I agree with majority of things you mention but wanted to point a couple of things out: > There is a huge market for security engineers If you have a look

I agree with majority of things you mention but wanted to point a couple of things out: > There is a huge market for security engineers If you have a look on Linkedin for "Application Security Engineer" jobs in London, UK you would find there are not that many, some companies don't even have AppSec Engineers. > Does the company have an established security program? If not, do they have a roadmap for making one? For less mature company or company just starting out AppSec could be the force that creates and implements a security roadmap, adopting OWASP SAMM or BSIMM