Career Roadmap
Application Security Engineer: Zero to Hero
This roadmap guides you from security fundamentals to professional Application Security engineering. You will learn to embed security into the SDLC, perform secure code reviews, integrate SAST/DAST/SCA into pipelines, threat-model applications, and mentor developers. Security+ builds the foundation. Burp Suite Certified Practitioner validates web application testing. CSSLP validates secure SDLC expertise. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for Software Engineers transitioning into AppSec who already write code and understand web architecture, as well as Security Analysts moving into application security who need to understand development workflows. Additionally, it is tailored for DevOps Engineers building CI/CD pipelines who want to add security gates, as well as Security Architects designing secure systems who require hands-on credential validation.
Skills You'll Develop
Identify and remediate OWASP Top 10 vulnerabilities in code and APIs
Review pull requests for security flaws, data flow analysis, and trust boundaries
Integrate and tune static, dynamic, and dependency scanning tools in CI/CD pipelines
Apply STRIDE methodology to design secure systems before code is written
Embed security requirements, design reviews, and testing throughout the development lifecycle
Translate security findings into actionable fixes and build security champions
Target Roles in this Roadmap
- Application Security Engineer: Embeds security into the SDLC and reviews code for vulnerabilities
- DevSecOps Engineer: Integrates security tools and gates into CI/CD pipelines
- Secure Code Reviewer: Performs manual and automated code reviews for security flaws
- Security Architect (AppSec Focus): Designs secure systems and performs threat modeling
- Application Penetration Tester: Performs white-box and black-box testing of web applications
Typical Employer Categories
- Technology & Software Firms: Product security teams, internal platform security
- Financial Services: Banking, fintech, insurance, and payment processors
- Healthcare Organizations: HIPAA compliance, patient data protection, medical devices
- E-Commerce & Retail: Customer data protection, PCI compliance, API security
- Consulting & Professional Services: Security assessment firms, managed security providers
- Government & Defense: DoD, federal agencies, defense contractors
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| CompTIA Security+ (SY0-701) | Month 1-2 | Foundational security knowledge. Required for DoD/government roles and establishes core vocabulary. |
| Burp Suite Certified Practitioner | Month 4-6 | Most directly relevant single credential. Ties to the industry standard web security testing tool. |
| ISC2 CSSLP | Month 10-14 | Validates secure SDLC knowledge and distinguishes you as a senior AppSec engineer. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| OSWE (Offensive Security Web Expert) | Month 14-18 | Advanced white-box web exploitation. Only for engineers who want deep penetration testing specialization. |
| GIAC GWAPT | Month 14-18 | Alternative web app penetration testing credential. More accessible than OSWE but still practical. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level | Security+ + OWASP Top 10 fluency + basic SAST/DAST exposure | Month 4-5 |
| Practitioner Level | Burp Suite Certified Practitioner + secure code review + threat modeling basics | Month 8-9 |
| Specialist Level | CSSLP + SAST/DAST/SCA pipeline integration + developer mentoring ability | Month 14+ |
Step 0 - Foundations (Development, Security, and Web App Vulnerabilities)
Build the development and security foundation that every AppSec concept depends on. This is the most important step — the depth of your learning here determines everything that follows.
~3-4 months~3-4 months
Step 0 - Foundations (Development, Security, and Web App Vulnerabilities)
Build the development and security foundation that every AppSec concept depends on. This is the most important step — the depth of your learning here determines everything that follows.
- Python scripting, Bash, Git, and Docker fundamentals
- At least one language deeply (Java, Python, Go, or JavaScript/TypeScript)
- Web application architecture (HTTP, REST APIs, authentication flows, databases)
- OWASP Top 10 — each vulnerability, how it works, how to detect it, how to remediate it
- Security fundamentals (CIA triad, authentication vs authorization, least privilege)
- Cryptography basics (hashing, encryption, TLS, JWT)
- Common vulnerability types (SQL injection, XSS, CSRF, SSRF, IDOR)
Certifications
💡 Security+ is the most practical first credential. It establishes security vocabulary and satisfies DoD 8570/8140 requirements.
💡 OWASP Top 10 is the core knowledge for AppSec. Know what each vulnerability is, not just its name.
💡 If you come from a security background without development experience, invest extra time here.
🏁 Entry Level Checkpoint: You have passed Security+. You can explain all OWASP Top 10 vulnerabilities. You can read a pull request and understand what the code is doing.
🛠 Project Ideas
- ▸Deploy a deliberately vulnerable web app (like DVWA or WebGoat). Manually exploit each OWASP Top 10 vulnerability and write a remediation guide for each.
- ▸Write a Python script that fuzzes a login endpoint for SQL injection using a list of payloads.
Step 1 - Core AppSec Skills (SAST, DAST, SCA, Code Review, Threat Modeling)
Build the core AppSec skills that every role requires. This covers SAST, DAST, SCA, secure code review, and threat modeling — the tools and practices that appear in every AppSec job description.
~3-4 months~3-4 months
Step 1 - Core AppSec Skills (SAST, DAST, SCA, Code Review, Threat Modeling)
Build the core AppSec skills that every role requires. This covers SAST, DAST, SCA, secure code review, and threat modeling — the tools and practices that appear in every AppSec job description.
- SAST (Semgrep or CodeQL) — static analysis in CI/CD pipelines, rule tuning, false positive management
- SCA (Snyk or Trivy) — dependency vulnerability scanning, licensing issues, update strategies
- DAST (OWASP ZAP or Burp Suite) — dynamic testing in CI/CD pipelines, authentication handling
- Secret scanning (GitHub Advanced Security or TruffleHog) — detection and remediation
- Secure code review — data flow analysis, trust boundaries, common anti-patterns
- Threat modeling (STRIDE methodology, data flow diagrams, attack surface analysis)
- Triage and prioritization (exploitability vs theoretical findings, CVSS scoring)
💡 Burp Suite Certified Practitioner is the most directly relevant credential for AppSec engineers because it ties to the industry standard tool.
💡 This exam is a fully practical 120-minute assessment with live proctoring, not a multiple-choice exam. You are given a vulnerable web application and must demonstrate your ability to identify and exploit vulnerabilities in real time.
💡 Threat modeling is undervalued in AppSec preparation. The ability to identify threats before code is written distinguishes senior AppSec engineers.
💡 The most common AppSec mistake is treating every scanner finding as critical. Learn to prioritize based on exploitability and business context.
🏁 Practitioner Level Checkpoint: You have a CI/CD pipeline with SAST, SCA, and secret scanning integrated. You can review a pull request and identify security issues.
🛠 Project Ideas
- ▸Integrate Semgrep (SAST) and Snyk (SCA) into a GitHub Actions CI/CD pipeline. Set up quality gates that fail builds on critical findings.
- ▸Perform a threat model on a sample microservices architecture. Produce a data flow diagram and a STRIDE-based threat list.
Step 2 - Secure SDLC and Advanced AppSec
Embed security across the entire software development lifecycle. AppSec is as much about prevention as testing. This covers secure SDLC principles, pipeline security, and developer mentoring.
~2-3 months~2-3 months
Step 2 - Secure SDLC and Advanced AppSec
Embed security across the entire software development lifecycle. AppSec is as much about prevention as testing. This covers secure SDLC principles, pipeline security, and developer mentoring.
- Secure SDLC principles: security requirements, secure design, secure coding, security testing, deployment, and maintenance
- CI/CD pipeline security: security gates, severity thresholds, exception handling, auto-remediation
- Developer security training: building security champions, running threat modeling workshops
- Secure coding standards: OWASP ASVS, CERT standards, and language-specific guidelines
- Compliance frameworks: PCI DSS, HIPAA, GDPR implications for AppSec
- Incident response for AppSec: handling vulnerable dependencies, zero-days, and responsible disclosure
Certifications
💡 CSSLP (Certified Secure Software Lifecycle Professional) from ISC2 is the credential that signals SDLC orientation.
💡 CSSLP requires 4 years of SDLC experience (can be reduced with education). If you do not yet have the experience, study the material and plan to take it when you qualify.
💡 The secure SDLC mindset is the single biggest differentiator between junior and senior AppSec engineers.
🏁 Specialist Level Checkpoint 1: You have passed CSSLP. You can design a secure SDLC process and mentor developers on secure coding.
🛠 Project Ideas
- ▸Design a secure SDLC process for a fictional company. Include requirements gathering, design review, coding standards, testing gates, and monitoring.
- ▸Create a developer training module on secure coding for your language of choice. Deliver it to a peer group.
Step 3 - Exam Readiness, Portfolio, and Follow-On Paths
Consolidate preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exams. Build the portfolio that proves your AppSec capabilities.
~1 month~1 month
Step 3 - Exam Readiness, Portfolio, and Follow-On Paths
Consolidate preparation through integrated scenario practice, timed simulations, and targeted gap closure before booking your exams. Build the portfolio that proves your AppSec capabilities.
- Full-domain scenario practice across all AppSec domains (OWASP, SAST/DAST/SCA, threat modeling, SDLC)
- Timed simulations for Burp Suite Certified Practitioner and CSSLP
- Portfolio projects: secure code review reports, threat models, security pipeline configurations
- Follow-on paths: Security Architect (design focus), Application Penetration Tester (testing focus), or DevSecOps Engineer (pipeline focus)
Certifications
💡 Consistent performance above 80% on Legend mode across five or more consecutive ExamOS sessions is the clearest readiness signal for certification exams.
💡 Your portfolio matters more than any certification. Each project should produce a repository, a write-up, and a screenshot or diagram.
💡 OSWE is optional and extremely demanding. Only pursue if web penetration testing is a significant part of your role.
🏁 Specialist Level Checkpoint 2: You have passed your target certifications. You have a portfolio demonstrating secure code reviews, threat models, and pipeline security configurations.
Final Step - What this path actually builds
This roadmap moves you from security fundamentals to professional Application Security engineering. Security+ establishes your vocabulary. Burp Suite Certified Practitioner proves you can test web applications hands-on. CSSLP validates that you understand security across the entire development lifecycle. More importantly, you will have a portfolio of real work - code reviews, threat models, and pipeline configurations. AppSec engineers are the bridge between developers and security. The ones who succeed are those who can read code, spot vulnerabilities, explain the fix in a developer's terms, and present the business risk to a product manager. Build that fluency. Measure your readiness with ExamOS. Book when your reasoning is sharp and your portfolio is complete.
Final Step - What this path actually builds
This roadmap moves you from security fundamentals to professional Application Security engineering. Security+ establishes your vocabulary. Burp Suite Certified Practitioner proves you can test web applications hands-on. CSSLP validates that you understand security across the entire development lifecycle. More importantly, you will have a portfolio of real work - code reviews, threat models, and pipeline configurations. AppSec engineers are the bridge between developers and security. The ones who succeed are those who can read code, spot vulnerabilities, explain the fix in a developer's terms, and present the business risk to a product manager. Build that fluency. Measure your readiness with ExamOS. Book when your reasoning is sharp and your portfolio is complete.
Final Thoughts
💡 Total: 10-16 months at 2 hours/day (8-12 months at 3-4 hours/day)
💡 Security+: Typically takes 4-6 weeks for candidates with basic IT experience.
💡 Burp Suite Certified Practitioner: Requires 4-6 weeks of dedicated hands-on lab work after OWASP mastery.
💡 CSSLP: Preparation takes 8-12 weeks, but you must have 4 years of SDLC experience to sit the exam.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| Security+ only | ~1 month | ~2 months |
| Security+ + Burp Suite Certified Practitioner | ~4 months | ~6 months |
| Security+ + Burp Suite Certified Practitioner + CSSLP | ~8 months | ~14 months |
| Security+ + Burp Suite Certified Practitioner + CSSLP + OSWE | ~12 months | ~18 months |