Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 44 days ago

Application Security Engineer

PepsiCo2,589 open roles

Pay
PLN 184,000 a year
Where
Warszawa, Poland
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowApplication Security EngineerPepsiCo · Warszawa, Poland

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on PepsiCo's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.8% of postings close within 7 days. Measured by our own scanner across the market. PepsiCo postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.4%3 days
  3. 11.8%7 days
  4. 18.6%14 days
  5. 35.6%30 days
  6. 45.1%60 days
This job: posted 44 days ago

PepsiCo median: 1 days open

The posting

Overview PepsiCo’s Global Application Security Program partners with development teams to identify and reduce security risk across enterprise applications and APIs. Approximately 80% of this role focuses on SAST/SCA/Secrets/DAST and API security scanning technology. The engineer will support the operation and tuning of tools, manually triage security findings, perform targeted reviews using established procedures, assist developers with remediation, and manage findings through centralized vulnerability-management workflows. The engineer will also help develop and maintain backend automation that initiates scans, monitors scan status, processes results, handles common failures, and integrates security tools into CI/CD and developer workflows. The remaining capacity will support mobile application-security tooling and integrations as needed. Working knowledge of mobile security reviews is preferred but not required. This may include assisting with specific mobile-application security tooling scanning automation and CI/CD integrations under the guidance of senior engineers. Responsibilities Operate and support SAST/SCA/Secret/DAST and API security scanning tools. Review, validate, and manually triage security findings, identify false positives, reproduce common issues, assess potential impact, and escalate complex findings when appropriate. Perform targeted web application and API security reviews using established tools, standards, procedures, and test cases. Assist with configuring and tuning SAST/SCA and Secret rules, policies, exclusions, severity mappings, and quality gates. Assist with configuring DAST and API scan profiles, authentication workflows, crawl settings, scan scopes, schedules, and policies. Support the integration of security tools into source-control, pull-request, build, CI/CD, ticketing, and developer workflows. Contribute to backend scanning automation that initiates scans, monitors scan state, handles retries, retrieves results, and routes findings to downstream systems. Process findings through centralized application-security or vulnerability-management platforms, including normalization, deduplication, ownership assignment, remediation tracking, suppression, and exception workflows. Provide developers with clear remediation guidance and support validation and tracking of vulnerabilities through closure. Monitor scan execution and integration health, troubleshoot common authentication, connectivity, configuration, timeout, and result-processing issues, and escalate platform problems as needed. As needed, support mobile security finding triage and tooling, including assisting with backend automation and CI/CD integrations for mobile security scans. Document findings, remediation guidance, scan configurations, integration procedures, troubleshooting steps, metrics, and operational activities while participating in Agile ceremonies and team support processes. Support team incident rotation through on-call hours, including weekends and holidays as needed. Qualifications Years of Experience Bachelor’s degree in Computer Science, Engineering, or a related technical field, with 1-3 years of relevant professional experience in application security, security engineering, secure software development, or vulnerability management. Mandatory Technical Skills Foundational understanding of web application, mobile application, and API security concepts. Experience with or exposure to SAST/SCA and Secret, including rules, policies, findings, exclusions, and CI/CD integrations. Experience with or exposure to DAST and API scanning platforms, including scan configuration, scope management, authenticated scanning, and finding review. Experience manually reviewing and triaging SAST/SCA/Secret, DAST, Mobile, and API-security findings. Ability to reproduce common findings, recognize likely false positives, gather supporting evidence, and document remediation recommendations. Familiarity with web, mobile and API testing tools such as Burp Suite, Postman, MobSF, curl, browser developer tools, or comparable technologies. Familiarity with the OWASP Top 10 and common web vulnerabilities, including injection, cross-site scripting, broken access control, authentication weaknesses, SSRF, security misconfiguration, and sensitive-data exposure. Familiarity with the OWASP API Security Top 10, including BOLA/IDOR, broken authentication, authorization failures, resource-consumption issues, mass assignment, and API inventory weaknesses. Basic understanding of API authentication and authorization, including OAuth 2.0, OpenID Connect, JWT, API keys, service accounts, and role-based access control. Ability to read and understand application code written in at least one language such as Java, JavaScript, TypeScript, Python, Go, or C#. Experience working with centralized findings-management, ASPM, or vulnerability-management platforms. Familiarity with finding ingestion, normalization, deduplication, ownership assignment, remediation status, suppressions, exceptions, and SLA tracking. Exposure to GitHub, GitLab, Azure DevOps, Jenkins, or comparable source-control and CI/CD workflows. Basic scripting experience with Python, Go, PowerShell, or a comparable language. Familiarity with REST APIs, webhooks, JSON, command-line tools, and basic integration concepts. Familiarity with backend automation concepts such as scheduled jobs, workers, queues, polling, retries, timeouts, and result processing. Basic understanding of SAST, DAST, SCA, secrets detection, API security, Mobile security, SBOM, and related software supply-chain controls. Familiarity with cloud or container technologies such as AWS, Azure, GCP, Docker, or Kubernetes. Understanding of secure credential handling, service accounts, access controls, encryption, certificates, and audit logging. Ability to create clear technical documentation, findings summaries, remediation guidance, troubleshooting notes, and operational procedures. Non-technical Skills Strong written and verbal communication skills. High integrity with sound judgment and accountability. Excellent analytical, problem-solving, and critical thinking abilities. Self-motivated, curious, and committed to continuous learning, including willingness to skill up in mobile application security. Strong collaboration, relationship-building, and influencing skills. Comfortable working in a fast-paced, global environment with changing priorities and ambiguity. Ability to perform effectively under pressure. Differentiating Behaviors Demonstrates curiosity, innovation, and a continuous improvement mindset, including a willingness to develop mobile application security expertise. Makes sound decisions by balancing technical, business, and operational trade-offs. Remains calm, organized, and methodical in high-pressure situations. Effectively prioritizes work and manages competing commitments. Compensation and Benefits: The expected starting compensation range for this position is 184,000 PLN annually. Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. This role is eligible for an annual bonus of 10% of annual salary, based on performance and eligibility. In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility. #LI-Hybrid

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against PepsiCo's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on PepsiCo's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    PepsiCo's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.