STEM OPT Application Security Engineer Jobs
Application Security Engineer roles qualify for STEM OPT because they fall under computer science and engineering CIP codes. Your 24-month STEM OPT extension gives you up to 36 months of total work authorization, provided your employer is enrolled in E-Verify and you file a completed I-983 training plan with your DSO.
Find STEM OPT Application Security Engineer JobsOverview
Showing 5 of 141+ Application Security Engineer jobs
See all 141+ Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Application Security Engineer roles.
Get Access To All JobsINTRODUCTION
PepsiCo’s Global Application Security Program integrates security into software development at enterprise scale. Our mission is to make application security risks visible, actionable, and measurable so they can be remediated efficiently.
This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most.
Responsibilities
- Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
- Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
- Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
- Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
- Integrate security tool outputs into centralized vulnerability management workflows.
- Validate findings, investigate false positives, and track remediation through closure.
- Partner with engineering teams to implement security guardrails and secure development practices.
- Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
- Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
- Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
- Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
- Develop and maintain technical documentation, operational runbooks, and security standards.
- Support vulnerability response, remediation activities, and application security incident investigations.
- Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
- Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
- Participate in a 24/7 on-call rotation, including weekends and holidays.
COMPENSATION AND BENEFITS
- The expected compensation range for this position is between $80,200 - $134,250.
- Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
- Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually.
- Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
- In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.
QUALIFICATIONS
Years of Experience
- Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience.
Mandatory Technical Skills
- Experience with secure software development and identifying vulnerabilities within application code.
- Experience analyzing application security findings and providing actionable remediation guidance.
- Hands-on experience with application security, vulnerability management, and security engineering.
- Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.
- Proficiency with Python and/or Go.
- Experience with SAST, SCA, Secrets, DAST, API, and Container security tools.
- Experience tuning security scanners and reducing false positives, including OWASP Top 10 findings.
- Experience deploying, configuring, and managing Web Application Firewalls (WAFs).
- Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar).
- Strong understanding of web and mobile application security, including the OWASP Top 10, SSRF, RCE, deserialization, and memory corruption vulnerabilities.
- Familiarity with securing CI/CD pipelines and integrating security into development workflows.
- Understanding of API security, including OAuth, JWT, authentication, authorization, and access control.
- Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching.
- Understanding of cryptographic principles, key management, and encryption best practices.
Non-technical Skills
- Strong written and verbal communication skills.
- High integrity with sound judgment and accountability.
- Excellent analytical, problem-solving, and critical thinking abilities.
- Self-motivated, curious, and committed to continuous learning.
- Strong collaboration, relationship-building, and influencing skills.
- Comfortable working in a fast-paced, global environment with changing priorities and ambiguity.
- Ability to perform effectively under pressure.
Differentiating Behaviors
- Demonstrates curiosity, innovation, and a continuous improvement mindset.
- Makes sound decisions by balancing technical, business, and operational trade-offs.
- Remains calm, organized, and methodical in high-pressure situations.
- Effectively prioritizes work and manages competing commitments.
Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance.
All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status.
PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity / Age
If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents. View PepsiCo EEO Policy.
Please view our Pay Transparency Statement.
INTRODUCTION
PepsiCo’s Global Application Security Program integrates security into software development at enterprise scale. Our mission is to make application security risks visible, actionable, and measurable so they can be remediated efficiently.
This role is responsible for implementing and operating foundational application security controls, optimizing security tooling, and enabling security automation at scale. The ideal candidate will improve signal quality, reduce false positives, and help developers remediate the risks that matter most.
Responsibilities
- Configure, tune, and maintain application security tools to maximize accuracy, coverage, and performance.
- Establish and maintain security baselines, policies, and scanning rules aligned with organizational standards.
- Improve finding quality by reducing false positives and ensuring results accurately reflect business risk.
- Develop and maintain risk-based prioritization models to focus remediation on the highest-impact vulnerabilities.
- Integrate security tool outputs into centralized vulnerability management workflows.
- Validate findings, investigate false positives, and track remediation through closure.
- Partner with engineering teams to implement security guardrails and secure development practices.
- Continuously evaluate and optimize security tooling, processes, and platform effectiveness.
- Perform targeted security assessments of high-risk applications to identify coverage gaps and critical vulnerabilities.
- Manage and optimize Web Application Firewall (WAF) and CDN security capabilities, including DDoS protection, bot mitigation, and traffic management.
- Evaluate emerging security technologies and recommend improvements to increase automation, coverage, and operational efficiency.
- Develop and maintain technical documentation, operational runbooks, and security standards.
- Support vulnerability response, remediation activities, and application security incident investigations.
- Participate in Agile development, including sprint planning, backlog refinement, estimation, stand-ups, and retrospectives.
- Develop metrics and KPIs to measure program effectiveness and drive continuous improvement.
- Participate in a 24/7 on-call rotation, including weekends and holidays.
COMPENSATION AND BENEFITS
- The expected compensation range for this position is between $80,200 - $134,250.
- Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
- Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually.
- Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
- In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.
QUALIFICATIONS
Years of Experience
- Bachelor’s degree in computer science, Engineering, or a related technical field, with 3-4 years of relevant professional experiences or equivalent in job experience.
Mandatory Technical Skills
- Experience with secure software development and identifying vulnerabilities within application code.
- Experience analyzing application security findings and providing actionable remediation guidance.
- Hands-on experience with application security, vulnerability management, and security engineering.
- Experience securing cloud-native applications in AWS (preferred), Azure, or GCP.
- Proficiency with Python and/or Go.
- Experience with SAST, SCA, Secrets, DAST, API, and Container security tools.
- Experience tuning security scanners and reducing false positives, including OWASP Top 10 findings.
- Experience deploying, configuring, and managing Web Application Firewalls (WAFs).
- Knowledge of Policy-as-Code frameworks (OPA, HashiCorp Sentinel, or similar).
- Strong understanding of web and mobile application security, including the OWASP Top 10, SSRF, RCE, deserialization, and memory corruption vulnerabilities.
- Familiarity with securing CI/CD pipelines and integrating security into development workflows.
- Understanding of API security, including OAuth, JWT, authentication, authorization, and access control.
- Understanding of CDN security, including DDoS protection, bot mitigation, rate limiting, and caching.
- Understanding of cryptographic principles, key management, and encryption best practices.
Non-technical Skills
- Strong written and verbal communication skills.
- High integrity with sound judgment and accountability.
- Excellent analytical, problem-solving, and critical thinking abilities.
- Self-motivated, curious, and committed to continuous learning.
- Strong collaboration, relationship-building, and influencing skills.
- Comfortable working in a fast-paced, global environment with changing priorities and ambiguity.
- Ability to perform effectively under pressure.
Differentiating Behaviors
- Demonstrates curiosity, innovation, and a continuous improvement mindset.
- Makes sound decisions by balancing technical, business, and operational trade-offs.
- Remains calm, organized, and methodical in high-pressure situations.
- Effectively prioritizes work and manages competing commitments.
Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance.
All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status.
PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity / Age
If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents. View PepsiCo EEO Policy.
Please view our Pay Transparency Statement.
See all 141+ STEM OPT Application Security Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new STEM OPT Application Security Engineer Jobs.
Get Access To All JobsTips for Finding STEM OPT Authorization as an Application Security Engineer
Verify your degree CIP code first
Check that your degree's CIP code falls under an approved STEM category before applying. Computer science (11.xx), information security (11.1003), and engineering (14.xx) codes all qualify, but some interdisciplinary degrees don't. Confirm eligibility with your DSO before targeting roles.
Confirm E-Verify enrollment before accepting offers
Any employer who hires you on STEM OPT must be enrolled in E-Verify, not just willing to enroll. Ask recruiters directly and verify through the E-Verify employer search before signing anything. A non-enrolled employer disqualifies your extension regardless of role fit.
Target security teams at regulated industries
Financial services, healthcare, and defense contractors face strict compliance mandates that create standing demand for application security engineers. These industries file consistent STEM OPT training plans and are familiar with I-983 requirements, reducing delays after you receive an offer.
Build your I-983 training plan around AppSec milestones
Don't wait until offer acceptance to draft your I-983. Map your planned work to specific learning objectives tied to secure SDLC, penetration testing, or threat modeling. A well-prepared training plan speeds DSO approval and signals readiness to compliance-aware employers.
Use Migrate Mate to find E-Verify employers hiring AppSec engineers
Filter your search on Migrate Mate by employers with confirmed E-Verify enrollment and active application security roles. This cuts time spent vetting employers manually and surfaces companies already familiar with STEM OPT filing requirements.
File your extension request 90 days before OPT expiration
USCIS requires your STEM OPT extension application to be submitted at least 90 days before your initial OPT EAD expires. Missing this window means a gap in work authorization. Your DSO must recommend the extension in SEVIS before you file Form I-765.
Frequently Asked Questions
Does an Application Security Engineer role qualify for the STEM OPT extension?
Yes, if your degree is in a qualifying STEM field such as computer science, information security, or software engineering. The role itself must also provide structured learning tied to your degree, which you document in the I-983 training plan. Application security work typically maps cleanly to these requirements because it involves technically complex, degree-relevant skills. Your DSO makes the final eligibility determination based on your specific degree CIP code.
What E-Verify requirements does my employer need to meet for STEM OPT?
Your employer must be actively enrolled in E-Verify at the time you begin work on the STEM OPT extension. Enrollment after hiring does not satisfy this requirement retroactively. You can check employer enrollment status through the E-Verify employer search tool. The employer must also sign your I-983 training plan, confirming they will provide the documented learning experience for the full extension period.
What goes into the I-983 training plan for an Application Security Engineer?
The I-983 requires you to describe specific training goals tied to your STEM degree, the skills you'll develop, and how the employer will supervise and evaluate your progress. For an application security role, this typically includes objectives around secure code review, vulnerability assessment, threat modeling, or incident response. The employer's designated supervisor signs the plan, and you submit it to your DSO before the extension begins. You also file an evaluation update at the 12-month mark.
How does cap-gap protection apply if my employer files an H-1B petition while I'm on STEM OPT?
If your employer files an H-1B visa petition before your STEM OPT EAD expires and you're selected in the lottery, cap-gap automatically extends your work authorization through September 30 of that fiscal year. You don't need to file separately for cap-gap. Your I-20 should be updated by your DSO to reflect the cap-gap period. USCIS confirms the underlying rules governing this extension, so verify your specific dates with your DSO.
Where can I find Application Security Engineer jobs where employers already understand STEM OPT?
Migrate Mate lists application security roles filtered by employers enrolled in E-Verify, which is the baseline requirement for your STEM OPT extension. Searching there saves time compared to screening employers manually. Look for roles at companies in regulated sectors like finance or healthcare, where dedicated security teams and compliance infrastructure mean faster I-983 processing and less employer education required on your end.