AppSec Engineer
Overview
AppSec is the bridge between abstract standards and technical execution.
It turns regulatory obligations into concrete, auditable controls proportionate to risk, ensuring that security is embedded across the complete lifecycle.
Key Responsibilities
- Translate standards and regulations into technical requirements
- Facilitate threat modelling sessions and architecture reviews
- Define secure development guidelines
- Support audits and produce security evidence
Organisational Context
They act as the link between technical teams and governance, ensuring the traceability required by NIS2 and DORA. Without AppSec, security policies become detached from technical reality.
Regulatory Framework
Essential for:
- NIS2: Traceability and vulnerability management
- DORA: Supplier governance and operational resilience
- GDPR: Security by design and privacy by default
Activities by Chapter
Ch. 01 - Application Classification
Review the criticality classification whenever relevant technical changes occur or at a fixed cadence (L1 yearly, L2 half-yearly, L3 quarterly). Verify that expected threats are covered by the controls applied.
User Stories:
- US-02: Criticality review on relevant changes - Keep the classification up to date
- US-03: Periodic criticality review - Fixed cadence per level
- US-06: Threat coverage verification - Validate the adequacy of controls
Ch. 02 - Security Requirements
Establish and maintain a security requirements catalogue, versioned and auditable throughout the SDLC.
User Stories:
- US-04: Security Requirements Catalogue - Consistent and traceable application
Ch. 03 - Threat Modelling
Document and formally approve residual risks identified in threat modelling, ensuring transparent and auditable decisions.
User Stories:
- US-04: Documentation and approval of residual risks - Transparent decisions
Ch. 04 - Secure Architecture
Review architecture designs to ensure compliance with established security patterns.
User Stories:
- US-03: Review of architecture designs - Validate technical compliance
Ch. 05 - Dependencies and SBOM
Run automatic SCA in pipelines and formalise CVE exceptions with explicit governance. Audit manually copied libraries.
User Stories:
- US-03: Automatic SCA with gates - Detect CVEs before production
- US-04: Formal, temporary CVE exceptions - Residual risk governance
- US-09: Audit of manually copied libraries - Blocking in CI/CD
Ch. 06 - Secure Development
Validate external dependencies, record technical exceptions, review guidelines quarterly, define L1-L3 validation profiles, detect dangerous patterns automatically.
User Stories:
- US-02: Validation of external dependencies - Reduce supply chain risk
- US-03: Recording and approval of technical exceptions - Traceability and review
- US-04: Quarterly review of guidelines - Formal governance
- US-05: L1-L3 validation profiles - Adequacy to risk
- US-06: Automatic detection of dangerous patterns - Blocking with educational feedback
Ch. 07 - Secure CI/CD
Apply distinct gates per L1-L3 and ensure container/SBOM scanners in pipelines. Run DAST in staging.
User Stories:
- US-07: Gates by risk - Proportionate security
- US-08: Extended coverage - Containers and SBOM
- US-11: DAST in staging - Behavioural validation
Ch. 08 - IaC and Infrastructure
Govern IaC modules from trusted origins, apply automatic policy enforcement, audit drift periodically.
User Stories:
- US-04: Governance of IaC modules - Reduce supply chain risk
- US-08: Automatic policy enforcement - Systematic compliance
- US-11: Periodic drift audit - IaC vs infrastructure coherence
Ch. 09 - Containers and Images
Digitally sign all images with verifiable provenance. Monitor container behaviour at runtime.
User Stories:
- US-03: Digital signing of images - Integrity and origin
- US-05: Runtime behaviour monitoring - Detection of suspicious events
Ch. 10 - Security Testing
Define a testing strategy per application proportionate to risk. Centralise findings on a unified platform and automate delivery to the teams.
User Stories:
- US-01: Security testing strategy - Coverage proportionate to risk
- US-10: Centralised findings management - Unified platform
- US-11: Automatic findings feedback - Contextualised delivery
Ch. 11 - Secure Deployment
Define automatic gates and thresholds for deployment. Run technical validation with conditional gates by risk.
User Stories:
- US-01: Automatic gates on deploy - Block insecure releases
- US-04: Conditional gates by risk - Proportionate technical validation
Ch. 12 - Monitoring and Operations
Define critical security events and metrics. Classify monitoring domains, correlate multi-source events, tune alerts, apply controls proportionate to risk.
User Stories:
- US-02: Definition of critical events - Coverage of relevant risks
- US-04: Classification of monitoring domains - Proportionate coverage
- US-05: Multi-source event correlation - Detection of suspicious patterns
- US-06: Alert validation and tuning - Reduce false positives
- US-09: Controls proportionate to risk - Balance cost and coverage
Ch. 13 - Training and Onboarding
Provide continuous training per profile, run code clinics, keep training tracks up to date, apply training proportionate to risk, implement validation quizzes, define the DoD per format.
User Stories:
- US-02: Continuous training per profile - Kept current with recent practices
- US-03: Structured code clinics - Continuous learning
- US-07: Maintenance of training tracks - Reflect current practices
- US-08: Tracks proportionate to risk - Adequacy to context
- US-09: Validation quizzes - Auditable record of competence
- US-10: Definition of DoD per format - Consistency and quality
Ch. 14 - Governance and Contracting
Aggregate practices in an organisational dashboard, review exceptions periodically, maintain the compliance repository, run periodic validation, formalise governance with delegated authority levels, maintain the centralised checklist, monitor suppliers.
User Stories:
- US-02: Organisational dashboard - Visibility and measurement
- US-04: Periodic review of exceptions - Validate mitigations
- US-06: Compliance repository - Facilitate audits
- US-07: Periodic compliance validation - Detect deviations
- US-10: Centralised compliance checklist - Actual state of all practices
- US-14: Continuous supplier monitoring - Real-time event detection
Chapter References
For full context and framing:
- Ch. 01 - Application Classification
- Ch. 02 - Security Requirements
- Ch. 03 - Threat Modelling
- Ch. 04 - Secure Architecture
- Ch. 05 - Dependencies and SBOM
- Ch. 06 - Secure Development
- Ch. 07 - Secure CI/CD
- Ch. 08 - IaC and Infrastructure
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations
- Ch. 13 - Training and Onboarding
- Ch. 14 - Governance and Contracting
- Ch. 05 - Dependencies and SBOM
- Ch. 06 - Secure Development
- Ch. 07 - Secure CI/CD
- Ch. 08 - IaC and Infrastructure
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations
- Ch. 13 - Training and Onboarding
- Ch. 14 - Governance and Contracting