I’m an AppSec engineer and the bulk of my work is application pentesting/security assessments.

Even within appsec the roles can vary quite a bit…some folks just do sdlc security for example.