made this move about three years ago. was a backend swe, now appsec. the swe-to-security track is genuinely one of the better switches in 2026 if you have the right background, and the interview process is pretty different from typical swe loops. here's what i know.
certs. everyone asks about this. security+ is a checkbox for some job postings but doesn't carry much weight in actual conversations. OSCP is the one that gets reactions, especially for pentest-adjacent or offensive-track roles. for appsec specifically, the cert that helped me most was actually just being able to talk about CVEs, OWASP top 10, and doing a few bug bounty writeups. concrete demonstrated experience beats paper qualifications pretty consistently.
what the interview loop looks like for appsec/product security roles at tech companies (not regulated enterprises): usually a phone screen with the recruiter, a technical screen that might be CTF-style challenge or whiteboard threat modeling, a panel with a mix of security and engineering stakeholders, and sometimes a separate behavioral round with the hiring manager. the technical content is more specific than swe loops. you'll get questions like 'walk me through how you'd find an SSRF vulnerability in this service' or 'what would you look for in a code review of this auth flow.'
the swe background is a genuine advantage because you understand the developer side and can explain vulnerabilities in terms of code, not just theory. the biggest gap for most swe-to-security switchers is the adversarial thinking. you have to actually enjoy asking 'how could this be broken' more than 'how do i build this correctly.' if you don't find that mode of thinking natural, appsec will grind you down.
comp. appsec at mid-to-large tech companies in SF/NYC 2026: senior range $220k-$310k TC depending on company and equity. it's broadly comparable to senior swe, sometimes slightly lower at FAANG but sometimes higher at companies where security is understaffed.
if you have a swe background and are thinking about this switch, happy to be more specific.