation outlook

Projected growth (2025–35): 21%
Projected openings per year: 14,100

Information Security Analysts (SOC 15-1212)

Source: U.S. Bureau of Labor Statistics, Table 1.2 Occupational projections, 2025–35, and worker characteristics, 2025 (2025–35, United States). Retrieved 2026-10-18.