Application Security Engineer Salary Guide 2026

Last updated: November 7, 2026

By Jennifer Burdick, Recruiting Manager, KORE1

Application security engineers earn $105,000 to $250,000 in base salary in 2026, and a seat lands in that range by how many stages of the software lifecycle it owns. Most mid-career and senior hires close between $150,000 and $200,000. The bottom of the range belongs to people who run scanners, and the top belongs to people who decide what gets built before anyone writes it.

A payments processor outside Tampa opened an application security engineer req in March at $128,000. The number came straight out of their HR system, which filed the job under information security analyst because that is the family security people live in.

The job was something else.

They were about to launch a card-issuing API for three bank partners. Somebody had to read the design before the first sprint, review the pull requests on the authorization service by hand, put signing and dependency checks into a build pipeline that forty developers pushed through every day, and tell a release manager no on a Thursday afternoon without being overruled by Friday. That is a $170,000 seat. Possibly a little more. Two finalists took offers from software companies that same quarter, and a third told us, politely, that the posting read like a compliance job. Eleven weeks went by before anyone questioned the grade.

We asked the processor to look at the engineering pay grades instead of the security ones. They did. The req reopened at $172,000 under a product security title and closed in seven weeks. Nothing about the work changed. The grade did.

I recruit for security and software seats at KORE1, mostly inside our cybersecurity staffing work, and application security is where those two pay scales collide. Weigh what follows with one fact in view. KORE1 collects a fee only after an engineer we introduced accepts an offer and starts, so hold my figures up to the BLS wage tables and the two salary sites linked below, not to whether they flatter us. How to run the search itself is covered in our hiring guide for this role, and the staffing side lives at application security engineer staffing. The interview round has its own page of application security engineer interview questions. This page is only about money.

Two Salary Ladders Claim This Job

Federal wage data has no line for application security engineers. It never has. The two nearest official occupations are information security analysts and software developers, and every employer’s pay system has quietly filed the seat under one of them, usually without anybody deciding to.

Sources: BLS Occupational Employment and Wage Statistics, May 2025, national, all industries, for information security analysts and software developers.

The medians sit $6,800 apart, which is why almost nobody notices the problem. The gap opens higher up. At the 90th percentile the software developer line pays $14,820 more than the security analyst line, and an application security engineer who owns design review and has the standing to hold a release is not a median person on either ladder. That seat belongs near the top of whichever ladder it gets assigned to. Assign it to the first and the top is about $200,000. Assign it to the second and the top moves out past $214,000. Neither line is the job.

Demand is real. The Bureau of Labor Statistics projects information security analyst employment to grow 21 percent from 2025 to 2035, against 6 percent for computer occupations as a whole, with about 14,100 openings a year. The ISC2 2025 Cybersecurity Workforce Study, which surveyed 16,029 practitioners and decision-makers, put application security fourth among the technical skills security teams say they need, named by 28 percent. Hiring managers read numbers like those and assume the salary will sort itself out. It does not. The grade does.

What the Seat Owns Sets the Band

Years of experience predict less here than almost anywhere else in security. Less, not nothing. A developer with seven years of Java who moved into security two years ago and an analyst with seven years of security who has never opened a pull request look identical on a resume timeline. They are different hires, and they do not cost the same.

What separates them is scope. Software passes through six stages, which are design, code, build, test, release, and runtime, and an application security engineer can own one of those or all six. Triage at the end is cheap. Threat modeling at the start is not, and the reason is plain enough. Every step earlier in the lifecycle means judging systems that do not exist yet, with no scanner output to lean on and nobody handing you a finding.

Base salary only. The ranges come from the sources in the next section, cross-checked against offers we see clear, and the row boundaries are my judgment rather than a survey, so use them as bands to price a req against and not as quotes. Row one to row four is $60,000 at the midpoints. Nothing in a job title tells you which of the two you are buying. The title stays the same. Once the band is set, writing the posting around that band comes next, and our template starts from the work queue.

Row three overlaps with a neighboring job. If the pipeline is most of the work, the DevSecOps hiring guide is the better starting point. For the wider family, the security engineer salary guide prices the job by experience level and treats application security as one specialization among five. This page does the opposite and stays on the one row.

The Cheapest Number Online Rests on 23 People

Look the title up and the figures read like they belong to different jobs, because they do.

Sources: BLS OEWS, ZipRecruiter, and PayScale, all read on November 7, 2026.

ZipRecruiter and PayScale are $40,433 apart. Do not average them. PayScale rests on 23 people, which is a small enough room that a single staff engineer at a bank moves the figure, and ZipRecruiter reads postings where junior triage seats and senior product security seats share one title. Both are honest. Each is simply measuring a different population. Average all three and you get roughly $121,660, a figure that lands inside row one of the table above and nowhere else.

Which means the public numbers are mostly describing the first three rows. For a second read on your own title and metro before you post, the salary benchmark assistant is free and does not require a call with anyone.

Developers Who Crossed Over Cost More Than the Analysts Who Stayed

Three kinds of people end up in this job. Developers who got interested in security. Penetration testers who got tired of writing reports. Analysts who moved sideways out of governance or the SOC. Each arrives with a different salary history and a different weak spot.

A software company outside Salt Lake City had two finalists last spring. One had written Java for seven years, spent the last two reviewing pull requests for security flaws, and asked for $168,000. The other had six years in security, two of them running a scanner against internal applications, and asked for $139,000. The hiring manager took the cheaper candidate, and nobody could fault the decision on paper. Eight months later the company had a tidy, de-duplicated backlog and a developer population that had stopped answering the security engineer’s tickets. They opened a second req for the first candidate’s profile at $171,000. That was not cheaper.

The gap between those two asks was $29,000, most of a full row in the table. What it paid for was credibility with the people who have to act on the findings. Credibility is the product. A candidate who has merged a fix into a production repository can usually prove it in the first interview, and a candidate who has only filed tickets about other people’s code cannot.

Penetration testers price on a third path, covered in our penetration tester salary guide. They tend to be strong at finding and thinner on fixing. That is a fine trade for the right seat and a bad one for row four.

What Pushes an Offer to the Top of Its Row

Inside any row, a handful of things decide whether the number lands low or high.

• Mobile. Reviewing iOS and Android binaries is a small corner of an already small field, and employers that need it pay toward the top of whatever row they are in.
• Which language is the codebase written in? Reviewing C# and .NET for a bank is a different skill from reviewing TypeScript services for a software company, and candidates know exactly which one they have done.
• Authorization logic. The flaw that only appears when two features collide is the one no scanner reports, and an engineer who has found one in production can name the date.
• Regulated data. Payment card, health, and lending environments want audit evidence along with fixes. That paperwork is part of the job, and it prices accordingly.
• Generated code. More teams now ask an engineer to review output from AI coding assistants alongside code written by hand.

That last item is new enough that I have no pay data on it, and I would distrust any page that claims otherwise. What I can say is that the postings have started naming it, and candidates have started asking whether the team has a policy.

Where the Metro Matters and Where It Does Not

BLS publishes metro wages for information security analysts, not application security engineers, so treat this as the shape of the geography and not the dollar figure for your req.

Source: BLS OEWS metropolitan area tables, May 2025, SOC 15-1212, retrieved through the BLS public data API.

San Jose to Chicago is $50,810. Below the top three, though, the next ten metros sit inside a $24,000 band, from $148,950 in Washington to $125,310 in Chicago, and that is narrower than the step from row two to row four of the lane table. Scope moves an offer further than geography does. Scope wins. A design review lead in Dallas outearns a scanner operator in San Jose, and candidates holding two offers do not compare metros anyway. They compare the number. Employers who price a senior seat from a local median and open it to remote applicants find that out in the first week.

Certifications Move the Shortlist, Not the Offer

Candidates list credentials before anything else, so a word on them.

The OSCP and the GIAC web application credentials tell you that somebody was tested on attacking applications. The CSSLP covers the secure software lifecycle from end to end, and ISC2 requires four years of cumulative, full-time experience in one or more of its eight domains for full certification, so the credential skews toward people who are already experienced. The CISSP is a management exam. Not one of them predicts whether developers will act on that engineer’s review comments.

I know of no public data that isolates a certification premium for this role, and the pay sites above do not report one. What a credential does is get a resume past a screen. It sorts a shortlist. It does not lift an offer by itself, and it matters least in rows four through six, where a candidate’s design reviews carry the case.

Total Pay Is Mostly Base Until Somebody Offers Stock

PayScale’s 23 profiles put application security bonuses at $1,000 to $25,000 and profit sharing at $0 to $8,000, which stretches the $67,000 to $151,000 base range to $67,000 to $170,000 in total pay. Bonuses are modest. Ask what the bonus paid out at last year, not what it targets. Targets are not payouts.

Stock is a different world. Equity changes the picture. Our broader guide to security engineer pay adds 20 to 40 percent to total compensation at public technology companies where RSUs are standard, and the product security seats in rows five and six are exactly where that happens. A $190,000 base at a late-stage software company and a $190,000 base at a regional insurer are not the same offer, and a candidate comparing the two will say so.

Contract Rates for the Same Seat

Some of this work has a finish line. A threat model before a launch. A burn-down of two years of old penetration test findings. A script inventory for a payment page before an assessor arrives. Those are projects. They end, and contract terms fit them better than a permanent seat does.

Our Contract Rate Index does not break application security out of the wider security line, so the nearest figures are for security analysts and engineers at all levels. They are bill rates, meaning what a client pays per hour including employer burden, and not what reaches the engineer’s paycheck.

Source: KORE1 Contract Rate Index, 2026-Q4, effective October 16, 2026, modeled from BLS OEWS May 2025 wages plus a 24 percent employer burden, with observed medians where we have five or more placements.

Seven placements is a thin sample. Treat it that way, and do not quote the observed row to a CFO. The senior line is the closest we publish for a design-stage seat. Where the work has a date attached, contract staffing keeps the cost to the project. Where the seat is permanent and the pay band is settled, direct hire is cleaner. A fixed-scope review of one codebase is also available through our code audit services without opening a req at all.

What Came Back From the Compensation Committee

Our HR system says this job tops out at $145,000

Then the seat is probably graded against the wrong job family. Compare duties, not titles. If the engineer reviews designs, holds releases, and fixes code, the engineering grade is the honest comparison, and it usually has more headroom than the security one. Start there.

Can we promote one of our own developers into the seat?

Often, and it is usually the cheapest route on paper. A developer who already has the team’s trust does not need to earn it, and that is the hardest thing to hire. The weak spot is threat modeling, which is a separate skill from writing secure code, so plan a contractor or a training budget for the first quarter. Budget for it.

$150,000 is the ceiling. What does that realistically buy?

$150,000 buys row two of the lane table in most metros, and row three in a few. It does not buy design-stage ownership. Not at that number. Posting a design review lead seat at that number is how a search stalls for a quarter.

Do we have to pay Bay Area numbers for a remote hire?

Not quite. Candidates will quote San Jose anyway, and the metro table shows why, since the gap to Chicago is $50,810. Pay for the scope of the seat and the market the candidate can actually choose from, and be ready to explain the logic in the first call so the conversation does not stall at the offer.

How long should we tell the board this will take?

Six weeks, give or take, from an approved req to an accepted offer. Our IT searches average 17 days across the whole desk, but application security is a narrow pool. A fair number of the strong candidates are not looking. A req that names one row and prices it honestly closes faster than one that tries to cover three.

Are AI coding assistants pushing these salaries up?

I cannot show that they are, and I distrust pages that claim to. What has changed is the posting, which now asks for review of generated code. Expect the question to show up in interviews before it shows up in base pay. Interviews move first.

Let the Earliest Stage Pick the Row

The Tampa processor never had a budget problem. It had a filing problem that happened to look like one.

Write it down. Before the req is posted, name in one sentence which of the six lifecycle stages the seat will own, and let the earliest stage on that list set the row. The grade, the engagement type, and how much a resume’s certificates should count all follow from it. A team that settles this first spends its time interviewing. A team that settles it after two declined offers spends that time apologizing to candidates, and the offer that finally lands is usually higher than the first one would have been.

KORE1 opened in 2005 and now fills IT and security searches in more than 30 U.S. metros. Retention is the number I would ask any agency for on a seat this specialized, ahead of fill time, and ours is 92 percent at twelve months across everyone we place. If a req is sitting at a number that does not match the work, bring the scope to a call with our application security recruiters and we will tell you which row it belongs in.