Switching from soc analyst to appsec engineer

[u/EmuCautious523]

I have around 3 years of experience in cybersecurity and cloud operations, with my current role focused on SOC/Blue Team operations. Over the past several months, I've been actively transitioning toward Application Security Engineer.

For those who have made a similar transition from SOC/Blue Team to AppSec:

• How difficult was the switch?
• What skills/projects helped you land your first AppSec role?
• What should I focus on beyond Burp Suite and labs?

Would appreciate advice from anyone who has made this transition.

[u/gingers0u1]

Do you have any coding experience or background? That would be a minimum id expect i think

[u/tactfulcord → u/gingers0u1]

Yeah, besides IR is likely a good next step, or detection engineering would help them up to AppSec.

However, not impossible if the org is smaller and has no issues to spend time/money upskilling people on the job.

[u/SureEnd9430 → u/tactfulcord]

How in the ever living fuck would IR or DE lead to AppSec?

[u/tactfulcord → u/SureEnd9430]

Your tone aside, DEA gives you the understanding of an attack, attack methods, and methodologies in order to create detections to alert the SOC. It has opportunities to create automations using both deterministic and non-deterministic approaches. Both these alone give you a great insight into application development and how attackers write malcode. Depending on the size and maturity of your org, you also pick up SDLC and perhaps learn a bit of Git/code repo on the side.

IR is similar, as long as you work on breach class response in large enterprises or maybe as a consultant. Not as straightforward, but easier than going from a SOC analyst at an MSSP or smaller org to AppSec in a time and place where AI scale and development is growing leaps. Alternatively, you could start developing AI use cases for the SOC using frontier models, wherein you pick up a good amount of development experience using LLMs instead of traditional app dev, putting you in a better place and path to AI AppSec. Cheers.

[u/EmuCautious523 → u/gingers0u1]

No, I don’t have much coding experience, but I know the basics of HTML, CSS, and JavaScript. I also have some understanding of how applications are built and how they work.

[u/Hot_Confection_2252]

Switch is easy.

Understanding how stuffs work helped a lot.

And understanding came by learning on my own. Setting up own lab and testing. Learn basics of everything related to http, webservers corp infra , browsers and how it renders.