Some mature orgs have done a good job of automating this, but it really depends on the industry. Finance and FinTech, for instance, are ahead of the curve here.

Some mature orgs have done a good job of automating this, but it really depends on the industry. Finance and FinTech, for instance, are ahead of the curve here. Most government entities on the other hand don't even realize there's a curve ahead, as do many utilities companies and some healthcare firms. So to your point about it being a big problem, "it depends on the company." As for strong developers in the appsec world, certainly. Especially if you have a strength in the automation side, you can easily carve a niche out for yourself. The main two areas where I can see a dev taking charge are in driving the use of security features in frameworks product teams already use (this is a HUGE bullet being pushed by notables in AppSec as it reduces the effort involved in uptake of secure coding practices) as well as in leading automation of new tooling in support of new frameworks. There's also the angle of developing custom solutions to address firm-specific problems, something appsec people without a strict development background will have a hard time doing. Quite a few appsec leads prefer bringing in developers with a breaker mindset in as appsec hires, so yes, there's always room. Depending on how you answer the question "what does 'secure ~10 webapps' mean?", you can probably easily score a lateral move into AppSec (Senior Dev -> Senior Security Engineer or Senior AppSec Consultant/Engineer). My keybase profile has all my contact info if you want more tailored guidance. Even if you don't join my firm or any of the other firms I have a hand in shepherding, we desperately need more people in appsec, so I'm all about sharing this knowledge.