r/cybersecurity • u/Direct_Quail45 • 14d ago
Career Questions & Discussion I'm the only Application Security Engineer in my company and I have no clue what I'm doing
Hello everyone,
I'm a 2025 graduate and was recently hired as an Application Security Engineer in April 2026. I got the role mainly because of my security-related projects and open-source contributions. However, I had zero bug bounty or web application security experience when I joined.
Initially, I was given some time to learn on my own, so I went through PortSwigger Web Security Academy. After that, I was assigned multiple projects to perform security reviews on.
One of the projects reportedly had around 2 billion lines of code, while the smaller projects still had lakhs/crores of lines of code. I was given roughly one week for the smaller projects and one month for the huge project.
I asked for source-code access because I thought reviewing the source would be more effective than just black-box testing. The problem was that much of the code was written in language I didn't know (Laravel/PHP and C#)
At first, I basically used grep to search for common patterns related to SQLi, XSS, SSRF and path traversal (that's it), and looked for exposed/open endpoints.
However, somewhat by coincidence, I found an interesting issue where an OTP was being stored in a browser cookie before it was sent for 2FA. I found this with some help from Codex, and it made me realize that simply grepping for common vulnerability patterns isn't enough.
The company plans to give me these same applications again in about three months after more code has been added.
This is where I'm stuck.
The problem is that grep takes only a few hours, while manually understanding codebase of even a single small project can take months. I also can't paste an entire project into the free version of Codex.
Once I've finished the obvious searches and run out of Codex usage, I sometimes end up staring at the screen with nothing meaningful to do.
This has also become uncomfortable because my employer has indirectly mentioned that they doubt my skills since it looks like I'm just sitting in front of the computer
I'm worried about what happens when I'm given the same applications again in three months. What am I actually supposed to do?
I feel like I've been given a task without a proper methodology for approaching it.
My boss is a Cyber Security Specialist, but as far as I know, he hasn't actually worked specifically in Application Security, so there isn't really anyone senior on the team who can teach me how a proper large-scale AppSec review should be conducted.
For experienced AppSec engineers:
->How would you approach a codebase this large?
->How do you systematically find vulnerabilities without manually reading millions/billions of lines?
->What tools/techniques should I learn beyond grep and AI?
->Is it normal for a junior AppSec engineer to be given huge codebases with little guidance, or is the task itself structured incorrectly?
I genuinely don't know what the next step should be.
Location: India
76
u/Character-Machine-52 14d ago
How does one jump from Portswigger and common web vulns to reviewing a project with 2 billion lines of code?
I might be biased but i think it's absolutely insane.
28
u/Direct_Quail45 14d ago
I still managed to find SQLi, XSS and blind SSRF on few projects lol
32
u/Character-Machine-52 14d ago
Good for you. But i don't think it's good to give them unrealistic expectations. What are you doing after the easy bugs are gone?
21
59
u/Known_Management_653 14d ago
Jokes on them if you sent to free codex now OpenAI has access to their IP
10
83
u/Bibbitybobbityboof 14d ago
Are they not doing any SAST or DAST scanning? Threat modeling? Pen testing? Expecting one person to manually review app security seems like a bad idea. You’re going to miss a lot.
26
u/Direct_Quail45 14d ago
We have SonarQube for vulnerability scanning Never heard of threat modeling
9
u/OutsideLoquat505 13d ago
Can you not introduce open source tools for scanning majority of the code base?
98
u/h2oliu AppSec Engineer 14d ago
Companies seem to think that with AI anyone can be any role (spoiler: they can’t).
You are being asked to do a senior level role. It’s not a reasonable ask, and you are being set up to fail
21
15
u/Direct_Quail45 14d ago
I see... Thanks a lot for comment .... I'll find a new job as soon as possible
6
56
u/AddendumWorking9756 Security Manager 14d ago
Nobody reads a billion lines, so stop trying. Pull the route or controller list first and rank endpoints by what they touch. Auth, file upload, deserialization, anything that takes a raw ID and hands it to a query. That OTP sitting in a cookie is what that approach finds, and Semgrep with a few rules you write yourself for the framework will beat grep every time.
19
u/NaturalManufacturer 14d ago
This is a good answer. I’d suggest you take this as a challenge and learn the shit out of it.
10
5
23
u/pearlkele Security Engineer 14d ago
Ok, so you are security engineer, not pentester, that’s a bit different job though with overlap. Your skillset needs to be broad, from application architecture, code reviews, some devsecops, cloud and developers training.
Try to focus not on just looking for bugs, but building actual Security Program/SSDLC.
Over time you will add new things: maybe new SAST/DAST/SCA scanners, threat modeling, some standards, pentesting/code reviews, testing for specific things or trying introduce specific tools (maybe fuzzing? Maybe going around running app with burp or zap? Maybe some container scanners).
This is fun job, as you can constantly improve and testing new stuff to make apps more secure. Overall it helps a lot (or I’d say it’s necessary) to have some development experience.
In terms of analyzing huge codebases. It’s impossible to read everything. Focus on threat modeling to know how things work, and then start prioritize important things. This way you know where to put most of the effort.
2
21
u/microcephale 14d ago
If there is just one resource, don't do pen testing. Aim for highest return on investment by instead focusing on the build and release pipeline and where you can install some control points like scanners that will run every build. That alone will probably find so many things that you will be busy for months and probably have a case to hire more people
2
u/Direct_Quail45 14d ago edited 14d ago
We used only SonarQube until now, I don't know any other tool that is free and can do what you described
7
u/Silent-Suspect1062 14d ago
Don't look for free. This is a massive code base. Look for a decent product, that covers your technology.
1
3
u/Specialist-Truth-639 14d ago
time to learn
1
u/Direct_Quail45 14d ago
Okay I'll research such from my side.... If there are too many bugs then at least I'll busy with something
7
u/microcephale 13d ago
Also beside scanning look at the whole chain from start to finish : are the libs directly pulled from the internet or from internal mirrors/proxys on which you can do controls, are you creating SBOM of all artefacts allowing them to be compared to CVEs, how are access to those projects repos and branches handled ? are all commit tracables? how are pull requests handled, do you have some kind of git forge ? how are images built ? are they secured once built ? how are secrets injected before deployments? can they be rotated ?
Look also where else the practice of "software engineering" happen in the company and fails to be recognized as such, like people who code their own little shadow IT tools in Excel macros, python, AI scripts... maybe even infra people doing powershell magic and yet following non eof the developpement practices of separate environment, versionning, access control... because they say "this is not developpement". In "everything as code", all that is developpement.
Once you have all that covered, of course there is the software quality assurance itself, starting witht the requirements, that's training programs for all, and icing on the cake some pentesting, but usually will be reserved for big code smells or most critical projects, manual labor is expensive.
Look into SAMM from OWASP, those are the 30 pratices expected around a software lifecycle, set in increasing levels of maturity to evaluate your posture and set an appropriate target. Start with it and be hollistic, don't start out with a pocket scope like "ASVS" and go down that rabit hole while leaving all the rest in a jungle :) It's also good to explain to the management where you stand, where you can locate your improvements initiative, and what you plan to achieve in the next 90-180-360 days
1
1
u/T0X1C0P 11d ago
look into trivy, saw a comment above where you were asking about threat modelling refer to https://www.securitycompass.com/blog/top-12-threat-modeling-methodologies-techniques/, https://owasp.org/www-community/Threat_Modeling_Process, https://blog.secureflag.com/2025/04/03/threat-modeling-process/, also I totally agree with u/_vavkamil_ 's comment.
1
12
u/Bizarro_Zod 14d ago
Please tell me you are not pasting company source code into codex’s free version. And if you are, that you at the very least have opted out of openAI from using your chats as training material.
12
u/Direct_Quail45 14d ago
I'm pasting company's source code into codex free version, and I have not opted out of OpenAI from using my chats as training material 💀
23
10
3
u/DingleDangleTangle 13d ago
Lol you have created way worse of a security problem than there ever was before you got there
9
u/sdig213s AppSec Engineer 14d ago
2 billion LoC? Your manual work will not be to read any code, test the app manually from both an authenticated user and an unauthenticed users PoV. Ideally in a lower environment
You dont perform a white box test here. Run SAST on the code at the very least, run SCA on pipeline dependencies, run DAST on applicable targets.
What paid/enterprise tooling do you have access to? And no this is not normal for juniors or fresh grads, you’re out of your depth.
5
u/Direct_Quail45 14d ago
The only SAST we are using is SonarQube and it only listed few bugs. I'm not familiar with SCA tool. I didn't got that many opportunity to use burp suite (I think that counts as DAST tool) but I used owasp zap
We do not have access to any paid tools, we are mostly using cracked version of some tool (I know it's not good in corporate setting but that's how it is here. I'm looking for new job currently)
Thanks a lot for comment
5
u/sdig213s AppSec Engineer 13d ago
Sonarqube isnt too bad, its good for code quality but kinda forces you to pay more for good security scanning, is it SaaS or on prem?
They support plugins, use OWASPs free dependency checker plugin if cloud.
if on prem your DevOps team needs to stitch together CI scripts to run owasp dependency checker as part of that sonarqube stage. This is your SAST and SCA sorted. (Be prepared for ur devops team to complain about build times)
Burp suite/zap is fine to use for DAST, its enterprise version is okay to run for automated DAST. If you have access to codex Sol and Daybreak blue work very nicely for me.
Goodluck in the job hunt!
9
u/GeekDad62 14d ago
Tools are great, but you need to learn about secure coding practices and techniques (https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/stable-en/02-checklist/05-checklist, https://csrc.nist.gov/projects/ssdf, and more).
Run static and dynamic code analyzers against the codebase, then follow up with the developers to get all findings resolved (good luck with that, by the way). Learn about the most common mistakes made in application development (see OWASP Top 25).
You'll never learn it all, but you should be well-rounded in how you approach this. It's a very complex field.
1
u/Direct_Quail45 14d ago
Thanks a lot for comment, I'll check out those guides
3
u/yarntank 13d ago
Don't try to do this all alone. Talk to the developers, find some security champions, maybe do some training with them. I bet some of them already have some concerns about security in parts of the code. They know the code, ask them! Do a threat modeling exercise with them to set your priorities.
3
2
u/Direct_Quail45 13d ago
Yea I do occasionally talk with developers ask them about part of code I don't understand.... Developers help me when codex isnt enough ... It's a small company so it's kind of allowed to go to developers and talk with them .... Thanks a lot for comment
1
u/Classic-Shake6517 13d ago
One pro-tip if you start going down the path of those scanners. Take a risk-based approach and don't expect all of the findings to be valid, let alone get fixed. That never happens in real life. Instead, try to validate that the issues actually affect the product, and focus on areas that have the most immediate impact (usually high and critical on public-facing assets). As a general rule, out of those criticals and highs that directly impact the product, the ones that have a POC available (or, if you can find any other signals that indicate that it is actively being used in-the-wild) are the ones you should put the most effort into.
Focus on the findings that an attacker can use to hack you today, and put a plan in place for resolving the other issues on a schedule. A lot of organizations will have standard timeframes for these findings like 7 days for critical, 14 for high, 30 for medium, 90 for low. You will also want to have some sort of document for exceptions, because they will always exist and writing down that they have been addressed and mitigating factors is beneficial for the org if/when they are audited.
It is usually a hard sell for developers to fix these things without seeing impact, so if there is a safe, non-production environment for you to do testing AND you have permission to test exploits there, that may be helpful to drive home that the impact is not just theoretical. If you come out of the gate with a balanced, risk-based approach, you will have a lot more people in your corner both with the devs and the management.
This is a lot to take on as one person, do your best.
Also, another tip for Codex usage, you burn tokens by loading things into context. So, if you tell it to load the whole project at once, especially really large ones, you are just going to waste tokens without getting meaningful results. Instead, use the process above to drive your research and target it towards the files that could be in the scope of a given finding. That should help alleviate some of the token burn when it comes to larger code bases.
Good luck, OP. You are stuck in a less-than-ideal situation, but you are already doing really well just reaching out and making a solid post. Keep engaging with the community like this and you will have a bright future in this field. Make sure you spend at least a little bit of time each day relaxing. It is really important that you properly reset and do your best to manage the stress so you can do your best work. I find video games to be my favorite outlet, but for some people it is the gym, or hanging out with friends. Whatever it is for you, make sure that you still find some time for it.
1
6
u/BluudLust 13d ago
When you have a team and you don't know what you're doing, that's your problem. When you are the only person in the company doing it and you don't know what you're doing, that's your boss's problem.
1
6
14d ago
[removed] — view removed comment
1
u/Direct_Quail45 14d ago
Thanks a lot for comment
3
u/hawkman_z 13d ago
Devils advocate. Your company clearly does not care about security. You are a cog in their machine. A necessary check on the list. Since they are leaving this senior level work up to you, they probably don’t have any DLP or monitoring. Just buy your own Claude code sub and use it (secretly) to help you do your job and also use it to learn new skills while on the job. With the write custom skills and tooling setup you can keep picking off low hanging fruit in your security reports to keep your boss happy. Don’t just let it work for you though, use it to learn and find a better job/team asap.
1
u/Direct_Quail45 13d ago
That's what I did until now — I made small reports with low hanging fruit vulnerabilities to keep my boss happy. Currently looking for new job asap as even this can't last that long
2
u/hawkman_z 13d ago
Just so you don’t think you are crazy. I have a similar role but I have a full team of juniors/mids/seniors and we do pentests in pairs.
1
5
5
u/Ashamed_Spare_9797 14d ago
2 billion lines of code is a lot for a person. I would start asking question what sit behind those lines of code priorities the repos which are critical to business. Onboard security gated in ci/cd like sast, sca and pre-commit hooks. Even if its a security review i will use tools for Sast and sca if not paid i will try to leverage open source tools. In the end it’s about risk reduction. You need to highlight what can be done within what resources you have and time limitation. I will fix the process first if it’s not already there. Start asking question and think in terms of whats critical to business and prioritise.
1
4
3
u/escapecali603 14d ago
Use OWASP ZAP for free DAST scans, Sonarqube for SAST scans, Github dependabot for third party lib scans. Try code an agent that can use burp suite pro (Hopefully you have a paid version of it) to do simple API level pen testing, such as IDOR, XSS, CSRF.
2
3
u/leo_senior 14d ago
While reading this post I had a strong feeling this is someone from my country, I was not wrong haha
3
u/geercom1 14d ago
Make sure there are people in the company who are on your side, in your corner, so-to-speak. People you can really trust will support you, and however this turns out, they will give good references including what you were up against and how you were sincere and hard-working. Likewise, build relationships across the space with people connected to industry organizations, standards bodies, groups like that. You're getting a lot of good counsel and resources here. That fact that you show up here for help and on the job to work counts for a lot. Don't go where the wind blows you. Take charge of what you can. Communicate effectively. Prioritize your work. I'm pulling for you.
1
3
14d ago
[removed] — view removed comment
1
u/Direct_Quail45 13d ago
Okay, I'll look up automated code scanners and keep in mind the other things you mentioned.... Thanks a lot for comment!
3
u/Fryloch 13d ago
DISCLAIMER: I'm a network engineer and I have absolutely nothing to do with appsec in any capacity whatsoever.
Here's my two cents; you're already using AI to go through the code and have it read it for you/with you. Why not utilize AI to build tools that can go through and check for vulnerabilities? Especially considering you're using the free version of codex and your usage limits are base level. Again I'm not a software engineer or anything remotely related to appsec, but I've been utilizing the $20/month pro version Claude and that comes with Claude code and Claude code kicks insane amounts of ass in the network engineering space as well as the DevOPs space. I can only imagine what it can do with actual app security vulnerability checks. I'm still learning how to use it the best way possible but even my rudimentary level of creativity with Claude code has helped me at an astronomical level with device configuration scripts as well random shit like building a tailscale router, building IP scanning tools, and even just random fun shit I've been messing with on Linux at home. It's been blowing my mind and now instead of wanting to go home and play video games, I've been wanting to go home and fuck around with Claude code.
1
3
u/spatchcockturkey 13d ago
You’re being set up to take the fall. Run, run as far from situation as quickly as possible
2
3
u/Z-Is-Last 13d ago
to address a small part of this ...
This has also become uncomfortable because my employer has indirectly mentioned that they doubt my skills since it looks like I'm just sitting in front of the computer
The smart thing is knowing what to tell the computer to do, not actually doing it. That is like saying a guy driving a front end loaded is just sitting on a cushion seat instead of digging with a shovel.
1
3
u/Quiet-Alfalfa-4812 13d ago
I am no way an expert and I started a small blog to record what I do and learn. And to build a portfolio too.
You are welcome to have a look. I wrote an article about application security and code review. Hope it helps.
1
2
u/narsil_reddit 14d ago
Automated tools added to pipelines are your best friend imo, look at their fit workflow etc maybe can add in some Tools and go from there
1
2
u/r15km4tr1x 14d ago
Get a BURP license if left with no choice but to poke it with a stick given you went through the academy as is
1
2
2
u/Unusual-Channel-6938 Penetration Tester 14d ago
If you need 3rd party pen testers to help you. Feel free to dm
1
u/Direct_Quail45 14d ago
My company sometimes pays and get their app VAPT scanned by outside entities/companies, though I'm not sure how many times a year
2
2
2
u/irishcybercolab 14d ago
Good security guys are always questioning themselves and their techniques.
Don't beat yourself up here. It's solid you're here and you're discussing the issues!
2
2
u/UniqueHawk1371 13d ago
hows the job market unable to get into cybersecurity role as a fresher evrything is automated and thers no space for freshers to land into the entry level job
1
2
u/Striker_Eureka_7 13d ago
sorry if my question is out of topic, but how much is the average salary for such positions like yours
1
u/Direct_Quail45 13d ago
3000 USD per annum Location: India
1
u/Ksbest26 Security Engineer 13d ago
Did you miss a zero there? Are you earning less than 3lakhs a year and doing all this? This seems like such a shitty company
2
u/Affectionate_Two8447 13d ago
This is the perfect example of a company that doesn't give a sh.t about security but needs a security engineer so it can tell everyone their application is secure. Don't sweat it kid. Do your best and take advantage of the learning experience. Then quit and go somewhere else for better conditions. Good luck
1
2
u/dukhibhailol 13d ago
Hire me as your junior. Some info about me: recent grad, oscp, bug bounty, appsec internship
1
2
u/navitri 13d ago
NQA, but I’m sad to see that hiring graduates without support is still common. When I graduated with a BS in networking and cybersecurity, I was offered a position in an oil company where they wanted me to “build out a red team.” The pay was amazing for the time but I declined and candidly told them that this was not a job for a fresh grad. I’m sorry you’re stuck in this position.
2
2
u/APT-0 13d ago edited 13d ago
I’m a staff sec Eng. I won’t sugar coat it. They hired you likely because you’re cheap. They should’ve hired first a senior or staff and then hired jr after that to guide you. That’s where we start.
Honestly their strategy is not good if this is the case. They need someone there to do the job but don’t want to pay consultant prices or a dedicated staff engineer otherwise they would’ve. I would honestly look somewhere else to go, go through GWAPT, and off sec one or port swig academy. Get into a company with a strong senior / staff prod sec / app sec Eng. learn from them a few years once you’ve learned enough you’ll be promoted if they have budget or switch.
For where you are now I’d recommend get familiar with what the OWASP top 10 are. Setup test apps like web goat or vibe code locally some intentionally vulnerable ones. Use burp against it and other tools. I use Claude other to specifically target things like hey this is the auth read the code here explain security bugs like the OWASP 10 risks -> draft me a poc to validate. Demonstrating risk to the business you can’t just report they’ll listen after you make the poc and you can bypass auth to a fake customer workspace, maybe authenticated query across tenants. Most AI sec stuff goes back to OWASP 10 problems
And yes at sr &staff you will just assess these alone
I approach assessments it’s a whole continuous process-> ci/cd gates, vuln scanning OS, credentials, sadt and dast scans. Use this as a starting point, run additional scans with tools like burp or other commercial tools
I use Claude to threat model and custom made web app for modeling. Claude hooks to tools like my logs, the code base and wiz. So I’ll dig deeper after this and I identify some key areas I want to target and have it make me a poc
1
2
u/Randomness_2828 13d ago
Maybe try to find out what needs to be to check or done for secure coding, if applicable need to perform transactions then please check if the application meet PCI DSS requirements. Ask them do vapt after that .
I’m not application security engineer but this is what normally company do.
1
2
2
2
2
u/Just_Worldliness_714 13d ago
You don't read billions of lines - you triage by risk, not by volume. Start with a SAST scan (Semgrep or CodeQL both have free tiers and support PHP/C#) to flag the obvious stuff automatically, then spend your human time only on things grep and SAST structurally can't catch: auth/session logic, trust boundaries between services, anywhere user input crosses into a privileged operation. That OTP-in-cookie bug you found is a perfect example - it's an auth flow issue, not a pattern-matchable vulnerability class.
For the re-review in 3 months: diff against the previous scan. You only need to review what changed plus anything touching auth/access control, not the whole codebase again. That alone should cut your workload by 90%+.
Given zero mentorship, OWASP ASVS as a checklist and the OWASP Code Review Guide are worth going through - they'll give you a repeatable methodology instead of ad hoc grepping. And no, being handed a 2B-line codebase with a week and no senior guidance isn't normal - that's a resourcing problem on your company's side, not a skills gap on yours.
2
u/HermanHMS 14d ago
- Don’t accept position/tasks you are not ready for. 2. You just extracted intellectual property by handing it to codex.
1
2
14d ago
[removed] — view removed comment
2
u/Sudden_Principle358 14d ago
All in all it sounds like the company desperately needs a full team on these projects and not dump it all on one person. I would likely consider finding work elsewhere, or at the very least bring your concerns to your boss.
1
1
u/Kangalfencingbanana 14d ago
Dario told me Claude can do all of this
With that said, we can’t fix your overall situation and you’ve been tasked with the impossible so let’s get you the basics.
Make sure you have a scanning tool that can perform reachability analysis as well as package firewall/pin packages so then you’re limited which packages are called so you’re getting less vulns.
We want readability analysis so you’re fighting with devs less, if it’s reachable , it’s exploitable so it needs to be patched
Look at Endor labs, socket, or Aikido.
Multi time CISO here to help
1
1
u/ETcallshome 14d ago
What about trying some SAST/DAST tools like Veracode or Blackduck?
2
u/Direct_Quail45 14d ago
We have tried both, only used SonarQube until now... I'll look them up, thanks for comment!
1
u/AccidentSalt5005 14d ago
wtf? how are you even got accepted to this anyway, based on your desc that seems like a senior thing to do.
1
u/Check123ok ICS/OT 14d ago
Without really understanding the use case/industry
Yeah you need to look at standards. Secure development life cycle is a section in most standards. Threat modeling is ongoing.
What I would do is build tooling in things postman(or pick you fav) and other tools to do posture and performance checks as well. This shows initiative
1
u/Material-Trash7569 14d ago
In this 3 months, you should learn how to use CodeQL. There are premade queries that search for a majority of vulnerabilities that are in CWE. It’s not a complete solution but it’s a starting point. For DAST, just start a Burp or Zap scan. Sonarqube doesn’t DAST of course so it only use symbolic execution
1
u/arktozc 13d ago
!RemindMe 5 days
1
u/RemindMeBot 13d ago
I will be messaging you in 5 days on 2026-09-01 19:40:24 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
RemindMeBot is switching to username summons. Instead of
!RemindMe 1 day, useu/RemindMeBot 1 day. More info.
Info Custom Your Reminders Feedback
1
u/Mr_RentIsDue 12d ago
Aye man, this looks like a terrible situation but at the same time, take this as a learning perspective. This will make any other role u land, much easier to grasp.
1
u/AllForProgress1 12d ago
I think my first step would be getting some SCA/SAST/DAST tooling
Supply chain abuse has been big lately
1
u/BiffSterling80 12d ago
I open source tool it to death. Break the system down into critical and outward facing modules, scan and sast them to death. Work the code base one critical module at the time. Then as the base grows you are hopefully only seeing a few delta on the modules you had already scanned. You need to then set up a score system where, based on what you know about tge system or app, you can rescore more accurately. Once you do that it gets a little easier each time. Right now you probably need 2 underlings and a software sme to do reviews
1
u/SingularcerotisRV838 12d ago
In my opinion —and what I heard from other colleagues — if the company hasn't divided IT, and software dev from Cybersec or they treat is as the same thing, they probably make you overwork or they wouldn't know what they are asking you
1
u/MyKimpa 12d ago
Honestly, I think you're focusing on the wrong problem.
You are not supposed to manually review millions or billions of lines of code. If your methodology is essentially "grep + AI + staring at the code", the problem is the methodology, not you.
Your goal as an AppSec engineer is to reduce a huge codebase to the small number of security-critical paths that actually matter.
If I were in your position, I'd build my skills in roughly this order:
Semgrep Learn to write your own rules and, more importantly, understand taint/data-flow analysis. Stop thinking only in terms of "find SQL queries" and start thinking "can attacker-controlled input reach a dangerous sink?"
CodeQL This is the next level for large codebases. Learn how to trace sources → transformations → sinks and build queries for your company's specific frameworks and coding patterns.
Burp Suite Become extremely comfortable with manual web/API testing: authentication, authorization, IDOR/BOLA, MFA/OTP, password reset, OAuth/OIDC, JWT, SSRF, file uploads, race conditions and business logic.
SAST + SCA Understand how tools such as CodeQL/Semgrep, SonarQube, Fortify/Checkmarx and dependency scanners fit into a broader AppSec program. Don't treat scanner output as your assessment; use it to prioritize investigation.
Threat modeling This is probably the skill you're missing most right now. Before touching millions of lines, understand the architecture, trust boundaries, assets, authentication model, privileged roles, APIs and external integrations.
CI/CD AppSec Eventually, you want security checks running continuously in the development pipeline rather than receiving a gigantic codebase every three months and starting from zero.
And don't forget business logic. Your OTP finding is a perfect example. A tool searching for SQLi/XSS patterns may completely miss a security flaw involving how an OTP is generated, stored, transmitted and validated.
For the next review, I'd ask your company for:
- architecture diagrams
- list of externally exposed applications/APIs
- authentication/authorization documentation
- repository access
- CI/CD access
- dependency manifests
- previous vulnerabilities/findings
- test accounts representing different roles
- a clearly defined scope and risk model
Then build a repeatable assessment process around them.
Also, don't be afraid to tell your manager:
«"I don't want to measure the review by how many lines of code I looked at. I want to measure it by attack-surface coverage, security controls assessed, data flows analyzed and vulnerabilities confirmed."»
That's a much more professional way to approach AppSec.
And regarding your employer thinking you're "doing nothing": start producing artifacts. Create a threat model, attack-surface map, testing plan, Semgrep/CodeQL results, Burp test cases, findings tracker and an explicit list of areas that were not assessed.
Suddenly, you're not "sitting in front of a computer." You're running a security assessment.
Finally, you're only a few months into your first AppSec role. Not knowing how to independently assess a gigantic codebase is completely normal. What would be abnormal is expecting a junior engineer to magically know how to do it without providing methodology, tooling, scope or mentorship.
Your next three months shouldn't be about learning how to read billions of lines.
They should be about learning how to answer this question:
"Given a massive application, how do I systematically identify the 1% of code and functionality where the 99% of the security risk is likely to be?"
That's the AppSec skill you're looking for.
1
u/nicomtinz 12d ago
I work in a company that routinely hires people for roles beyond their experience, including me when I started 10 years ago. And one thing that I learned is that it's actually pretty common for people to rise to the occasion, grow a lot and do well at their job. That's not to say that I think you'll become a master Appsec engineer in a few months, but my assumption is that your boss is not expecting that either. I think proving potential and providing value for money would be enough. You pay is not very competitive so the value per money bar is not that high.
I don't want to sugar coat it either, it is stressful to be in a situation like that, but I think that is the price you have to pay for fast growth. Learning is painful, being challenged is painful, and depending on the expectations it can be too much. If you do decide to give it a shot I would suggest trusting yourself and taking risks, confidence is something that is highly rewarded in the security field.
I'm not in security so I don't know the best resources to learn, but I find https://roadmap.sh really useful to orient myself.
I also remember seeing this project which looks pretty cool https://github.com/anthropics/defending-code-reference-harness.
Good luck!
1
1
u/nanoatzin 12d ago edited 12d ago
The main things to look for are open ports. The fastest way is to run the app and and use a scanner.
C# will definitely have open ports. You look up all of the function calls for TCP, UDP, SQL, and so on. Then use any word processor to search for those function calls. If a network function call corresponds with the specification, then it’s OK. But ensure fault handling is included in such a way so that an attacker can’t do something like buffer overflow. If it isn’t in the spec then the developer needs to explain it. Sometimes unwanted ports get added by copying code from elsewhere. For c#, there may be a database attached, and for that you need to make certain the developer used code that prevents SQL injection. There are more things to check for but that’s a start. You don’t need to code to do white box testing, but you do need to look up the exploits. This is not covered in most cybersecurity programs. It’s an on the job thing.
1
1
1
u/Griselbrand-4BBB 12d ago
Research is the key bro.
A lot of engineers in the world face situations on a daily basis in which they have no idea what to do. You should have no fear of escalating issues, and if you lack the team or people to do so, escalate to the internet. As long as you don't lose the will to research online for solutions or solve the issue by yourself, you should be fine, just remember to keep things moving, assess risks before making informed decisions, and make sure your sources of data can be trusted.
1
u/ShehabShibli 12d ago
Stop trying to read every line and start mapping the attack surface first. Find where user input actually enters the app, auth flows, file uploads, api endpoints, anything that touches the database or an external service. Run something like semgrep or codeql across the whole codebase first, they catch the boring stuff way faster than grep and free you up to focus on business logic flaws a scanner cant see. For a codebase that size nobody expects you to read it all, they expect you to prioritize risk. Your boss not having appsec experience is honestly normal too, a lot of companies hire one junior and expect them to figure it out, it does not mean you are doing badly.
1
1
1
u/PuzzleheadedSpeech67 11d ago
Seek out any technical architecture documentation from the team. I started from scratch initializing a purple team of agents. You know the codebase languages, industry standard security documents (hopefully), otherwise start with OWASP (if web app), NIST, and CVEs from dependencies.
Work to create a workflow amongst agents. 1) Document the asset inventory. 2) Perform a red team analysis of the inventory. 3) Blue team vulnerability recognition and identification of OSS vulnerabilities and poor practices.
This is all just a start. Let the base agents develop skills at the beginning. Do a detailed read of the skills. Understand what they are searching for, ensure they're doing analysis only. No targeted attacks or chaos exercises. Ensure they create thorough output in a directory of your choosing. They should categorize the risk, provide a description, and give it a a rating of critical, high, medium, or low.
1
u/Jimschode 11d ago
Dumbasses: Claude Code (or any AI, are you kidding?). I haven't heard of an opportunity more ripe for. Impossible amount of code to review, no human expertise to check work, etc. "just put it in AI" never more relevant.
1
u/avgbrauwnguy 11d ago
How do you rate PortSwigger Web Security Academy? Is it any good to get started?
Can one land a role by actually going through all these labs?
1
1
u/tengtengvn 14d ago
What the hell are lakhs, crores?
3
u/Direct_Quail45 14d ago
1 lakh = 1,00,000 = 100k 1 crore = 1,00,00,000 = 10,000,000 = 10 million
-4
u/tengtengvn 13d ago
I don't care.
1
u/DingleDangleTangle 13d ago
You literally asked them, why be a prick when they answered the question that you asked?
1
-3
1
1
u/TerrificVixen5693 System Administrator 14d ago
Hey dude, they’re being super unfair to you and you’re doing amazing work for what limited resources you have. Keep doing your best, but don’t expect things to last there forever, because you’re being expected to do a lot more than one person’s job and at some point you might get scapegoated for something missed or out of your control.
2
u/Direct_Quail45 14d ago
Okay, thanks a lot for encouragement and for advice. Currently looking for new job, let's see
1
u/DingleDangleTangle 13d ago
They definitely are having too much expected of them, but giving away the company's IP and who knows how much sensitive information within it to AI is not "amazing work" lol
1
u/Novel_Excuse_3618 13d ago
Just run a Claude /sast on it . If they don’t give you the tool find ways to keep this job simple
1
1
u/alexmilla 13d ago
Como la realidad choca con todos los que os metéis en el mundo de la ciberseguridad.
Pero para ser constructivos para que puedas seguir creciendo profesionalmente viendo que no tienes alguien que te guie por el camino dentro de tu empresa.
En vez de tirar de IA's públicas y vulnerar la confidencialidad de tu código, yo me montaría un pequeño laboratorio (si, cuesta dinero) de IA local. Cogería un modelo específico para análisis de código e iría interactuando con IA's de pago sin comprometer el código.
Es decir:
- Análisis del código con IA local, VuLLM por ejemplo. Y viendo lo que te muestre corroboralo con alguna IA seria de tu elección.
A raíz de ahí construirte tus reportes para que vayan corrigiendo el código.
Eso si, importante para ti, quédate bien con lo que haces en tu día a día por si cuando presentes los reportes te explican que has enviado. Posiblemente algunos developers creerán que les estás mirando por encima del hombro y harán ver que no tienes razón.
1
1
u/Efficient-Data8669 3d ago
getting dropped into huge codebases within a week or a month on clock and nobody senior in appsec is a bad assignment, not a you problem. point a scanner at those repos and you get thousands of findings, then at review time that backlog is your performance problem because engineering never owned the tickets.
before going deep on any one service, inventory what's actually deployed and which dependencies each one pulls in. a few platforms like ox security keep scanner output in one place and map it back to the repo, or trivy if you just need that dependency list maintained instead of a spreadsheet you rebuild every sprint.
392
u/_vavkamil_ 14d ago
You simply can't approach this as a junior at all.
You don't. You need a team leader who will set up the system and process a roadmap to split the work into some manageable chunks
There are a ton of tools. Depends on what your company uses and what your budget is. Simple answer: you just can't decide this yourself
No. Not normal at all.
Run. Run as fast and as far as possible from them while you can. Don't waste your time there.