Think like an attacker. Build like an engineer.
Not too long ago, software developers didn’t have to give much thought to security. The most important question they needed to get an answer to was, “Does it work?” Followed closely by, “Is it reliable?” and, “Is it user-friendly?
Then the internet came along. By the 1990s, software was exposed to the world — and that world, as it turned out, included a lot of people interested in breaking into other people’s software. Fast forward to 2025, where barbecues, shoes, and even egg trays have connected software, and it feels like for every application, there is an equal and opposite vulnerability just waiting to be exposed and exploited.
That’s where you come in.
When every line of code has the potential to become a security vulnerability, the developers who make the most impact aren’t just the ones who make things work in high-pressure, accelerated software development lifecycles (SDLCs) — they’re the ones who can make things work securely. By design.
The next generation of rockstar software developers will have a security-first mindset — and it will show. Here’s how you can leverage your security knowledge to build a satisfying — and successful — career.
Be the Calm at the Center of the Storm
Developers and AppSec teams are working in the eye of a software-defined storm. Code as everything — infrastructure, compliance, security, AI — is the new normal. The lines between software developer and security pro are blurring and converging. And the rockstar developers of the future will thrive in that space. While your peers are debating React vs. Vue for the thousandth time, you can be the one architecting systems to detect and mitigate zero-days in real-time, or engineering software that can withstand active attack.
And that starts with understanding the security challenges your AppSec colleagues are facing…
1. Familiarize Yourself With the Problem(s)
Fact of life: a lot of application development work relies heavily on re-use of code, libraries and other components. Why reinvent the wheel when pre-built, proven libraries exist for you to work with? How else will you keep up with accelerated SDLCs?
The use of third-party components and open-source code brings many benefits for developers, but it also introduces risk: much of today’s software supply chain contains code that has been around for many years, often without update. Not all of that code is vulnerable, but it’s worth knowing that the most common vulnerabilities, such as cross-site scripting (XSS), are tied to attack vectors that have been known for many years.
No one is suggesting that developers don’t care about security — modern applications are often complex, with many interconnected components and dependencies. The likelihood of vulnerabilities slipping through the cracks or being introduced through recycles or third-party code is high. For AppSec teams already wading through 100,000+ alerts, things can get overwhelming pretty quickly.
TLDNR: Lighten the load. Eighty-five percent of CISOs believe that vulnerability noise and alert fatigue are a significant challenge to finding, responding to, and remediating vulnerabilities. Developers can help reduce the burden by adhering to techniques that include regular code reviews using static analysis tools to catch insecure patterns before deployment, and referencing trusted resources such as the OWASP Cheat Sheet Series to reduce the risk of introducing common vulnerabilities.
2. Collaboration is King: Make Friends With Your Security Colleagues
As the saying goes, a problem shared is a problem halved — and there’s a lot of truth in there for software development and AppSec teams. An OX Security poll suggests there’s a hill to climb: 39% of AppSec pros say that friction between security and development teams is their top pain point.
Here’s another saying: In adversity, lies opportunity. Developers who learn how to work with their security colleagues can help support faster development by creating more secure software — and that’s unlikely to harm anyone’s career prospects.
How can you do that? Some quick wins include:
- Work to understand the performance metrics by which AppSec is driven, such as compliance and risk reduction. Think about how you can factor those into your processes and code.
- Find a common language that helps security colleagues provide tickets that you can both understand and act on. This builds trust and increases security.
- Work with security teams to hold shared standups and retrospectives.
TLDNR: Shared responsibility not only reduces the risk, italso reduces the burden for everyone. Open communication helps teams understand each other’s priorities and challenges, building mutual understanding and more secure software.
3. When They Shift Left, Get it Right
At a time when traditional software development work is at risk of becoming commoditized, security-focused development is becoming more complex — with more opportunities for human involvement at a strategic level. “Shift left” means integrating security earlier in the development process — multiple sources estimate that 70-75% of organizations have already done this or plan to do so.
Software developers who understand how every line of code or every architecture choice can be a strategic decision or risk calculation will thrive in this environment. Some pointers:
- Read and remediate scan results. This will help you develop the skills you need beyond fixing bugs, into understanding the why behind them.
- Welcome penetration testing and red teaming as part of the feedback loop that ultimately makes your code and applications better.
- Whenever you get the opportunity, contribute to secure design reviews. Your early involvement in architecture and design decisions will help position you as a go-to technical lead— the kind of visibility that often leads to promotion.
TLDNR: Security is a quality issue. Treat security bugs like functional ones: fix early, fix often.
4. Learn the Tools of the Security-First Trade
So far, a lot of what we’ve discussed has been mindset. But security-first developers also need to master some key tools and skills:
- Threat Modeling: This is a foundational skill, because learning to think like an attacker fundamentally changes how you design software. Security-first isn’t about plugging gaps later; it’s about designing with security from day one.
- Static and Dynamic Application Security Testing: Integrating SAST and DAST means you catch problems before they become incidents. Integrating these tools into the software development pipeline helps catch vulnerabilities early, before software is deployed.
- Software Composition Analysis: Every third-party library introduces potential vulnerabilities. SCA is a crucial tool for helping you understand the security implications of every dependency you include so you can make informed decisions.
- Infrastructure as Code Security: As everything moves to cloud-native, securing the infrastructure layer becomes crucial. Devs increasingly write (and manage) the cloud environments their applications run on; misconfigurations can expose entire systems.
TLDNR: Security-first developers don’t *just* write code, they build with defense in mind. These tools are a baseline to help you build secure, resilient software from the ground up.
5. Practice Makes Perfect
Ready to make the shift? Here are some practical steps you can take to learn and grow as a security-first software developer.
- Threat model your existing projects: Take something you’ve already built, ask yourself, “How could this be attacked,” and test it. Document everything, and learn from it.
- Use security-focused development tools: Install and integrate tools like OWASP into your workflow — don’t just run them, be curious about what they tell you about your code.
- Find your tribe: Participate in security communities. From local OWASP chapters to security researchers on social media and vulnerability disclosures, the security community is very welcoming to developers who have genuine interest in learning.
TLDNR: Security-first software development is inherently collaborative. The more you can do to familiarize yourself with the tools and build relationships with security teams, the easier it will be to position yourself as the bridge between development and security.
Your Security-First Development Career Starts Here
Security-first development isn’t about becoming a different kind of developer; it’s about becoming a better developer. You’re the one who understands that the best software isn’t just functional, it’s secure. As our tech future becomes increasingly software-defined, the future will belong to developers who think like attackers but build like engineers.
OX Security believes that the future of secure software development lies in uniting AppSec and engineering, not positioning them at odds. When we collaborate and learn from each other, we improve security outcomes, but also accelerate delivery timelines and strengthen product integrity.
