Roadmaps Security roadmaps Core domains
Application and Software Security
Find and fix security flaws in the software people build, and help developers write code that is secure from the start.
Estimated time: 25–43 months · At about 10 hours a week.
- BeginnerWeb vulnerabilities and how to find them3–4 months
- IntermediateSecure code, APIs and automated testing4–6 months
- AdvancedSoftware supply chain and AppSec at scale6–9 months
- ExpertProduct security leadership and research12–24 months
Offensive skills are for authorised testing only: your own lab, a practice platform, or a system whose owner has given you written permission. Testing anything else is a crime in most countries.
Overview
Application security (AppSec) is about the security of software itself: web and mobile apps, APIs, and the libraries and services they depend on. It covers finding vulnerabilities (testing and code review), preventing them (secure design, safe frameworks, developer training) and managing them across hundreds of applications.
Modern AppSec works inside the development process. Security engineers threat model new features, add automated checks to pipelines, review risky code, and help developers fix issues quickly, rather than testing once just before release.
Why it matters
Applications are what an organisation exposes to the internet, and flaws in them, such as broken access control, injection and vulnerable dependencies, are a leading cause of breaches. Fixing a flaw in design costs far less than fixing it after an attack.
Typical job roles
- EntryJunior application security engineer / AppSec analyst Triages scanner findings and helps developers fix them.
- Mid-levelApplication security engineer Threat models, reviews code, tests apps and runs AppSec tooling.
- Mid-levelWeb application penetration tester Tests web apps and APIs, with permission, and writes reports.
- SeniorProduct security engineer Owns the security of a product line, working inside engineering teams.
- SeniorApplication security architect Sets secure design patterns, standards and reference architectures.
- LeadHead of application or product security Runs the AppSec programme across the organisation.
Prerequisites
- Programming in at least one language used for web apps, such as Python, JavaScript or Java, well enough to build a small app.
- How the web works: HTTP methods, headers, cookies, sessions, same-origin policy.
- Basic databases and SQL.
- Git and a basic understanding of how software is built and deployed.
Learning path
Show
-
Beginner Web vulnerabilities and how to find them 3–4 months
Topics
Skills
- Use Burp Suite or ZAP to intercept, change and replay requests.
- Find and exploit the common OWASP Top 10 flaws in practice apps.
- Explain the root cause and the right fix for each flaw, not just the exploit.
Hands-on projects and labs
- Work through the Apprentice and Practitioner labs in the PortSwigger Web Security Academy.
- Run OWASP Juice Shop and DVWA locally in Docker and solve their challenges.
- Build a small web app yourself, then attack it and fix each flaw you find.
Done when you can…
- Find and explain SQL injection, XSS and an access control flaw in an app you have not seen before (a practice app).
- Explain the fix for each OWASP Top 10 category in the language you code in.
-
Intermediate Secure code, APIs and automated testing 4–6 months
Topics
Skills
- Review code for security flaws, starting from where user input enters.
- Run and tune SAST, SCA and secrets scanning in a CI pipeline, and cut the false positives.
- Test REST and GraphQL APIs for broken object-level authorisation and other API risks.
- Threat model a feature with STRIDE or a data flow diagram.
Hands-on projects and labs
- Add Semgrep, Trivy or OSV-Scanner, and gitleaks to a GitHub Actions pipeline for one of your own projects, and fix what they find.
- Run OWASP crAPI and find the API Top 10 issues in it.
- Threat model a sample app with OWASP Threat Dragon and turn the threats into tests.
Done when you can…
- Review a pull request and write security comments a developer can act on.
- Show a pipeline that blocks a build with a known-vulnerable dependency or a committed secret.
- Present a threat model for a login and payment flow.
-
Advanced Software supply chain and AppSec at scale 6–9 months
Topics
Skills
- Write custom rules that catch the bugs your codebase actually has.
- Generate SBOMs, sign builds, and verify provenance before deployment.
- Prioritise application vulnerabilities by real risk, not just CVSS.
- Train and support developers so security scales beyond your team.
Hands-on projects and labs
- Write CodeQL or Semgrep rules for a vulnerability class you found earlier, and run them on open-source projects you are allowed to test.
- Sign a container image with cosign in your pipeline and reject unsigned images at deploy time.
- Do the Expert labs in the Web Security Academy on request smuggling and race conditions.
Done when you can…
- Show custom rules that found real issues, with low false positives.
- Show a build pipeline that produces a signed artefact with an SBOM and provenance.
- Run a security champions session for developers and collect their feedback.
-
Expert Product security leadership and research 12–24 months
Topics
Skills
- Design and measure an AppSec programme for many teams and products.
- Find new classes of vulnerabilities and report them responsibly.
- Influence engineering leadership on architecture and priorities.
Hands-on projects and labs
- Assess a real or fictional organisation against OWASP SAMM and write a two-year improvement plan.
- Report a vulnerability to an open-source project or a bug bounty programme through its official disclosure process.
Done when you can…
- Show measurable improvement in an AppSec programme, such as fix times or vulnerabilities per release.
- Have a disclosed vulnerability, a published tool or a conference talk to your name.
Tools and technologies
- Burp Suite Community Edition The standard intercepting proxy for testing web apps. The Professional edition is paid.
- ZAP Open-source web app scanner and intercepting proxy.
- Semgrep Community Edition Fast static analysis with rules that look like code.
- CodeQL GitHub's code analysis engine; free for open-source projects.
- OSV-Scanner Finds known vulnerabilities in your dependencies.
- Trivy Scans code, containers and IaC for vulnerabilities and secrets.
- OWASP Dependency-Check Software composition analysis for known-vulnerable libraries.
- gitleaks Finds secrets committed to Git repositories.
- OWASP Threat Dragon Threat modeling diagrams and reports.
- Sigstore (cosign) Signs and verifies software artefacts.
- OpenSSF Scorecard Checks the security practices of open-source projects you depend on.
- DefectDojo Collects and tracks findings from all your security tools.
- sqlmap Automates finding SQL injection. Only use it on apps you may test.
Certifications
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
- Intermediate Burp Suite Certified Practitioner PortSwiggerCheap, practical and well respected.
- Intermediate OffSec Web Assessor (OSWA) OffSecHands-on web application testing.
- Intermediate GIAC Web Application Penetration Tester (GWAPT) GIACOften employer-funded.
- Advanced OffSec Web Expert (OSWE) OffSecWhite-box testing: find bugs by reading source code.
- Advanced CSSLP ISC2Secure software lifecycle, for senior and architect roles.
Resources
- Web Security Academy
- OWASP Juice Shop
- OWASP Cheat Sheet Series
- OWASP Web Security Testing Guide
- OWASP crAPI (vulnerable API)
- DVWA (Damn Vulnerable Web Application)
- Developing Secure Software (LFD121)
- Threat Modeling Manifesto
- 6.858 Computer Systems Security
- Designing Secure Software
- Hacking APIs
- API Security in Action
Frameworks and standards
- OWASP Top 10 The ten most critical web application security risks, updated every few years from real data.
- OWASP API Security Top 10 The ten most common and serious risks in APIs, such as broken object-level authorisation.
- OWASP ASVS (Application Security Verification Standard) A detailed list of security requirements to design, build and test web applications against.
- OWASP SAMM A maturity model to measure and improve an organisation's software security programme.
- NIST SP 800-218 Secure Software Development Framework (SSDF) A set of secure development practices that buyers, including the US government, ask software makers to follow.
- SLSA (Supply-chain Levels for Software Artifacts) Levels of build integrity and provenance that protect software from tampering between source and release.
- CWE (Common Weakness Enumeration) A catalogue of the types of software and hardware weaknesses that cause vulnerabilities.
- CVE (Common Vulnerabilities and Exposures) Gives every publicly known vulnerability a unique ID, such as CVE-2021-44228, so everyone talks about the same flaw.
- CVSS (Common Vulnerability Scoring System) A standard way to score how severe a vulnerability is, from 0 to 10.
- OWASP GenAI Security Project Home of the OWASP Top 10 for LLM Applications and guidance on securing generative and agentic AI.
Career path
A common progression. Titles vary between companies.
- Developer, QA engineer or junior security analyst0–2 years
- Application security engineer or web pentester2–5 years
- Senior AppSec or product security engineer5–8 years
- AppSec architect or AppSec lead8+ years
- Head of product security10+ years
Related domains to move into
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact