We're a software security firm, and when promising candidates reach out to us and tell us they're worried that they don't have a lot of exposure to web app security, we buy them _The Web App Hackers Handbook_ (I invariably apologize for the stupid title) and _The Tangled Web_.
I think a lot of those security checklist things are a good guidemap of what you need to do. Then add to that a security book specific to your application's programming language(s)
