Application Security (AppSec) Specialists

Conduct Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), and Software Composition Analysis (SCA).

Use tools like Burp Suite, OWASP ZAP, Fortify, SonarQube, Checkmarx , and others.

Manually and / or automatically review source code for vulnerabilities like SQL injection, XSS, buffer overflows, etc.

Integrate security into DevOps (DevSecOps) pipelines.

Implement secure coding practices and ensure adherence through CI / CD.

Secure coding principles

Software development lifecycle (SDLC)

Common vulnerabilities and their mitigation (OWASP Top , CWE)

Compliance standards (PCI-DSS, HIPAA, GDPR)

Authentication and access control mechanisms (OAuth, SAML, JWT)