How to Find Remote Application Security Jobs

This guide covers the job titles worth searching, where remote AppSec ads appear, and how to read their location rules from Lagos or Kano. It also lists the skills hiring managers check and gives you a weekly routine. We're honest about the hard part too: remote AppSec is rarely an entry-level job. Most people get in from software development, QA or penetration testing, and we explain how that move works.

Quick answer

Remote application security jobs are mostly advertised on company Greenhouse, Lever and Ashby boards. Search for "application security", "product security", "AppSec" and "DevSecOps", then keep only ads open to Nigeria, Africa, EMEA or worldwide. Employers usually want developers or testers who know the OWASP Top 10, secure code review and CI/CD security tooling. Before you apply, confirm on the live ad that it accepts Nigerian residents.

What application security work is, and the job titles to search

Application security (AppSec) is about keeping the software a company builds secure. Network or SOC (security operations centre) teams watch infrastructure and alerts. AppSec people work alongside developers instead. They review code and designs, run threat-modelling sessions, add security scanners to build pipelines and help engineers fix the bugs those scanners find.

Companies don't all use the same name for this job, so searching only "application security engineer" misses a lot. These titles usually mean the same work, or work that overlaps heavily with it:

Three abbreviations come up in almost every ad. SAST (static application security testing) scans source code. DAST (dynamic application security testing) attacks a running app. SCA (software composition analysis) checks open-source dependencies for known vulnerabilities. If an ad mentions all three plus "SDLC" (software development life cycle), it's an AppSec role, whatever its title says.

Who gets hired: realistic routes into remote AppSec from Nigeria

Very few remote AppSec vacancies hire juniors. Most of the ads we read while researching this guide asked for prior engineering or security experience, and senior titles were common. You'll find it easier if you think of AppSec as a second step, not a first job.

Route 1: software developer to AppSec

This is the most common route. Backend, full-stack and mobile developers already read code all day, and AppSec teams need people who can say, "this endpoint is missing an authorisation check, here's the fix". If you're a developer, become the person on your current team who handles security reviews, dependency updates and scanner findings. Then write that experience up on your CV in concrete terms. Our software engineer career guide covers the developer foundation if you're still building it.

Route 2: QA or penetration testing to AppSec

Testers who already think about how software breaks can move across by learning to read code and recommend fixes, not just report findings. Penetration testers have an advantage on the testing side but often need to strengthen their code review and their ability to work with developers. Our planned guide to remote penetration tester jobs covers that neighbouring role.

Route 3: DevOps or cloud to DevSecOps

If you run CI/CD pipelines or cloud infrastructure, adding SAST, SCA, secrets scanning and container scanning to those pipelines leads naturally into DevSecOps roles. The DevOps engineer career guide explains the base skills.

If you're starting from zero in security, read our cybersecurity analyst career guide and the planned guide to entry-level remote cybersecurity jobs first. AppSec usually comes after you can already write or test software.

Where remote application security jobs are advertised

Company ATS boards (the main source)

Most technology companies post vacancies through an applicant tracking system, and many of these systems publish public job boards that search engines index. You can search them directly with Google's site: operator:

Swap in "DevSecOps", "AppSec" or "secure code review", and add "Africa", "EMEA" or "worldwide". Expect plenty of noise. Search engines don't always respect the site: filter, and many results are US-only or already closed.

Ads close quickly. During our research on 27 October 2026, a remote "Senior Security Engineer, Application Security (EMEA)" ad that still ranked in search results redirected to the company's general jobs page when we opened it, which means it had closed. Open the ad itself, check it's live, and only then spend time on a tailored application.

African fintechs and companies with African engineering teams

Payment and banking companies run some of the most active AppSec programmes on the continent, because regulators and card schemes expect them to. These employers are often the most realistic first remote AppSec job for someone living in Nigeria. They hire in African time zones and often state "Remote, Nigeria" outright.

Two examples from our research, as of October 2026:

• The Remote From Africa newsletter of 9 October 2026 listed a mid-level Application Security Engineer role at Paystack, recruited through Talent Safari, marked "Remote (Pan-African)". When we tried the application link on 27 October 2026 it returned "not found", so that vacancy had probably closed. Even so, it shows the kind of employer to watch.
• Moniepoint's Greenhouse careers board, checked on 27 October 2026, tags many roles "Remote, Nigeria" (compliance, fraud, finance and others). The page we checked had no application security vacancy that day. It's still worth bookmarking, along with the boards of other Nigerian and pan-African fintechs.

We don't vouch for either employer. Check every vacancy on the company's own site.

Global remote companies hiring in EMEA

Some all-remote companies hire security engineers across EMEA (Europe, the Middle East and Africa). "EMEA" in an ad does not automatically include Nigeria, because some companies can only pay people in countries where they have an entity or an employer-of-record (EOR) arrangement. Our planned explainer on what EMEA means in a remote job ad covers how to check.

WorkRemote.ng and community sources

Our tech job listings on WorkRemote only include remote roles open to applicants living in Nigeria, and each listing shows where applicants may live. Search them for "security". Security community Slack and Discord groups, OWASP chapter meetups and the monthly "Who is hiring?" threads on Hacker News are also worth checking. Treat anything you find there as a lead to confirm on the employer's own careers page.

How to read the location line in an AppSec ad

Read the location rule before anything else. Here's how the common phrases usually work out for someone in Nigeria:

Check the application form as well as the ad. A country dropdown that leaves out Nigeria, or a question such as "Are you authorised to work in the United States?", tells you what the ad doesn't. Our planned guides on what "worldwide remote" means from Nigeria and checking whether a job accepts Nigerian residents go into more detail.

What AppSec hiring managers check

Core knowledge

• The OWASP Top 10. The current edition is the OWASP Top 10:2025, whose categories run from A01 Broken Access Control and A02 Security Misconfiguration to A03 Software Supply Chain Failures, A05 Injection and A10 Mishandling of Exceptional Conditions. Interviewers expect you to explain each category with a code example and a fix, not just recite the list.
• Secure code review in at least one language the company uses. Check the ad's stack (Go, Java, Python, Ruby on Rails, TypeScript and so on) and practise reviewing pull requests in that language.
• Threat modelling. Draw a data-flow diagram of a feature, mark the trust boundaries and list what could go wrong.
• Pipeline tooling. Know how SAST, DAST, SCA and secrets scanning fit into CI/CD, and how to stop scanners flooding developers with false positives.
• Cloud and APIs. Most modern AppSec work involves REST or GraphQL APIs, authentication flows such as OAuth and JWTs, and at least one cloud provider.

Hands-on testing practice

PortSwigger's Web Security Academy is free and has interactive labs on SQL injection, cross-site scripting, access control, OAuth, JWT attacks, request smuggling and other topics. It's the cheapest serious way to build web testing skill from Nigeria. Bear in mind that it uses a lot of data if you work on a mobile connection.

Certifications that fit AppSec

Certifications help you get past recruiters, but they rarely replace evidence of real work. Two that match AppSec closely:

PortSwigger says the Burp Suite Certified Practitioner is valid for five years and that candidates need an active Burp Suite Professional subscription. The exam guidance describes a four-hour exam with two vulnerable applications, each with three stages. According to the certification FAQ, the exam is open book and uses automated proctoring with an ID check. The exam fee and the Burp Suite Professional subscription are separate costs, so check both current prices on PortSwigger's site before budgeting.

ISC2's CSSLP page lists eight domains, from secure software concepts to the secure software supply chain. It suits people who already have years of experience, not newcomers. Our planned guide to cybersecurity certifications for remote jobs compares wider options.

Proof that gets an AppSec application shortlisted

Hiring managers in AppSec are usually engineers. They want evidence they can open and read. A useful portfolio might include:

• Write-ups of PortSwigger labs or capture-the-flag (CTF) challenges that explain the root cause and the code fix, not only the exploit.
• A small deliberately vulnerable app you built in your main language, plus a write-up of how you found and fixed each issue.
• A public CI pipeline (GitHub Actions, for example) running SAST, SCA and secrets scanning on a sample repo, with notes on how you tuned the rules.
• A threat model of a well-known app feature, such as password reset or a money transfer flow.
• Security fixes merged into open-source projects, or responsibly disclosed vulnerabilities, if you have them.

Only test systems you own or have written permission to test. Bug bounty programmes set their own scope rules, and testing outside that scope can get you banned or into legal trouble. The planned guide to building a cybersecurity portfolio for remote employers covers presentation in depth.

What remote AppSec jobs pay, and what that means from Nigeria

No reliable public dataset gives AppSec pay for Nigeria-based remote workers, so treat any single figure you see online with caution. The best published benchmark is American. The US Bureau of Labor Statistics reports a median pay of $129,180 a year for information security analysts in May 2025 and projects 21% employment growth for 2025 to 2035. That figure covers US-based workers in a broad security occupation. It is a benchmark, not what a Nigeria-based contractor will be offered. Remote pay for people living in Nigeria is usually well below US local pay.

Pay for Nigeria-based workers depends on:

• Who employs you. A Nigerian fintech usually pays in naira, sometimes with a dollar element. A foreign company may pay in dollars, but often uses location-based pay bands.
• How you're engaged. Contractors are paid a gross fee and handle their own tax, while employees hired through an EOR get payslips and benefits. Our guide to contractor versus EOR employee arrangements explains the difference.
• Seniority. Senior AppSec and product security roles pay noticeably more than junior ones, and they make up a large share of remote ads.

Example (hypothetical): a foreign company offers a Nigeria-based contractor $4,000 a month for a mid-level AppSec role. At the WorkRemote house rate of ₦1,362 to $1 (CBN NFEM weighted average, 23 October 2026), that's about ₦5,448,000 a month before withdrawal fees and tax. This is an illustration of the arithmetic, not a market rate. Compare it with a naira offer only after deducting fees and tax on both sides. For withdrawal costs, see how to receive dollar payments in Nigeria. For tax on foreign income, see our remote work tax guide for Nigeria.

A weekly routine for finding remote AppSec jobs

1. Monday: run your saved searches. Run the ATS search strings above with three or four title variants. Open every promising ad and record the title, company, location line, stack and closing date in a spreadsheet.
2. Monday: delete the ineligible ones. Remove US-only, UK-only and closed ads straight away. Note "EMEA" ads and check the application form's country list.
3. Tuesday: check your target companies. Keep a list of 20 to 30 companies whose products you know (African fintechs, developer-tool companies, all-remote software firms) and check their careers pages directly.
4. Wednesday: tailor two or three applications. Match your CV bullets to the ad's language and stack. If it asks for Go and threat modelling, lead with your Go code review and a threat model you've written.
5. Thursday: add one portfolio item. Finish one write-up, lab series or pipeline improvement every week.
6. Friday: follow up and network. Message one AppSec engineer at a target company with a specific question about their work, not a job request.

Example (hypothetical): Tolu, a backend developer in Ibadan with three years of Node.js experience, takes on security tickets at her current job, finishes the Web Security Academy labs on access control and authentication, and publishes a GitHub repo showing SAST and dependency scanning in a Node.js pipeline. Her CV now has two security bullets with outcomes, and she applies mainly to fintechs advertising "Remote, Nigeria" or "Pan-African" AppSec roles. She doesn't apply to US-only senior ads.

Nigeria-specific things AppSec employers will ask about

Time zones and on-call

AppSec teams join incident calls when a vulnerability is being exploited. Nigeria is on WAT (UTC+1) all year. UK clocks went back on 25 October 2026, so Lagos is now one hour ahead of London. US Eastern is five hours behind Lagos until 1 November 2026 and six hours behind after that. If an ad mentions an on-call rota, ask in the interview which hours you'd cover.

Power, internet and devices

Security roles often come with a company laptop, a VPN and device-management software, and some employers forbid personal devices. You'll need reliable power (inverter, solar or generator backup) and two internet sources, such as a fibre or 4G router plus a phone hotspot. Being unreachable during an incident looks worse in security than in most jobs.

Background checks and access

Security employers often run background checks and ask for identity documents. That is normal after an offer from a verified company. It is not normal before any interview, or when the request comes through WhatsApp from an unknown recruiter. If anyone asks you to pay for "security clearance", training or equipment to get a job, walk away. Our guide to spotting remote job scams in Nigeria covers the warning signs.

Common mistakes when applying for remote AppSec jobs

• Applying to US-only ads anyway. These applications are usually filtered out automatically, and you lose time you could have spent on eligible roles.
• A CV that lists tools without results. "Used SonarQube" says little. "Cut critical SAST findings in our payments service from 40 to 3 in two quarters by fixing root causes" says a lot. (Use your own real numbers.)
• Treating AppSec as pentesting only. Most AppSec roles expect you to help developers fix issues and prevent them, not just find them.
• Ignoring the stack. A Ruby on Rails shop wants Rails-specific security knowledge. A generic OWASP answer is weaker.
• Collecting certificates instead of evidence. A certificate with no write-ups or code behind it rarely gets you past the technical interview.
• Not preparing for a code review exercise. Many AppSec interviews include reviewing a snippet live or as a take-home task. Practise talking through code out loud. Our cybersecurity analyst interview questions cover the general security questions that come up too.

Frequently asked questions

Can I get a remote application security job from Nigeria with no experience?

Rarely. Most remote AppSec ads want prior development, QA or security experience, and many are senior roles. The realistic path is to get experience as a developer or tester first, take on security tasks there, and move across once you have evidence of real security work.

Do I need a computer science degree for application security jobs?

Not always, but many US-focused employers list a degree, and the BLS lists a bachelor's degree as the typical entry education for information security analysts. Strong code review skills, a portfolio and relevant experience can make up for not having a degree at many startups and fintechs, especially ones hiring across Africa.

Which programming languages should I learn for AppSec?

Learn the language your target employers use, and learn it well enough to review it. Python and JavaScript/TypeScript are useful almost everywhere. Go, Java and Ruby come up often in product companies' ads. Being able to read several languages matters more than writing one perfectly.

Is Burp Suite Certified Practitioner worth it for remote AppSec jobs?

It can be, especially if you're coming from a testing background. It's a practical four-hour exam, it's valid for five years, and it builds on PortSwigger's free Web Security Academy. You also need a Burp Suite Professional licence, so budget for both costs and check current prices before you buy.

What is the difference between application security and product security?

There is usually little difference. "Product security" tends to mean AppSec for the software a company sells, sometimes with extra hardware, cloud or privacy duties. Read the responsibilities, not just the title.

Are remote AppSec jobs paid in dollars?

Jobs with foreign companies are often paid in dollars, usually to contractors through platforms such as Deel or Remote, or straight to a domiciliary or fintech account. Nigerian fintechs mostly pay in naira. Always confirm the currency, the payment method and your contract type (contractor or employee) before you accept an offer.

How do I know a remote AppSec job is real?

Find the same vacancy on the company's own careers page or its official ATS board, and check that the recruiter's email uses the company's domain. A real employer never charges you to apply, to be interviewed or for "clearance".

Key takeaways

• Remote AppSec vacancies are mostly on company Greenhouse, Lever and Ashby boards. Search them by title variant and location.
• Search "product security", "DevSecOps" and "Security Engineer, AppSec" as well as "application security engineer".
• Ads marked Pan-African, Remote Nigeria and some EMEA or worldwide ads are realistic from Nigeria. US-only and UK-only ads usually aren't.
• Most people move into AppSec from development, QA, pentesting or DevOps, not straight from school.
• Hiring managers want readable proof: write-ups, fixed code, threat models and tuned CI pipelines.
• The US BLS median of $129,180 (May 2025) is a benchmark only. Nigeria-based remote pay is usually lower and depends on employer, contract type and seniority.

Next steps

Start with our remote tech job listings and search "security". Each listing shows where applicants may live, and applying is always free. After a search, use "Get email updates" to save it as a free job alert so new matching roles arrive in a daily email. If your CV still reads like a developer CV with no security story, our Premium plan (₦29,999 a month) includes a CV and LinkedIn rewrite by a member of the team. For the bigger picture, see the planned guide to the best remote cybersecurity jobs for Nigerians.

Sources

• Information Security Analysts, Occupational Outlook Handbook, US Bureau of Labor Statistics
• OWASP Top 10:2025, OWASP Foundation
• Web Security Academy, PortSwigger
• Burp Suite Certified Practitioner, PortSwigger
• Exam hints and guidance, PortSwigger
• Certification FAQ, PortSwigger
• CSSLP, ISC2
• Global Remote Roles in Africa, Remote From Africa newsletter (9 October 2026)
• Moniepoint careers board, Greenhouse