Application Security Engineer: Automate and Harden Apps

PepsiCo; Plano (TX); On-site; USD 80,000 - 134,000; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

Disability insurance

401(k) retirement plan

Employee Assistance Program

Job summary

PepsiCo is seeking an experienced application security professional to implement and operate foundational controls, optimize tooling, and enable automation at scale. You will improve signal quality, reduce false positives, and guide developers in remediating critical risks across cloud-native apps in AWS/Azure/GCP.

You will tune scanners, manage WAF/CDN security, and participate in Agile delivery. The role requires knowledge of SAST/DAST/SCA, policy-as-code, and secure DevOps practices to

Qualifications

• Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience.
• Experience with secure software development and identifying vulnerabilities within application code.
• Experience analyzing application security findings and providing actionable remediation guidance.
• Hands-on experience with application security, vulnerability management, and security engineering.
• Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.

Responsibilities

• Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
• Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
• Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
• Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
• Integrate security tool outputs into centralized vulnerability management workflows.
• Validate findings, investigate false positives, and track remediation through closure.
• Partner with engineering teams to implement security guardrails and secure development practices.
• Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
• Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
• Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
• Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
• Develop and maintain technical documentation, operational runbooks, and security standards.
• Support vulnerability response, remediation activities, and application security incident investigations.
• Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
• Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
• Participate in a 24/7 on-call rotation, including weekends and holidays.

Skills

Secure software development

Vulnerability remediation guidance

Cloud security (AWS/Azure/GCP)

Python or Go

CI/CD security integration

API security (OAuth, JWT)

WAF security

Policy-as-Code (OPA, Sentinel)

CDN and DDoS basics

Cryptography fundamentals

Education

Bachelor’s degree in CS, Engineering, or related field

Tools

SAST tools

SCA tools

DAST tools

WAF configuration

CI/CD tooling

Job description

PepsiCo is seeking an experienced application security professional to implement and operate foundational controls, optimize tooling, and enable automation at scale. You will improve signal quality, reduce false positives, and guide developers in remediating critical risks across cloud-native apps in AWS/Azure/GCP.

You will tune scanners, manage WAF/CDN security, and participate in Agile delivery. The role requires knowledge of SAST/DAST/SCA, policy-as-code, and secure DevOps practices to