Roles · Application Security Engineer · Junior

What a Junior } should know

19 core skills, 54 in total. Expectations per skill, and what changes at the next level.

This page lists what a Junior } is expected to know and do, skill by skill. Core skills are the ones a manager and peers assess in a review cycle; the rest count only in self-assessment. Main areas: Cloud & Infrastructure, Security.

19core skills
35additional skills
2skill areas
0%at Advanced or Expert
Assess myself as Junior Full role matrix

Core skills for a Junior

Grouped by area. The label on the right is the expected depth: Awareness, Working, Advanced or Expert.

Cloud & Infrastructure · 1

Network Fundamentals Awareness

Understands HTTP/HTTPS, DNS basics, TCP vs UDP. Knows what ports, IP addresses, and localhost are. Can use curl for API testing.

Security · 18

Cloud Security Awareness

Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Dependency Vulnerability Scanning Awareness

Understands basic Dependency Vulnerability Scanning concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Digital Forensics Basics Awareness

Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

GDPR / 152-FZ Compliance Awareness

Understands basic GDPR / 152-FZ Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Incident Response Process Awareness

Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

JWT / OAuth2 / OIDC Awareness

Understands basic JWT / OAuth2 / OIDC concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Kubernetes Security Awareness

Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Network Security Awareness

Understands basic Network Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

OWASP & Application Security Awareness

Understands basic OWASP and application security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

PCI DSS Awareness

Understands core PCI DSS requirements for cardholder data protection. Follows secure coding guidelines aligned with PCI standards. Recognizes common application vulnerabilities that may lead to PCI compliance violations in codebases.

RBAC / ABAC Authorization Awareness

Understands basic RBAC / ABAC authorization concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

SAST/DAST Awareness

Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Secrets Management Awareness

Understands basic Secrets Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Secure Coding Practices Awareness

Understands basic Secure Coding Practices concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

SOC2 Compliance Awareness

Understands basic SOC2 Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Supply Chain Security Awareness

Understands basic Supply Chain Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Threat Modeling Awareness

Understands basic Threat Modeling concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Vulnerability Management Awareness

Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Additional skills

Not assessed by the team, but part of the self-assessment and the development plan.

Algorithms & ComplexityAPI DocumentationAPI TestingAsync ProgrammingAWSChatGPT / ClaudeCode Quality & RefactoringCode ReviewContainer Security ScanningCursor IDEData StructuresDesign PatternsDockerELK StackGit AdvancedGitHub Actions / GitLab CIGitHub CopilotGraphQL DesignIntegration TestingKubernetes CoreMultithreadingOOP & SOLID PrinciplesOpenTelemetryPostgreSQLPrometheus & GrafanaPrompt Engineering for CodeRate Limiting & ThrottlingRedisREST API DesignRunbook & Playbook WritingSecurity TestingStructured LoggingSystem Design FundamentalsUnit TestingWebhooks & Integrations

What changes at Mid-level

54 skills get a higher expectation or become core when moving from Junior to Mid-level. The biggest jumps first.

See the Mid-level page →
Run this with your whole team
Self-assessment plus manager and peer reviews against the same matrix, gap analysis and next-level readiness for every engineer. Team Pro is free for 14 days; individual tools stay free forever.
Start a team trial (14 days free) Send to my manager

} in the open competency matrix: 54 skills across 5 levels. The matrix is free for individuals and stays free.