> Markdown version of [/jobs/ext/2628026-application-security-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/2628026-application-security-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Application Security | Application Security Engineer - **Company:** PepsiCo, Inc. - **Location:** Plano, TX, United States - **Experience:** Experienced - **Salary:** $80,200.0 - $134,250.0 - **Contract:** Permanent contract - **Skills:** Kubernetes Security, Application Programming Interfaces (APIs), Agile Methodology, Amazon Web Services, Application Firewall, User Authentication, Microsoft Azure, System Configuration, DDoS Mitigation, Mobile Application Software, Python (Programming Language), Key Management, OAuth, Open Web Application Security, Scrum Methodology, JSON Web Token, Secure Coding, Software Engineering, Systems Integration, Software Vulnerability Management, Policy as Code, Spring Cloud, Software Security, Rate Limiting, Information Technology, Hashicorp, Static Application Security Testing, Dynamic Application Security Testing - **Published:** August 3, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=4ff584a09e3960d3 ## About the Role Years of Experience * Bachelor's degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience Mandatory Technical Skills * Experience with secure software development and identifying vulnerabilities within application code. * Experience analyzing application security findings and providing actionable remediation guidance. * Hands-on experience with application security, vulnerability management, and security engineering. * Experience securing cloud-native applications in AWS (preferred), Azure, or GCP. * Proficiency with Python and/or Go. * Experience with SAST, SCA, Secrets, DAST, API, and Container security tools. * Experience tuning security scanners and reducing false positives, including OWASP Top 10 findings. * Experience deploying, configuring, and managing Web Application Firewalls (WAFs). * Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar). * Strong understanding of web and mobile application security, including the OWASP Top 10, SSRF, RCE, deserialization, and memory corruption vulnerabilities. * Familiarity with securing CI/CD pipelines and integrating security into development workflows. * Understanding of API security, including OAuth, JWT, authentication, authorization, and access control. * Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching. * Understanding of cryptographic principles, key management, and encryption best practices. Non-technical Skills: * Strong written and verbal communication skills. * High integrity with sound judgment and accountability. * Excellent analytical, problem-solving, and critical thinking abilities. * Self-motivated, curious, and committed to continuous learning. * Strong collaboration, relationship-building, and influencing skills. * Comfortable working in a fast-paced, global environment with changing priorities and ambiguity. * Ability to perform effectively under pressure. Differentiating Behaviors: * Demonstrates curiosity, innovation, and a continuous improvement mindset. * Makes sound decisions by balancing technical, business, and operational trade-offs. * Remains calm, organized, and methodical in high-pressure situations. * Effectively prioritizes work and manages competing commitments. ## Description This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most., * Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance. * Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards. * Improve finding quality by reducing false positives and ensuring results accurately reflect business risk. * Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities. * Integrate security tool outputs into centralized vulnerability management workflows. * Validate findings, investigate false positives, and track remediation through closure. * Partner with engineering teams to implement security guardrails and secure development practices. * Continuously evaluate and optimize security tooling, processes, and platform effectiveness. * Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities. * Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management. * Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency. * Develop and maintain technical documentation, operational runbooks, and security standards. * Support vulnerability response, remediation activities, and application security incident investigations. * Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives. * Develop metrics and KPIs to measure program effectiveness and drive continuous improvement. * Participate in a 24/7 on-call rotation, including weekends and holidays. ## Related Videos - [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Serverless Architectures with Spring Cloud Functions and Knative](https://www.wearedevelopers.com/videos/814-serverless-architectures-with-spring-cloud-functions-and-knative) - [Bridging AI and Nomad: a Go-based MCP Server for Cluster Control](https://www.wearedevelopers.com/videos/2063-bridging-ai-and-nomad-a-go-based-mcp-server-for-cluster-control) - [Kubernetes Native Java](https://www.wearedevelopers.com/videos/383-kubernetes-native-java) - [Securing Secrets in the GitOps era](https://www.wearedevelopers.com/videos/546-securing-secrets-in-the-gitops-era) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [7 Important Tips That Every Software Developer Should Know](https://www.wearedevelopers.com/magazine/101-7-important-tips-that-every-software-developer-should-know) - [Top Characteristics of a Software Engineer](https://www.wearedevelopers.com/magazine/166-top-characteristics-of-a-software-engineer) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [How to Answer the Interview Question: “Why Do You Want to Be a Software Engineer?”](https://www.wearedevelopers.com/magazine/392-how-to-answer-the-interview-question-why-do-you-want-to-be-a-software-engineer)