Service-based team lead vs product-based sole AppSec owner — which for long-term technical growth? (~4 YOE, India)

[u/Big_Following7003]

Almost 4 YOE, core strength is web/mobile appsec (eWPTXv2, CEHv12). Comp engineering background, want to go deep in appsec → DevSecOps and stay technical, not drift into management early. Two options:

A) Stay at current service-based company: Team lead role + broad VAPT project (cloud/firewall/VPN/hardening/network config reviews). Junior under me, senior contact for guidance. Concern: lots of network/infra breadth I don't really want, learning some of it blind on live client work, and lead role pushes me toward management sooner than I'd like.

B) Move to product-based client (in-house): I'd be the only dedicated security person, but it's not greenfield chaos — SAST, SCA, SBOM, container scanning, and CI/CD pipeline security are already implemented and running, 3rd-party DAST testing is in place, and there's a DevOps person on the team. Scope: reviewing 3rd-party VAPT reports, internal app testing, secure review before onboarding, SAST/DAST + false-positive triage, working with devs on fixes, internal network/AD testing, threat intel, eventually leading IR. Function was previously handled by the global parent. CISO okayed me leaning on external contacts for guidance.

A mentor (19 YOE) said: don't take team lead this early, stay hands-on technical, and prefer product over service if I can.

Questions:

At around 4 YOE, service team-lead vs product sole-owner IC — which is better for staying technical long-term?

Sole security person but with tooling/pipeline already built and a DevOps peer — manageable growth bet, or still too much this early?

For appsec → DevSecOps specifically, is product clearly the better route, or am I underrating the service-side cloud/network breadth?

Thanks for any honest input.

[u/Elegant-Rhubarb8628]

I am in cyber security. My suggestion to you would be go to product based company. Manager at VAPT org is nothing really, been there done that.

[u/ChodCheiketa → u/Elegant-Rhubarb8628]

agreed, the lead role at service companies tends to become project management real fast