Application Security | Application Security Engineer

Overview PepsiCo’s Global Application Security Program integrates security into software development at enterprise scale. Our mission is to make application security risks visible, actionable, and measurable so they can be remediated efficiently.

This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most.

Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance. Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards. Improve finding quality by reducing false positives and ensuring results accurately reflect business risk. Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities. Integrate security tool outputs into centralized vulnerability management workflows. Validate findings, investigate false positives, and track remediation through closure. Partner with engineering teams to implement security guardrails and secure development practices. Continuously evaluate and optimize security tooling, processes, and platform effectiveness. Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities. Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management. Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency. Develop and maintain technical documentation, operational runbooks, and security standards. Support vulnerability response, remediation activities, and application security incident investigations. Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives. Develop metrics and KPIs to measure program effectiveness and drive continuous improvement. Participate in a 24/7 on-call rotation, including weekends and holidays.

The expected compensation range for this position is between $80,200 - $134,250. Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process. Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually. Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement. In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.

Qualifications Years of Experience

Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience

Mandatory Technical Skills

Experience with secure software development and identifying vulnerabilities within application code. Experience analyzing application security findings and providing actionable remediation guidance. Hands-on experience with application security, vulnerability management, and security engineering. Experience securing cloud-native applications in AWS (preferred), Azure, or GCP. Proficiency with Python and/or Go. Experience with SAST, SCA, Secrets, DAST, API, and Container security tools. Experience tuning security scanners and reducing false positives, including OWASP Top