I'm a mid level appsec engineer looking to upskill. I work in Microsoft and have heard it is really good to get this cert. Does anyone know much about it? I do know it's a very hard cert, 48 hours long

Started out as a security engineer 1 then promod to Security engineer 2 a year ago.

I'm looking for another job. Should I be applying to mid level career roles or senior roles?

I would say that I have had pretty meaningful projects.

I am not saying at all that people here are all unemployed. A lot of people are employed.

But Reddit is not always real life.

Something worth keeping in mind whenever you're gauging the job market from this sub: the people posting are skewed toward those who are currently looking for work. If you already have a job and aren't hunting, you're way less likely to hop on here and comment about how the market's going — you're just… working.

now the job market is rough across the board right now, but I'm curious how it's actually looking for mid-level security engineers specifically. I'm talking ~4-6 years of experience and past the entry-level scramble but not yet staff/principal.

I just want to state, when I get assigned to projects or help builders secure their apps, of course this includes at least some exposure to cloud security because all apps live in the cloud. A lot of my time goes to threat modeling, secure code review, and helping apps find threats in their design.

That said, I feel like my day-to-day is heavily weighted toward application-layer concerns, things like design flaws, api security, a lot of code review, etc.

For those of you who've made a similar transition (or work in cloud security and hire from AppSec backgrounds): How transferable are AppSec skills in practice? I'd assume threat modeling and understanding attacker mindset translate well, but what gaps should I expect?

What should I focus on studying? I'm thinking AWS/Azure/GCP certifications, but I'm not sure which ones actually matter vs. just being resume flair

Any resources, labs, or projects you'd recommend for building hands-on cloud security experience outside of work? Appreciate any advice. Trying to be intentional about this

Quick background: about 5 years as a security engineer at a FAANG company. Mix of application security, threat modeling, and product security. Fairly comfortable across the SDLC, work directly with dev teams, and have shipped real security outcomes.

My coding skills need work to be honest, I need to take a month or two to get up to speed, but I feel fairly confident in other domains with a bit of studying.

I have 5 years experience as a security engineer and was promoted to senior about a year ago

How is the current job market for mid-level engineers?