Application Security Engineer — Cloud-Native & Automation

PepsiCo Deutschland GmbH; Plano (TX); On-site; USD 80,000 - 134,000; Full time

Job summary

PepsiCo is seeking a security-focused professional to implement and operate foundational application security controls and enable automation at scale. The role emphasizes reducing false positives, prioritizing remediation, and partnering with engineering teams to embed secure development practices.

Responsibilities include tuning tools, establishing baselines, optimizing workflows, and contributing to a 24/7 on-call rotation.

Qualifications

• Bachelor’s degree in computer science, Engineering, or a related technical field with 3–4 years of experience.
• Experience with secure software development and identifying vulnerabilities within application code.
• Experience analyzing application security findings and providing actionable remediation guidance.
• Hands-on experience with application security, vulnerability management, and security engineering.
• Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.
• Experience with SAST, SCA, Secrets, DAST, API, and Container security tools.
• Experience deploying, configuring, and managing Web Application Firewalls (WAFs).
• Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar).
• Understanding of OAuth, JWT, authentication, authorization, and access control.
• Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching.
• Familiarity with securing CI/CD pipelines and integrating security into development workflows.
• Strong written and verbal communication skills.

Responsibilities

• Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
• Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
• Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
• Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
• Integrate security tool outputs into centralized vulnerability management workflows.
• Validate findings, investigate false positives, and track remediation through closure.
• Partner with engineering teams to implement security guardrails and secure development practices.
• Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
• Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
• Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
• Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
• Develop and maintain technical documentation, operational runbooks, and security standards.
• Support vulnerability response, remediation activities, and application security incident investigations.
• Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
• Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
• Participate in a 24/7 on-call rotation, including weekends and holidays.

Skills

Python

Go

Education

Bachelor’s degree in computer science, Engineering, or a related technical field

Tools

SAST

SCA

DAST

API security

Container security

Job description

PepsiCo is seeking a security-focused professional to implement and operate foundational application security controls and enable automation at scale. The role emphasizes reducing false positives, prioritizing remediation, and partnering with engineering teams to embed secure development practices.

Responsibilities include tuning tools, establishing baselines, optimizing workflows, and contributing to a 24/7 on-call rotation.