Application Security Engineer
Application security engineers analyze the security of new or existing applications and software and report actionable results. Their work includes secure code review, security testing with static analysis and fuzzing tools, threat modeling during design, and risk analysis when an application goes through a major change.
Updated
What They Do
11 tasks- Test, review, and assess programs to find flaws in code and mitigate vulnerabilities.
- Conduct code reviews and apply coding and testing standards, using security testing tools such as fuzzers and static code analysis scanners.
- Conduct threat modeling and document the software attack surface, early in the development lifecycle where possible, such as during design.
- Integrate security requirements into application design, using the OWASP Application Security Verification Standard (ASVS) as a guide for setting them.
- Develop secure software testing and validation procedures, including use and abuse test cases.
- Analyze threats, vulnerabilities, and probability of occurrence whenever an application or system undergoes a major change.
- Give developers security tools such as static analysis, software composition analysis, secret, and infrastructure as code scanners, and teach them how to use the tools.
- Work with developers to decide what to fix from security bug reports, and set service level agreements for fixing security bugs.
- Gather information on potential vulnerabilities in the software and its third-party components, and investigate credible reports.
- Analyze identified vulnerabilities to determine their root causes, and record the lessons learned.
- Determine and document software patches or releases that would leave software vulnerable, and analyze patches and updates for vulnerabilities.
Knowledge and Skills
- Application security threats and vulnerabilities such as buffer overflow, cross-site scripting, injection, and race conditions
- The most critical web application security risks in the OWASP Top 10, such as broken access control, injection, and software supply chain failures
- Security requirements in the OWASP Application Security Verification Standard (ASVS), a basis for testing web application technical security controls
- Secure coding and secure programming tools and techniques
- Code analysis tools and security testing tools and techniques
- Software quality assurance and secure test plan design for unit, integration, system, and acceptance testing
- Secure software deployment methodologies and secure configuration management techniques
- The secure software development practices of the NIST Secure Software Development Framework (SSDF), SP 800-218
- Provenance data for software components, such as a software bill of materials (SBOM)
- Penetration testing principles, tools, and techniques
How to Become an Application Security Engineer
CISA's alternative titles for the Secure Software Assessor work role include information assurance software developer, information assurance software engineer, and secure software engineer. The work role's core competencies include software development, software testing and evaluation, and vulnerability assessment, and CISA asks applicants for the role to align the experience on their resumes with the listed competencies.
NIST SP 800-218 calls for role-based training for all personnel whose responsibilities contribute to secure development, with a training plan for each role. For threat modeling, it suggests training the development team, security champions in particular, or working with a risk modeling expert.
The OWASP Top 10 suggests a security champion program or a general security education program for developers. The OWASP Security Champions Guide recommends a continuous training and education program so that new joiners can grow into the security champion role, and suggests job titles or specialized roles to recognize champions.
ISC2 describes its CSSLP certification as meant for software development and security professionals who apply best practices to each phase of the software development lifecycle, and lists application security specialist among the positions it fits. The certification requires four years of work experience.
Certifications
7 certificationsThe DoD 8140 Qualification Matrix V3.0 lists 7 certifications as qualification options for DCWF work role 622 Secure Software Assessor, up to the proficiency level shown. Options aligned to a higher proficiency level also qualify for the lower levels.
| Certification | Issuer | DoD 8140 level |
|---|---|---|
| CISSP-ISSEP Information Systems Security Engineering Professional · ISC2 | ISC2 | Up to Advanced |
| CSC Cyber Secure Coder · Logical Operations, Inc. dba CERTNEXUS | Logical Operations, Inc. dba CERTNEXUS | Up to Intermediate |
| CSSLP Certified Secure Software Lifecycle Professional · ISC2 | ISC2 | Up to Intermediate |
| GCSA GIAC Cloud Security Automation · GIAC | GIAC | Up to Intermediate |
| GSEC GIAC Security Essentials · GIAC | GIAC | Up to Intermediate |
| Security+ CompTIA Security+ · CompTIA | CompTIA | Up to Intermediate |
| GCLD GIAC Cloud Security Essentials · GIAC | GIAC | Up to Basic |
Frequently Asked Questions
What does an application security engineer do?→
An application security engineer reviews and tests code to find and mitigate vulnerabilities, runs threat modeling during design, and sets security requirements for applications. The engineer also analyzes risk when an application changes, helps developers use security tools, and works with them to fix security bugs and find the root causes of vulnerabilities.
How do I become an application security engineer?→
CISA lists developer titles such as information assurance software developer and secure software engineer among the alternative titles for the Secure Software Assessor work role. NIST SP 800-218 calls for role-based training for people who contribute to secure development, and OWASP describes security champion programs that train developers in security.
What skills does an application security engineer need?→
CISA lists knowledge of application security threats and vulnerabilities such as cross-site scripting and injection, secure software deployment, and software quality assurance for this work role, along with skill in using code analysis tools and in secure test plan design.
Which DCWF work role covers application security?→
CISA lists application security analyst or engineer and application security tester among the alternative titles for the Secure Software Assessor work role, DCWF work role code 622. The work role analyzes the security of new or existing computer applications, software, or specialized utility programs and provides actionable results.
What certifications are there for application security engineers?→
ISC2 describes its CSSLP (Certified Secure Software Lifecycle Professional) certification as meant for software development and security professionals, including application security specialists. The certification requires four years of work experience.
What is threat modeling in application security?→
The OWASP Threat Modeling Cheat Sheet describes threat modeling as a structured, repeatable process that models a system from a security perspective, identifies the threats that apply to it, and determines responses to them. The cheat sheet places it early in the development lifecycle, such as during design, and says to maintain and update the threat model as the system changes.
Sources
- CISA: Secure Software Assessor work role
- NICCS: Secure Software Development NICE Framework work role
- NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1
- OWASP Top 10:2025
- OWASP Top 10:2025: Establishing a Modern Application Security Program
- OWASP Application Security Verification Standard
- OWASP Cheat Sheet Series: Threat Modeling
- OWASP Security Champions Guide: Invest in your champions
- OWASP Security Champions Guide: Anticipate personnel changes
- ISC2: CSSLP certification
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. Certification options come from the DoD 8140 Qualification Matrix V3.0 (2026-10-05); the matrix and a specific job posting are the authority for a given position. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense.