QA engineer trying to move into AppSec — does this plan hold up?

📰 Reddit r/cybersecurity

Transition from QA to AppSec with a focused plan on web security fundamentals and tooling

intermediate Published 26 May 2026

Action Steps

Learn web security fundamentals using PortSwigger Web Security Academy
Understand the OWASP Top 10 vulnerabilities and their implications
Get hands-on experience with Burp Suite and ZAP tooling
Apply security testing skills to identify vulnerabilities in web applications
Configure and test security tools to simulate real-world attacks

Who Needs to Know This

QA engineers looking to move into AppSec can leverage their existing testing skills, while AppSec teams can benefit from their new member's fresh perspective

Key Insight

💡 AppSec requires a similar 'how could this break' mindset as QA, but with a security focus

Key Takeaways

Transition from QA to AppSec with a focused plan on web security fundamentals and tooling

Full Article

Few years (2.5+) in software QA test automation, CS degree, comfortable in TypeScript/Python/C. I want to move into AppSec, specifically it feels like the same "how could this break" instinct I already use, just pointed at security. Before I sink months into it, can people who do this for a living sanity check my rough plan? - Fundamentals: PortSwigger Web Security Academy + actually understanding the OWASP Top 10 - Tooling: Burp Suite, ZAP,

Read full article → ← Back to Reads