Application Security (AppSec) Engineer

694 US job postings, 322 of them in the 30 days to 2026-10-28. Data as of 2026-10-29.

Skills employers ask for

CI/CD — 18% of postings
DAST — 16% of postings
OWASP Top 10 — 16% of postings
Threat Modeling — 16% of postings
Python — 14% of postings
Amazon Web Services — 13% of postings
Code Review — 12% of postings
Java — 11% of postings
SDLC — 10% of postings
Penetration Testing — 10% of postings

Where the jobs are

California — 17%
Massachusetts — 15%
Washington — 14%
New York — 13%
Texas — 12%
Illinois — 10%
Georgia — 3%
Florida — 2%

Advertised pay

Annual pay: median $163K/yr, middle half $140K/yr to $194K/yr (150 postings)

Remote, hybrid or onsite

Of 621 postings that state it: 36% remote, 30% hybrid, 34% onsite.

Related roles

Web & API Security Architect

Explore more