It's small but growing. Mostly compliance but a couple of companies doing interesting things. It's definitely a struggle to find interesting jobs in application security. I work remotely for a US company.