Related: cybersecurity in Germany, learn penetration testing, who is a pentester, how to become AppSec, mentoring.
People ask me the same question about France: is it realistic to actually work there in AppSec or pentest, or does it all come down to the language barrier and a tough market? Usually the person already has some QA or development background, opens the job boards, and freezes within an hour. It is unclear where to aim, how strictly French is required, and what counts as a normal first entry.
The work exists, but the market is uneven and has its own specifics. Most openings are concentrated around Paris and the Île-de-France region — that is also where you most often find teams that can work in English. Lyon, Toulouse, and Nantes hire too, and remote roles exist. But if you set a hard filter of “all of France, remote only, no French,” the options shrink quickly.
How the hiring market works
In practice, the hiring manager cares about simple things: can you test an application, find vulnerabilities, and calmly explain business risk. The team lead usually thinks in basic terms: can this person review an API, verify a developer's fix, write a clear report, and work normally with the engineering team. Certificates and impressive job titles can help you pass the first HR filter, but on their own they do not replace practical work.
In France it helps to understand how the market splits by company type — these are different doors, with different requirements, interview processes, and expectations:
- Consulting and ESN (Entreprises de Services Numériques). Service companies and integrators offer the most open positions. You can enter as an AppSec engineer, security tester, or a specialist who tracks vulnerabilities across client projects (banks, industry, retail). The upside is plenty of practice and a faster entry. The downside is that French shows up much earlier in client meetings, and reports must be written very carefully, since they are read by management on the client side.
- Product companies and scale-ups (mostly Paris). They hire Application Security or Product Security engineers once basic automated scanners are no longer enough. Fintech, SaaS, and marketplaces look for people closer to engineering: threat modeling, API review, integrating checks into CI/CD, and periodic internal pentests before release. This is the most realistic English-first path.
- Large corporate sector, finance, defense, and aerospace. They hire more slowly and the selection process is more bureaucratic, but those who get through are offered good conditions and are expected to have mature habits: systematic tickets, an evidence base, mandatory retests, and strict process discipline.
- Boutique pentest. Small specialized firms that hire people able to run a quality web/API assessment from defining the scope to the final report. Here the French client expects the risk described in plain words, not an automated scanner export.
Salaries in France (2026 orientation, gross per year)
There is no single salary bar in French cybersecurity: it all depends on the role, region, and work format. Below are current orientation ranges for the private sector, in euros (before tax):
| Level / Experience | Salary range | Notes and nuances |
|---|---|---|
| Junior / first role | €38,000 – €52,000 | In Paris and strong product teams, more often closer to €50k+. In consulting the base can be more modest but offset by benefits. |
| Mid (2–5 years of experience) | €55,000 – €75,000 | In Paris AppSec and pentest, the upper end is reached with confident work on APIs, JWT/OAuth, and authorization logic. |
| Senior / Lead | €75,000 – €100,000+ | An orientation for Paris and in-demand specialists. In the regions the bar is usually lower. |
What to pay attention to
Paris offers the highest pay, but a large part of that difference is eaten up by rent. Outside Île-de-France salaries are lower, but so is the cost of living. The open-ended employment contract in France (CDI) provides social protection and feels different from project-based work. When comparing offers, look at the whole package: remote work, extra days off (RTT), bonuses, and the contract type.
Do you need French?
The honest answer depends on which segment of the market you are heading into.
- English only: realistic in international product teams and Paris startups. There, technical proof and the ability to communicate with developers are valued more than the local language.
- French required: in consulting with local clients, in the public-adjacent sector, banks, and large traditional corporations. Even if tickets and code are in English, working calls and incident discussions are often held in French.
A practical compromise: keep your technical portfolio and CV in English. Learn French in parallel — for calls, clients, and daily life. In interviews employers respond well to the approach: “I do technical work in English, and I'm actively learning French for communication.”
Which technical skills are actually tested
For AppSec and Web/API pentest in France, the technical round looks at fundamentals:
- Networking and protocols: understanding how HTTP/HTTPS works, the structure of REST APIs, response codes, token passing, cookies, redirects, and how sessions are built.
- Access Control: the main practical skill. The ability to find logic flaws — IDOR/BOLA (accessing another user's object by changing an ID), privilege escalation, tenant isolation, and unprotected endpoints.
- Burp Suite: the ability to intercept, modify, and replay requests, take notes, and record the steps of an attack.
- Reading code and fixes: the ability to open a Pull Request, spot a dangerous place in the code (Node.js, Java, Python, .NET), and suggest a correct fix to the developer.
- Writing reports: a report that reads in a couple of minutes — clear reproduction steps, proof (PoC), risk in plain words, and concrete remediation recommendations.
Switching from QA and development
From QA / SDET
You already have a strong base: test design, an understanding of APIs, experience with CI/CD, and the habit of defending your findings to developers. Add skills for testing logic abuse (bypassing checks, tampering with parameters, expired tokens) and prepare a couple of clean reports. Product companies in Paris highly value specialists with a background in automation and testing.
From development
It is easier for you to read code and suggest architectural fixes. The main task is to shift your thinking from “how to build a feature” to “how this feature can be abused.” Start with practical steps at your current job: run a security audit of one feature, clean up how secrets are stored, and go through the security of authorization. French product teams will often prefer a developer with a security mindset over a candidate who only has theoretical certificates.
A practical preparation plan
If you study regularly in the evenings and on weekends, preparation for a first offer usually takes 6 to 12 months:
- Basics and Burp (months 1–2): deploy a training vulnerable application. Learn to intercept and modify traffic through Burp Suite. Build the habit of documenting every step.
- Focus on access control (months 3–4): find and record at least three vulnerabilities related to permission boundaries and ID tampering. Write one of the cases up as a full professional report.
- Full cycle and LinkedIn (months 5–6): run one full testing cycle (scope → test → report with 4–6 findings → retest). Clean up your LinkedIn profile, clearly stating your positioning (AppSec / Web Security).
- Interviews and adjustment (months 6–12): start targeted applications (Paris Product AppSec, pentest boutiques, consulting). Record the reasons for rejections and close the gaps you find.
Common candidate mistakes
- Copying US-centric roadmaps that focus on passing certificates instead of hands-on lab work.
- Applying only to “Senior Remote English” positions while holding a beginner's portfolio.
- Ignoring French, betting that “everyone speaks English anyway.”
- Submitting reports as a raw export from automated vulnerability scanners.
- No clear positioning sentence at the screening (“I'm interested in all of security” instead of “I specialize in Web/API and access control”).
Paperwork and visas
Citizens of non-EU countries should keep visa sponsorship in mind. French companies are willing to handle paperwork and sponsor relocation for Mid and Senior specialists. For junior positions employers rarely start the visa process unless they already have an internal procedure in place. Discuss the visa question and timelines directly with HR in the early stages.
Training and mentoring
If you need systematic practice in Application Security and hands-on pentest with real report reviews aligned to the European market, see the program on the Application Security Engineer page.
To put together an individual preparation plan for your background, message me on WhatsApp. Details of the format are in the cybersecurity mentoring section.
Also: cybersecurity in Germany, learn penetration testing, who is a pentester, how to become AppSec, mentoring.
I teach AppSec and practical pentest for people aiming at real jobs — including France. Need a plan for your background? Message me on WhatsApp.
