Application security and secure software development require a mastery of multiple programming languages. You have teams that just do black box stuff and run ots tools and submit reports and recommended mitigation’s. Then you have teams that do white box stuff and do a deep dive into the application itself, the environment it’s deployed in, the technology stack, etc. Everything gets analyzed, automated tools are run, code is manually reviewed, interviews with design teams are had, interviews with network teams, interviews with c-suite (most people miss this), interviews with 3rd party vendors, etc. Reports are developed, remediation plans shared, and we would work together to fix the problems, then test again, and rinse and repeat quarterly. Secure software development requires the same mastery, only better. Where I worked, we actually built the software a very large security firm sold. They didn’t have the expertise. The talent in that space is very small. I’ve got a lot of good stories of you need/want to chat. Not sure what business you’re in.