@sparring/tech-roles-library
Version:
Comprehensive tech roles and competencies library for 78 technical roles with 9 career levels each. Includes detailed competencies and career progression paths with complete bilingual support (EN/ES).
259 lines (258 loc) • 8.47 kB
JSON
{
"role": "Application Security Engineer",
"category": "Security",
"levels": {
"ASEC-L1": {
"level": "L1 - AppSec Trainee",
"levelNumber": 1,
"yearsRange": {
"min": 0,
"max": 1
},
"coreCompetencies": [
"Basic knowledge of application security",
"Elementary understanding of OWASP Top 10",
"Ability to execute basic security scans",
"Basic knowledge of common vulnerabilities (XSS, SQL Injection)",
"Ability to review code with supervision",
"Understanding of basic authentication and authorization",
"Documentation of security findings",
"Elementary knowledge of security testing"
],
"complementaryCompetencies": [
"Familiarity with basic Burp Suite",
"Basic knowledge of SAST/DAST tools",
"Elementary understanding of secure coding"
],
"indicators": [
"Requires constant supervision",
"Identifies basic vulnerabilities",
"Is learning application security"
]
},
"ASEC-L2": {
"level": "L2 - Junior AppSec Engineer",
"levelNumber": 2,
"yearsRange": {
"min": 1,
"max": 2
},
"coreCompetencies": [
"Ability to perform code security reviews",
"Implementation of basic security controls",
"Practical knowledge of threat modeling",
"Ability to configure WAF rules",
"Understanding of basic cryptography",
"Ability to execute basic penetration testing",
"Knowledge of secure SDLC",
"Ability to provide remediation guidance"
],
"complementaryCompetencies": [
"Knowledge of security frameworks",
"Ability to implement security automation",
"Understanding of container security"
],
"indicators": [
"Performs assessments with supervision",
"Implements security fixes",
"Contributes to secure coding guidelines"
]
},
"ASEC-L3": {
"level": "L3 - AppSec Engineer",
"levelNumber": 3,
"yearsRange": {
"min": 2,
"max": 3
},
"coreCompetencies": [
"Design of security controls in applications",
"Implementation of security testing automation",
"Mastery of penetration testing",
"Ability to perform complete threat modeling",
"Ability to perform security architecture review",
"Deep knowledge of authentication protocols",
"Implementation of secrets management",
"Ability to provide security training"
],
"complementaryCompetencies": [
"Knowledge of API security",
"Ability to secure mobile applications",
"Understanding of cloud security"
],
"indicators": [
"Leads security assessments",
"Designs secure solutions",
"Mentors on security practices"
]
},
"ASEC-L4": {
"level": "L4 - Senior AppSec Engineer",
"levelNumber": 4,
"yearsRange": {
"min": 3,
"max": 5
},
"coreCompetencies": [
"Architecture of application security programs",
"Design of security testing strategy",
"Implementation of security champions program",
"Mastery of advanced exploitation techniques",
"Ability to design secure architecture",
"Deep knowledge of zero-trust models",
"Ability to manage bug bounty programs",
"Leadership in security remediation"
],
"complementaryCompetencies": [
"Experience in compliance (SOC2, ISO27001)",
"Knowledge of DevSecOps",
"Implementation of security metrics"
],
"indicators": [
"Defines AppSec strategy",
"Leads security initiatives",
"Is a reference in application security"
]
},
"ASEC-L5": {
"level": "L5 - Lead AppSec Engineer",
"levelNumber": 5,
"yearsRange": {
"min": 5,
"max": 7
},
"coreCompetencies": [
"Technical leadership in application security",
"Design of enterprise security programs",
"Management of security teams",
"Definition of security standards",
"Ability to perform risk assessment",
"Implementation of security automation platforms",
"Mastery of vendor security assessment",
"Evangelization of security culture"
],
"complementaryCompetencies": [
"Experience in regulatory compliance",
"Knowledge of security partnerships",
"Management of security tools budget"
],
"indicators": [
"Manages AppSec team",
"Defines security vision",
"Represents security to executives"
]
},
"ASEC-L6": {
"level": "L6 - Principal AppSec Architect",
"levelNumber": 6,
"yearsRange": {
"min": 7,
"max": 10
},
"coreCompetencies": [
"Direction of corporate security strategy",
"Management of security programs at scale",
"Definition of security architecture",
"Leadership in security transformation",
"Management of major security incidents",
"Implementation of security governance",
"Innovation in security technologies",
"Management of security compliance"
],
"complementaryCompetencies": [
"Experience in security M&A",
"Knowledge of security investment",
"Leadership in security industry"
],
"indicators": [
"Directs AppSec department",
"Participates in executive strategy",
"Defines security investments"
]
},
"ASEC-L7": {
"level": "L7 - Director Application Security",
"levelNumber": 7,
"yearsRange": {
"min": 10,
"max": 12
},
"coreCompetencies": [
"Executive leadership in application security",
"Design of global security strategies",
"Organizational transformation via security",
"Management of security at Fortune 500 scale",
"Creation of security culture",
"Definition of security roadmap",
"Evangelization of security at board level",
"Influence on security standards"
],
"complementaryCompetencies": [
"Management of security budgets",
"Experience in security IPO readiness",
"Leadership in security consortiums"
],
"indicators": [
"Reports to CISO/CTO",
"Manages security organization (20+ people)",
"Defines corporate security strategy"
]
},
"ASEC-L8": {
"level": "L8 - VP Application Security",
"levelNumber": 8,
"yearsRange": {
"min": 12,
"max": 15
},
"coreCompetencies": [
"Strategic vision of enterprise security",
"Leadership in security transformation",
"Creation of security competitive advantage",
"Management of security ecosystems",
"Disruptive innovation in security",
"Definition of next-gen security paradigms",
"Evangelization of zero-trust",
"Influence on security policies"
],
"complementaryCompetencies": [
"Experience as CISO in scale-ups",
"Advisory in security startups",
"Thought leadership in AppSec"
],
"indicators": [
"Is part of the executive committee",
"Defines security strategy",
"Is a recognized leader in AppSec"
]
},
"ASEC-L9": {
"level": "L9 - CISO / Chief Security Officer",
"levelNumber": 9,
"yearsRange": {
"min": 15,
"max": null
},
"coreCompetencies": [
"Visionary leadership in corporate security",
"Transformation of security culture",
"Creation of security paradigms",
"Definition of security-first organizations",
"Innovation in security governance",
"Evangelization of security consciousness",
"Architect of security ecosystems",
"Influence on security regulation"
],
"complementaryCompetencies": [
"Experience transforming security in Fortune 500",
"Recognition as a security leader",
"Influence on security standards"
],
"indicators": [
"Is CISO or Chief Security Officer",
"Defines the future of security",
"Is a world authority in security"
]
}
}
}