Where is this demand you speak of because I have only had jobs building features for Incident Response or being a “DevOps Engineer” that implements secure pipeline, docker, logging, artifact repo scanning...

The need for App Sec is there as far as I’m concerned the demand is non existent... even though most red teams could make them cry.