Senior Application Security Engineer

Overview

PepsiCo’s Global Application Security Program partners with development teams to identify and reduce security risk across enterprise applications and APIs.

Approximately 80% of this role focuses on SAST/SCA/Secrets/DAST and API security scanning technology. The engineer will support the operation and tuning of tools, manually triage security findings, perform targeted reviews using established procedures, assist developers with remediation, and manage findings through centralized vulnerability-management workflows.

The engineer will also help develop and maintain backend automation that initiates scans, monitors scan status, processes results, handles common failures, and integrates security tools into CI/CD and developer workflows.

The remaining capacity will support mobile application-security tooling and integrations as needed. Working knowledge of mobile security reviews is preferred but not required. This may include assisting with specific mobile-application security tooling scanning automation and CI/CD integrations under the guidance of senior engineers.

Responsibilities

1. Operate and support SAST/SCA/Secret/DAST and API security scanning tools.
2. Review, validate, and manually triage security findings, identify false positives, reproduce common issues, assess potential impact, and escalate complex findings when appropriate.
3. Perform targeted web application and API security reviews using established tools, standards, procedures, and test cases.
4. Assist with configuring and tuning SAST/SCA and Secret rules, policies, exclusions, severity mappings, and quality gates.
5. Assist with configuring DAST and API scan profiles, authentication workflows, crawl settings, scan scopes, schedules, and policies.
6. Support the integration of security tools into source-control, pull-request, build, CI/CD, ticketing, and developer workflows.
7. Contribute to backend scanning automation that initiates scans, monitors scan state, handles retries, retrieves results, and routes findings to downstream systems.
8. Process findings through centralized application-security or vulnerability-management platforms, including normalization, deduplication, ownership assignment, remediation tracking, suppression, and exception workflows.
9. Provide developers with clear remediation guidance and support validation and tracking of vulnerabilities through closure.
10. Monitor scan execution and integration health, troubleshoot common authentication, connectivity, configuration, timeout, and result-processing issues, and escalate platform problems as needed.
11. As needed, support mobile security finding triage and tooling, including assisting with backend automation and CI/CD integrations for mobile security scans.
12. Document findings, remediation guidance, scan configurations, integration procedures, troubleshooting steps, metrics, and operational activities while participating in Agile ceremonies and team support processes.
13. Support team incident rotation through on-call hours, including weekends and holidays as needed.

Qualifications

Years of Experience

• Bachelor’s degree in Computer Science, Engineering, or a related technical field, with 1-3 years of relevant professional experience in application security, security engineering, secure software development, or vulnerability management.

Mandatory Technical Skills

• Foundational understanding of web application, mobile application, and API security concepts.
• Experience with or exposure to SAST/SCA and Secret, including rules, policies, findings, exclusions, and CI/CD integrations.
• Experience with or exposure to DAST and API scanning platforms, including scan configuration, scope management, authenticated scanning, and finding review.
• Experience manually reviewing and triaging SAST/SCA/Secret, DAST, Mobile, and API-security findings.
• Ability to reproduce common findings, recognize likely false positives, gather supporting evidence, and document remediation recommendations.
• Familiarity with web, mobile and API testing tools such as Burp Suite, Postman, MobSF, curl, browser developer tools, or comparable technologies.
• Familiarity with the OWASP Top 10 and common web vulnerabilities, including injection, cross-site scripting, broken access control, authentication weaknesses, SSRF, security misconfiguration, and sensitive-data exposure.
• Familiarity with the OWASP API Security Top 10, including BOLA/IDOR, broken authentication, authorization failures, resource-consumption issues, mass assignment, and API inventory weaknesses.
• Basic understanding of API authentication and authorization, including OAuth 2.0, OpenID Connect, JWT, API keys, service accounts, and role-based access control.
• Ability to read and understand application code written in at least one language such as Java, JavaScript, TypeScript, Python, Go, or C#.
• Experience working with centralized findings-management, ASPM, or vulnerability-management platforms.
• Familiarity with finding ingestion, normalization, deduplication, ownership assignment, remediation status, suppressions, exceptions, and SLA tracking.
• Exposure to GitHub, GitLab, Azure DevOps, Jenkins, or comparable source-control and CI/CD workflows.
• Basic scripting experience with Python, Go, PowerShell, or a comparable language.
• Familiarity with REST APIs, webhooks, JSON, command-line tools, and basic integration concepts.
• Familiarity with backend automation concepts such as scheduled jobs, workers, queues, polling, retries, timeouts, and result processing.
• Basic understanding of SAST, DAST, SCA, secrets detection, API security, Mobile security, SBOM, and related software supply-chain controls.
• Familiarity with cloud or container technologies such as AWS, Azure, GCP, Docker, or Kubernetes.
• Understanding of secure credential handling, service accounts, access controls, encryption, certificates, and audit logging.
• Ability to create clear technical documentation, findings summaries, remediation guidance, troubleshooting notes, and operational procedures.

Non-technical Skills

• Strong written and verbal communication skills.
• High integrity with sound judgment and accountability.
• Excellent analytical, problem-solving, and critical thinking abilities.
• Self-motivated, curious, and committed to continuous learning, including willingness to skill up in mobile application security.
• Strong collaboration, relationship-building, and influencing skills.
• Comfortable working in a fast-paced, global environment with changing priorities and ambiguity.
• Ability to perform effectively under pressure.

Differentiating Behaviors

• Demonstrates curiosity, innovation, and a continuous improvement mindset, including a willingness to develop mobile application security expertise.
• Makes sound decisions by balancing technical, business, and operational trade-offs.
• Remains calm, organized, and methodical in high-pressure situations.
• Effectively prioritizes work and manages competing commitments.

Compensation and Benefits:

• The expected starting compensation range for this position is 184,000 PLN annually.
• Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary.
• This role is eligible for an annual bonus of 10% of annual salary, based on performance and eligibility.
• In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility.

#LI-Hybrid