Senior AI Application Security Engineer

Overview

Pepsi Co’s Global Application Security Program integrates security into software development at enterprise scale. As AI becomes a core component of enterprise applications, our mission expands to ensure AI systems are designed, developed, deployed, and operated securely by default.

This role serves as a senior technical contributor responsible for designing, implementing, and advancing AI Application Security capabilities. The ideal candidate brings deep technical expertise across AI systems, application security, and cloud-native architectures to solve complex security challenges and enable secure AI adoption across the enterprise.

• Design and implement advanced security controls for AI-enabled applications, including LLMs, AI agents, RAG pipelines, MCP servers, and AI workflows.
• Perform complex AI application threat modeling and security architecture assessments for high-risk systems.
• Design and implement reusable AI security capabilities, libraries, frameworks, and automation to improve security at scale.
• Develop security controls for prompts, agent memory, tool execution, model interactions, identity, authorization, and sensitive data protection.
• Research, prototype, and evaluate emerging AI security technologies, attack techniques, and defensive capabilities.
• Identify and mitigate AI-specific threats, including prompt injection, indirect prompt injection, model poisoning, jailbreaks, insecure tool execution, excessive agency, sensitive data disclosure, and AI supply chain risks.
• Design and integrate AI security controls into enterprise AI platforms, CI/CD pipelines, and developer workflows.
• Develop reusable reference implementations, security patterns, and engineering guidance for AI-enabled applications.
• Partner with development, platform engineering, architecture, and Data & AI teams to solve complex AI security challenges.
• Conduct advanced security assessments, code reviews, and architecture reviews for AI-enabled applications.
• Evaluate AI security tooling and recommend improvements to increase detection accuracy, automation, and operational efficiency.
• Develop technical documentation, implementation guides, and engineering standards for AI security capabilities.
• Contribute to AI security metrics and continuously improve platform effectiveness and security posture.
• Mentor junior engineers through technical coaching, design reviews, and knowledge sharing.
• Support AI security investigations, incident response, and complex vulnerability remediation.
• Participate in Agile planning and contribute to strategic Application Security initiatives.
• Participate in a 24/7 on-call rotation, including weekends and holidays.

Compensation and Benefits:

• The expected compensation range for this position is between $93,500 - $156,450.
• Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
• Bonus based on performance and eligibility target payout is 10% of annual salary paid out annually.
• Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
• In addition to salary, Pepsi Co offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility:
  Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.

Technical

Skills:

• Advanced knowledge of secure software development, secure architecture, and application security engineering.
• Advanced experience performing application and AI threat modeling using frameworks such as STRIDE, PASTA, or equivalent.
• Deep understanding of the OWASP Top 10, OWASP Top 10 for LLM Applications, and secure software engineering practices.
• Strong experience designing and securing cloud-native applications in AWS (preferred), Azure, or GCP.
• Strong proficiency in Python and/or Go.
• Experience integrating security into CI/CD pipelines and Dev Sec Ops  workflows.
• Deep understanding of modern AI architectures, including:
  • Large Language Models (LLMs)
  • AI Agents
  • Retrieval-Augmented Generation (RAG)
  • Model Context Protocol (MCP)
  • Embeddings and Vector Databases
  • Tool Calling and Function Execution
  • AI Memory and Context Management
  • Multi-Agent Systems
• Experience mitigating AI threats including prompt injection, model poisoning, jailbreaks, insecure tool execution, excessive agency, prompt leakage, sensitive data disclosure, and AI supply chain attacks.
• Experience evaluating AI security technologies such as Promptfoo, NVIDIA Garak, Protect AI, Lakera, Hidden Layer, Microsoft AI Security, or equivalent.
• Experience with AI development frameworks such as Lang Chain, Lang Graph, Semantic Kernel, MCP, OpenAI SDK, Azure AI Foundry, Amazon Bedrock, or similar.
• Strong understanding of identity, authorization, API security, cryptography,…