We pay absolutely zero attention to certifications. I literally don't know what's in the SANS program.

Not taking Cody's classes wouldn't harm you here, or at any other high-end firm that I'm aware of. But actually taking it would signal a particular interest and engagement with appsec, which is something I would pay attention to.

If there is some other forcing function you have to get you to actually practice software security and find vulnerabilities, that too would be valuable.