Senior App Security Engineer: Web & API Security Lead

PepsiCo; Warszawa; On-site; PLN 162,000 - 198,000; Full time

Job summary

PepsiCo’s Global Application Security Program seeks an engineer to secure web apps and APIs at scale. You will configure scanners, triage findings, and lead remediation guidance while integrating security into developer workflows.

The role focuses on backend automation, continuous integration, and collaboration with DevOps and product teams to enforce security guardrails and risk-based prioritization.

Qualifications

• Bachelor's degree and 3–5 years in application security or related field.
• Experience configuring and integrating security tools across enterprise development environments.
• Strong knowledge of OWASP Top 10 and API security.
• Experience with CI/CD integrations and security automation.

Responsibilities

• Configure, tune, administer, and maintain scanning tools (SAST/DAST/SCA/Secrets).
• Manually triage findings, reproduce issues, assess exploitability, and provide remediation guidance.
• Conduct targeted security reviews of web apps and APIs, including auth, access control, and input validation.
• Develop and maintain SAST/DAST rules, policy packs, and quality gates.
• Integrate findings into CI/CD and developer workflows via APIs and webhooks.

Skills

SAST/DAST/SCA

Burp Suite

OWASP Top 10

CI/CD security integration

Python/Go automation

API security

REST APIs

DevOps collaboration

Education

Bachelor's degree in Computer Science or related field

Tools

Burp Suite

Postman

curl

Browser Dev Tools

Jira

Job description

PepsiCo’s Global Application Security Program seeks an engineer to secure web apps and APIs at scale. You will configure scanners, triage findings, and lead remediation guidance while integrating security into developer workflows.

The role focuses on backend automation, continuous integration, and collaboration with DevOps and product teams to enforce security guardrails and risk-based prioritization.