Skip to content
sec/atlas
all careers

careers

AppSec Engineer

Make the software your company ships hard to break, without slowing the people who write it.

An application security engineer finds and prevents vulnerabilities in the code and design of products, and builds the checks, guidance and habits that let developers fix them early. The job sits between security and engineering: half technical depth, half influence.

see this path on the journey map

A day in the job

  • Review designs and pull requests for security problems, and explain the fix instead of just blocking.
  • Run and tune SAST, SCA, DAST and secret scanning in the pipeline, keeping the noise low enough that developers trust them.
  • Triage findings by real risk, not by scanner severity, and track them to closure.
  • Threat-model new features with the team before the code exists.
  • Respond when something slips through: reproduce, assess impact, help ship the fix.
0 of 17 studiedNext topic: Shift-left

  1. Stage 1· Foundations

    Understand how software is delivered and where security fits.

    Study here

    Learn elsewhere

    • How the web works: HTTP, sessions, authentication and authorization
    • The OWASP Top 10 and one programming language you can read well
    • Git and a pull-request workflow

    Build this

    Add secret scanning and a pre-commit hook to one of your own repositories, and document what it catches.

  2. Stage 2· Practitioner

    Operate the core checks and judge their results.

    Study here

    Learn elsewhere

    • Reading code in the stack you protect
    • Manual testing with an intercepting proxy
    • Writing a clear, actionable vulnerability report

    Build this

    Run SAST, SCA and DAST against a deliberately vulnerable app, triage every finding and write up which ones are real.

  3. Stage 3· Advanced

    Run an application security program, not just tools.

    Study here

    Learn elsewhere

    • Secure design reviews on real systems
    • Vulnerability management metrics and prioritization
    • Teaching and influencing developers at scale

    Build this

    Design a pipeline gate policy (what blocks, what warns, what is exempt) and measure its false-positive rate over a month.

What to show

  • A write-up of a threat model for a small real system, with the mitigations you chose and why.
  • A pipeline repository showing SAST, SCA and secret scanning with tuned rules and a documented exception process.
  • A short guide for developers: the five vulnerability classes that matter most in your stack and how to avoid them.

Certifications (examples)

  • OSWE (OffSec)
  • CSSLP (ISC2)
  • GIAC GWEB

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles