I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in particular I should change or search for to find someone who can review code manually?

C# .Netcore 2.2

  • Does your job description include the line "manually inspect code" or "code review"? It's hard to know what to change without knowing what you are asking for.
    – schroeder
    May 22 '19 at 10:32

When you hire someone, you do so because you expect that they provide value to your company. What are your expectations for your Application Security Engineer?

If you answered "To make our product more secure", then it seems to me that you have not really thought too much about security. Perhaps it's also not your area of expertise, which is fine too. We all started at some point.

Ask yourself, what do you actually want this person to do? Are you looking for someone who finds flaws and suggest reactive measures? Or are you looking for someone who improves your processes and overall code architecture to improve your security proactively?

Once you have settled for what you actually want the future employee to provide for your company, ask yourself how their skill set fits into this. For instance, if you are dealing with a codebase that is very broken due to no existing security knowledge at all, then perhaps someone who has good experience building secure architectures may be a good option.

But don't be discouraged if a future employee does not 100% fit the role you had hoped for them to do. People evolve, and if you actively aim to getting this employee where you want them to have (e.g. by offering them specialized training, sending them to conferences, etc.), then you will inevitably end up with someone very valuable to your company infrastructure.

I know that "It depends on what you want" is not the answer you may have hoped for. It certainly would have seemed to be much easier if I had listed a number of skills and certifications that person would need to have, but ultimately this isn't the way you would want to go.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.