You must have a basic understanding of how the product works, and familiarity with the security aspects of the web applications.