Application Security Engineer (AppSec): salaries and requirements
As of September 28, 2026, the cvGO database holds 80 active jobs for “Application Security Engineer (AppSec)”. Median pay among jobs that state it: US & Canada — $220,500 per year (n = 42). Most requested skills: Application Security, Threat Modeling, Vulnerability Management.
Pay by region
| Region | Median | 25–75% | Jobs with pay |
|---|---|---|---|
| US & Canada | $220,500 per year | $168,200 per year – $260,000 per year | 42 |
| Europe | not enough data | 1 | |
Skills in requirements
- Application Security — 62%
- Threat Modeling — 51%
- Vulnerability Management — 35%
- Penetration Testing — 34%
- Product Security — 31%
- Python — 28%
- SAST — 23%
- Code Review — 22%
- Incident Response — 20%
- OWASP Top 10 — 18%
- Bug Bounty — 17%
- DAST — 17%
- Security Architecture — 17%
- CI/CD — 15%
- Security Tooling — 15%
- Authentication — 14%
- prompt injection — 14%
- Security Assessments — 14%
- Cloud Security — 12%
- AWS — 11%
Levels
- Middle — 22
- Senior — 52
- Lead — 5
- Director — 1
FAQ
How much do “Application Security Engineer (AppSec)” jobs pay?
US & Canada: median $220,500 per year, half of jobs between $168,200 per year and $260,000 per year (n = 42). Pay is stated in 56% of jobs.
Which skills do “Application Security Engineer (AppSec)” jobs require?
Application Security — 62%, Threat Modeling — 51%, Vulnerability Management — 35%, Penetration Testing — 34%, Product Security — 31%. Share of jobs with parsed requirements (n = 65).
How many “Application Security Engineer (AppSec)” jobs are remote?
Remote — 46%, hybrid — 18%, office — 36% (of 80 jobs that state the format).
Are there entry-level “Application Security Engineer (AppSec)” jobs?
There are no intern or junior jobs in the database right now.
What level of English is required?
The level is stated in 94% of jobs; most often: C1 — 80%, C2 — 5%, B2 — 5%.
How we count
- Source: jobs in the cvGO database as of September 28, 2026: Global 83%, HeadHunter 11%, Telegram 6%.
- A job belongs to a profession by its title; one job may belong to several professions.
- Some jobs in the database match no profession in our catalogue and are not counted on these pages.
- Pay is the midpoint of the stated range or the single stated amount, in US dollars at a fixed rate (90 RUB per USD, table v1). Yearly amounts are divided by 12; if the period is not stated, it is inferred from the currency and amount; amounts outside 300–60,000 USD per month are excluded.
- A median is shown when a region has at least 10 jobs with pay.
- Skills and English are counted only for jobs with the employer’s own text.
- Duplicates of one job across sources are not merged.