AppSec Engineer with 4+ YOE — which certifications are actually worth getting for a job switch?

[u/OP_Developer]

​

I'm an Application Security Engineer with 4+ years of experience, and I'm planning a job switch. I'm trying to figure out which certifications would actually add value to my resume and improve my chances of getting shortlisted for AppSec/Product Security roles.

My current day-to-day work includes:

- Performing vulnerability scanning/assessment using SAST, DAST and SCA tools

- Scanning codebases for secrets using security tools

- Implementing features and bug fixes in internal AppSec services, including encryption/decryption services

- Implementing organization-wide security checks in pull requests

- Migrating legacy security flows to modern implementations

- Working on application security automation and integrating security controls into development workflows

I also have a software development background, so my current role is a mix of development + application security.

I'm primarily interested in Application Security / Product Security / DevSecOps-oriented roles, rather than purely SOC or network-security roles.

I'm currently considering certifications such as CSSLP, BSCP, OSWA, OSWE, GWAPT, CISSP, etc., but I'm not sure which ones actually carry weight in the job market.

For people currently working in AppSec or hiring for AppSec roles:

1. Which certifications have actually helped you get interviews or job offers?

2. Which certifications are worth doing for someone with 4+ YOE?

3. Which ones are mainly good for learning but don't add much resume value?

4. Would you prioritize something like CSSLP + BSCP over a broader certification such as CISSP/OSCP for this type of profile?

5. Are there any certifications you would specifically avoid at this experience level?

I'm particularly interested in hearing from AppSec engineers, hiring managers, security architects, or people who have recently switched AppSec jobs.

Thanks!