OPT Application Security Engineer Jobs
Application Security Engineer jobs are consistently sponsored on OPT, with employers ranging from fintech and cloud infrastructure firms to enterprise software companies. Most roles require a computer science or cybersecurity degree, making them a strong fit for STEM OPT's 24-month extension. Cap-exempt employers and government contractors frequently hire in this field.
Find OPT Application Security Engineer JobsOverview
Showing 5 of 184+ Application Security Engineer jobs
See all 184+ Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsINTRODUCTION
PepsiCo’s Global Application Security Program integrates security into software development at enterprise scale. Our mission is to make application security risks visible, actionable, and measurable so they can be remediated efficiently.
This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most.
Responsibilities
- Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
- Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
- Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
- Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
- Integrate security tool outputs into centralized vulnerability management workflows.
- Validate findings, investigate false positives, and track remediation through closure.
- Partner with engineering teams to implement security guardrails and secure development practices.
- Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
- Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
- Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
- Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
- Develop and maintain technical documentation, operational runbooks, and security standards.
- Support vulnerability response, remediation activities, and application security incident investigations.
- Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
- Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
- Participate in a 24/7 on-call rotation, including weekends and holidays.
COMPENSATION AND BENEFITS
- The expected compensation range for this position is between $80,200 - $134,250.
- Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
- Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually.
- Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
- In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.
QUALIFICATIONS
Years of Experience
- Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience.
Mandatory Technical Skills
- Experience with secure software development and identifying vulnerabilities within application code.
- Experience analyzing application security findings and providing actionable remediation guidance.
- Hands-on experience with application security, vulnerability management, and security engineering.
- Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.
- Proficiency with Python and/or Go.
- Experience with SAST, SCA, Secrets, DAST, API, and Container security tools.
- Experience tuning security scanners and reducing false positives, including OWASP Top 10 findings.
- Experience deploying, configuring, and managing Web Application Firewalls (WAFs).
- Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar).
- Strong understanding of web and mobile application security, including the OWASP Top 10, SSRF, RCE, deserialization, and memory corruption vulnerabilities.
- Familiarity with securing CI/CD pipelines and integrating security into development workflows.
- Understanding of API security, including OAuth, JWT, authentication, authorization, and access control.
- Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching.
- Understanding of cryptographic principles, key management, and encryption best practices.
Non-technical Skills
- Strong written and verbal communication skills.
- High integrity with sound judgment and accountability.
- Excellent analytical, problem-solving, and critical thinking abilities.
- Self-motivated, curious, and committed to continuous learning.
- Strong collaboration, relationship-building, and influencing skills.
- Comfortable working in a fast-paced, global environment with changing priorities and ambiguity.
- Ability to perform effectively under pressure.
Differentiating Behaviors
- Demonstrates curiosity, innovation, and a continuous improvement mindset.
- Makes sound decisions by balancing technical, business, and operational trade-offs.
- Remains calm, organized, and methodical in high-pressure situations.
- Effectively prioritizes work and manages competing commitments.
Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance.
All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status.
PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity / Age
If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents. View PepsiCo EEO Policy.
Please view our Pay Transparency Statement.
INTRODUCTION
PepsiCo’s Global Application Security Program integrates security into software development at enterprise scale. Our mission is to make application security risks visible, actionable, and measurable so they can be remediated efficiently.
This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most.
Responsibilities
- Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
- Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
- Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
- Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
- Integrate security tool outputs into centralized vulnerability management workflows.
- Validate findings, investigate false positives, and track remediation through closure.
- Partner with engineering teams to implement security guardrails and secure development practices.
- Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
- Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
- Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
- Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
- Develop and maintain technical documentation, operational runbooks, and security standards.
- Support vulnerability response, remediation activities, and application security incident investigations.
- Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
- Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
- Participate in a 24/7 on-call rotation, including weekends and holidays.
COMPENSATION AND BENEFITS
- The expected compensation range for this position is between $80,200 - $134,250.
- Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
- Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually.
- Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
- In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.
QUALIFICATIONS
Years of Experience
- Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience.
Mandatory Technical Skills
- Experience with secure software development and identifying vulnerabilities within application code.
- Experience analyzing application security findings and providing actionable remediation guidance.
- Hands-on experience with application security, vulnerability management, and security engineering.
- Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.
- Proficiency with Python and/or Go.
- Experience with SAST, SCA, Secrets, DAST, API, and Container security tools.
- Experience tuning security scanners and reducing false positives, including OWASP Top 10 findings.
- Experience deploying, configuring, and managing Web Application Firewalls (WAFs).
- Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar).
- Strong understanding of web and mobile application security, including the OWASP Top 10, SSRF, RCE, deserialization, and memory corruption vulnerabilities.
- Familiarity with securing CI/CD pipelines and integrating security into development workflows.
- Understanding of API security, including OAuth, JWT, authentication, authorization, and access control.
- Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching.
- Understanding of cryptographic principles, key management, and encryption best practices.
Non-technical Skills
- Strong written and verbal communication skills.
- High integrity with sound judgment and accountability.
- Excellent analytical, problem-solving, and critical thinking abilities.
- Self-motivated, curious, and committed to continuous learning.
- Strong collaboration, relationship-building, and influencing skills.
- Comfortable working in a fast-paced, global environment with changing priorities and ambiguity.
- Ability to perform effectively under pressure.
Differentiating Behaviors
- Demonstrates curiosity, innovation, and a continuous improvement mindset.
- Makes sound decisions by balancing technical, business, and operational trade-offs.
- Remains calm, organized, and methodical in high-pressure situations.
- Effectively prioritizes work and manages competing commitments.
Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance.
All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status.
PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity / Age
If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents. View PepsiCo EEO Policy.
Please view our Pay Transparency Statement.
See all 184+ OPT Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new OPT Application Security Engineer Jobs.
Get Access To All JobsTips for Finding OPT Sponsorship as an Application Security Engineer
Lead with your security certifications
OSCP, CEH, and Security+ certifications signal hands-on competence to hiring managers faster than a degree alone. OPT students who hold at least one recognized security credential move through technical screenings at a noticeably higher rate in this field.
Target STEM-designated program employers first
Application Security Engineering falls under CIP codes that qualify for the 24-month STEM OPT extension. Prioritize employers already familiar with STEM OPT obligations, since they understand the timeline and are far less likely to withdraw offers over authorization concerns.
Demonstrate experience with specific security frameworks
OWASP Top 10, NIST, and MITRE ATT&CK are referenced in most job descriptions. Calling out specific frameworks you have applied, not just studied, in your resume and cover letter directly addresses what hiring managers are screening for in this role.
Highlight any bug bounty or capture-the-flag experience
Practical proof of skill matters more in security than in most engineering disciplines. Bug bounty reports on HackerOne or CTF placements are legitimate portfolio items that demonstrate offensive and defensive competencies employers cannot easily assess from academic credentials.
Understand your employer's H-1B sponsorship history before applying
Application Security Engineers are in high demand, but sponsorship willingness varies significantly by company size and legal infrastructure. Researching a company's past H-1B visa filings through public OFLC disclosure data helps you prioritize employers likely to support long-term sponsorship after OPT.
Be specific about your OPT start date and STEM extension eligibility
Recruiters in security-sensitive industries need clear authorization timelines upfront. Stating your OPT end date and confirming STEM extension eligibility in your initial outreach eliminates ambiguity and positions you as a candidate who understands their own authorization, which builds recruiter confidence.
Application Security Engineer OPT: Frequently Asked Questions
Is Application Security Engineer a STEM OPT-eligible role?
Yes. Application Security Engineering roles typically fall under CIP codes in computer science and information security, both of which qualify for the 24-month STEM OPT extension. This gives eligible F-1 students up to three years of work authorization in total, making this one of the stronger fields for OPT students pursuing long-term U.S. employment.
Do employers in this field commonly sponsor OPT students?
Yes, particularly at mid-size and large technology companies, financial institutions, and cloud infrastructure firms. Application security is a specialist function with a well-documented talent shortage, which pushes many employers to sponsor candidates they would otherwise pass on. You can browse OPT-friendly Application Security Engineer openings directly on Migrate Mate, where listings are filtered for sponsorship willingness.
Can I work as an Application Security Engineer on OPT if my degree is in computer science rather than cybersecurity?
Yes. USCIS does not require your degree to be in cybersecurity specifically. A computer science, software engineering, or information systems degree is sufficient, provided your coursework or experience connects reasonably to the security function of the role. Most employers in this field regularly hire engineers with general CS backgrounds who have developed security specialization through coursework, certifications, or projects.
What should I do if a job posting says 'U.S. citizens or permanent residents only'?
This restriction almost always reflects government contracting requirements or access to classified systems, not a general sponsorship policy. For commercial application security roles without clearance requirements, most large employers do not impose this restriction. Focus your search on roles at companies without federal contract dependencies, and use Migrate Mate to filter for positions explicitly open to OPT applicants.
How early should I start my Application Security Engineer job search before my OPT start date?
Start at least three to four months before your expected OPT start date. Technical hiring processes in security often include multiple interview rounds, take-home assessments, and background checks that can run four to six weeks from first contact to offer. Beginning early leaves room to negotiate start dates that align with your EAD arrival and reduces the risk of accepting a role under time pressure.