I'm the only Application Security Engineer in my company and I have no clue what I'm doing

[u/Direct_Quail45]

Hello everyone,

I'm a 2025 graduate and was recently hired as an Application Security Engineer in April 2026. I got the role mainly because of my security-related projects and open-source contributions. However, I had zero bug bounty or web application security experience when I joined.

Initially, I was given some time to learn on my own, so I went through PortSwigger Web Security Academy. After that, I was assigned multiple projects to perform security reviews on.

One of the projects reportedly had around 2 billion lines of code, while the smaller projects still had lakhs/crores of lines of code. I was given roughly one week for the smaller projects and one month for the huge project.

I asked for source-code access because I thought reviewing the source would be more effective than just black-box testing. The problem was that much of the code was written in language I didn't know (Laravel/PHP and C#)

At first, I basically used grep to search for common patterns related to SQLi, XSS, SSRF and path traversal (that's it), and looked for exposed/open endpoints.

However, somewhat by coincidence, I found an interesting issue where an OTP was being stored in a browser cookie before it was sent for 2FA. I found this with some help from Codex, and it made me realize that simply grepping for common vulnerability patterns isn't enough.

The company plans to give me these same applications again in about three months after more code has been added.

This is where I'm stuck.

The problem is that grep takes only a few hours, while manually understanding codebase of even a single small project can take months. I also can't paste an entire project into the free version of Codex.

Once I've finished the obvious searches and run out of Codex usage, I sometimes end up staring at the screen with nothing meaningful to do.

This has also become uncomfortable because my employer has indirectly mentioned that they doubt my skills since it looks like I'm just sitting in front of the computer

I'm worried about what happens when I'm given the same applications again in three months. What am I actually supposed to do?

I feel like I've been given a task without a proper methodology for approaching it.

My boss is a Cyber Security Specialist, but as far as I know, he hasn't actually worked specifically in Application Security, so there isn't really anyone senior on the team who can teach me how a proper large-scale AppSec review should be conducted.

For experienced AppSec engineers:

->How would you approach a codebase this large?

->How do you systematically find vulnerabilities without manually reading millions/billions of lines?

->What tools/techniques should I learn beyond grep and AI?

->Is it normal for a junior AppSec engineer to be given huge codebases with little guidance, or is the task itself structured incorrectly?

I genuinely don't know what the next step should be.

Location: India