Senior Information Security Analyst

PepsiCo • Plano, TX

1d

About The Position

PepsiCo’s Global Emerging Technologies Security Team, within the Cyber Fusion Center, is seeking a Senior Information Security Analyst to operationalize API and web application security using Imperva solutions. The role focuses on continuous discovery, vulnerability identification, prioritization, mitigation, and escalation across APIs and web applications. The analyst serves as the organization’s Imperva subject matter expert, leading platform operations, security automation, integration architecture, and risk-remediation workflows.

The position operates and improves Imperva WAF and API Security (WAAP) capabilities across cloud and/or on-premises environments. It includes administering the management console and gateways, managing platform lifecycle and performance, discovering and classifying APIs, tuning security policies, supporting application onboarding, and responding to incidents. The analyst develops integrations and automation with ServiceNow, SIEM/SOAR, and ITSM platforms; embeds security into CI/CD workflows; reports on operational KPIs; and provides technical leadership, escalation support, documentation, and mentorship.

The role requires 6 to 7 years of cybersecurity experience with application/API protection platforms, vulnerability management, and security automation. A bachelor’s degree in a related field or equivalent hands-on experience is required. The position includes periodic on-call rotations and may require after-hours incident support. The expected compensation range is $93,500–$156,450, with a performance bonus target of 10% of annual salary. PepsiCo offers paid time off and an eligible, election-based benefits package.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent hands-on experience.
• 6 to 7 years of cybersecurity experience operating application/API protection (WAAP) platforms, vulnerability management, and security automation.
• Hands-on experience operating Imperva solutions in cloud and/or on-premises environments, including console and gateway administration, learning mode, application profiling, virtual patching, and version and patch lifecycle management.
• Strong programming or scripting skills in Python, PowerShell, Bash, or equivalent for API and WAF security automation.
• Expert knowledge of TCP/IP, HTTP/S, DNS, SSL/TLS, SSH, FTP, VPNs, RDP, routing, and firewalling.
• Proficiency with Infrastructure as Code, such as Terraform or CloudFormation, CI/CD pipelines, and container security using Kubernetes and Docker.
• Deep knowledge of API and web security, including the OWASP API Top 10, token and OAuth authentication, REST/GraphQL/gRPC/SOAP schemas, and session-level bot, scraping, and DDoS mitigation.
• Experience tuning security policies and managing false positives, including signatures, exceptions, allowlisting, rate limiting, bot scoring, and geographic controls.
• Cybersecurity and engineering/development skills, including experience using APIs to integrate Imperva with ServiceNow and SOAR platforms.
• Familiarity or hands-on experience with AWS, Azure, and Google Cloud environments.
• Working knowledge of SQL and data visualization tools such as Power BI, Tableau, or Looker for risk reporting and KPI tracking.
• Proven ability to lead security automation initiatives and mentor junior analysts.
• Strong analytical, troubleshooting, and problem-solving skills, with a focus on sustainable systems.
• Proactive, positive, impact-focused, curious, analytical, self-starting team player with high integrity and ethical standards.
• Ability to build trust and influence others to improve the business’s security posture.
• Customer orientation and excellent oral and written communication skills in English, including presenting findings and trends in stakeholder business reviews.
• Ability to operate under pressure, balance multiple priorities in a fast-paced environment, and be available for on-call rotations.

Nice To Haves

• Equivalent hands-on experience may substitute for the stated bachelor’s degree.
• Familiarity or hands-on experience with cloud computing environments such as AWS, Azure, and Google Cloud.
• Working knowledge of SQL and data visualization tools such as Power BI, Tableau, or Looker.

Responsibilities

• Operate, monitor, administer, and continuously improve the enterprise Imperva WAF and API Security (WAAP) service, including configuration, maintenance, health checks, lifecycle activities, console administration, onboarding, licensing, and node and gateway monitoring.
• Manage Imperva platform patches, version upgrades, and gateway updates, validating stability and policy integrity after changes.
• Monitor WAAP capacity and performance, including latency, throughput, and node utilization, to avoid degrading application performance.
• Execute production policy and configuration changes through formal Change Management (CAB), documenting change requests, rollback plans, and post-change validation.
• Discover REST, GraphQL, gRPC, and SOAP endpoints, including shadow, unmanaged, and zombie APIs; onboard and offboard applications; and classify APIs and applications by data sensitivity and business criticality.
• Design, implement, and tune Imperva security policies, profiles, and rules, including signatures, exceptions, allowlisting, rate limiting, bot scoring, and geographic controls, while minimizing false positives.
• Analyze Imperva traffic and logs for abuse patterns, bot attacks, scraping, anomalies, and application-layer attacks, and apply inline, client-session-level mitigations.
• Support application and API onboarding through requirements gathering, architecture and exposure review, DNS and SSL/TLS certificate validation, cutover coordination, certificate renewals, and IP, URL, or country blocking.
• Automate ingestion of Imperva findings into ServiceNow VR and integrate with SOAR platforms to automate ticket creation, configuration validation, and response to low-risk incidents.
• Develop and scale Python, PowerShell, Bash, and other automation integrating Imperva with ServiceNow VR and CC, SIEM/SOAR, and ITSM platforms.
• Design custom API integrations between Imperva, ServiceNow, and ITSM/SOAR platforms to automate security workflows.
• Embed API and web application security into CI/CD pipelines using schema validation, OWASP API Top 10-aligned tests, Terraform or other Infrastructure-as-Code components, and policy-as-code at pull-request time.
• Serve as the L2/L3 escalation point for L1/SOC teams on Imperva-related events and incidents; validate triage, guide engineers, and maintain runbooks and knowledge articles.
• Troubleshoot security incidents across network layers using knowledge of networking and security protocols, including DoS/DDoS, brute force, XSS, SQL injection, and RCE vectors.
• Define and track operational security KPIs, including blocked events, attacks and attackers, false-positive rate, MTTR, exposed or unmanaged endpoints, protection coverage, and inline action rate; produce periodic reports for stakeholders and leadership.
• Manage AI Protection solutions, including AI Prompt Jailbreak defense and AI Model protection, as well as DLP technologies including CASB SaaS and Email Security SaaS.
• Collaborate with product, DevOps, and support teams to investigate false positives and false negatives and implement corresponding Imperva policy changes.
• Participate in recurring internal customer and business stakeholder reviews to communicate risk posture, attack trends, and remediation status.
• Lead technical design reviews, evaluate security tools, and drive architectural discussions to improve Imperva and complementary tools.
• Provide technical leadership in API security, WAF, container security, and security automation; mentor junior and mid-level analysts on Imperva operations, API development, and risk prioritization.
• Develop and maintain security documentation, playbooks, SOPs, and network diagrams for Imperva operations.
• Stay current on API and web application threats, regulatory changes, and vulnerability trends, and refine security automation strategies.
• Deliver projects and objectives aligned with team goals; act as the Imperva SME for business, IT, and senior leadership; and maintain documentation, processes, and configurations as threats evolve.
• Collaborate with partner teams, service owners, and senior leadership to influence, prioritize, and resolve security findings discovered by Imperva.
• Participate in security reviews, audits, VAPT findings, and on-site engagements, and support after-hours incidents when required, including periodic on-call rotations.
• Focus on scalable API and web application security, high-fidelity and developer-friendly security signals, proactive removal of development-workflow bottlenecks, and data-driven operational improvements.

Benefits

• Performance-based annual bonus with a target payout of 10% of annual salary, subject to eligibility.
• Paid time off, subject to eligibility, including paid parental leave, vacation, sick, and bereavement leave.
• Medical, dental, vision, disability, health reimbursement, and dependent care reimbursement accounts, subject to elections and eligibility.
• Employee Assistance Program (EAP).
• Accident, group legal, and life insurance, subject to elections and eligibility.
• Defined Contribution Retirement Plan.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior