Senior Information Security Analyst

Overview PepsiCo's Global Emerging Technologies Security Team is responsible for operationalizing API and web application security using the ImpervaSolutions, which turns discovery and visibility into continuous, measurable risk reduction through discovery, vulnerability identification, prioritization, mitigation, and escalation. Within the Cyber Fusion Center, we are looking for a Senior Information Security Analyst with 6 to 7 years of experience operating Imperva Solutions, vulnerability management, automation development, and enterprise security operations. This role requires advanced scripting skills (Python, PowerShell, Bash) to build automation frameworks that integrate Imperva with ServiceNow, SIEM/SOAR platforms (e.g., Splunk,Tines, Torq), and ITSM, optimizing risk remediation workflows. As a seasoned professional, you will lead strategic security initiatives to operationalize API and web application protection (discovery, classification, tuning, and inline mitigation) using Imperva, design scalable integration architectures, evaluate COTS product enhancements, participate in stakeholder/customer reviews, and mentor junior analysts on the platform's daily operations. Responsibilities Operate, monitor, and continuously improve the enterprise Imperva WAF and API Security (WAAP) service end to end, including configuration, maintenance, health checks, and lifecycle activities across APIs and web applications, acting as the organization's technical SME for the platform. Administer the Imperva management console (Cloud Console and/or on-prem MX): user/role management, site and gateway onboarding, license management, and health/performance monitoring of nodes and gateways. Manage the platform's lifecycle: apply patches, version upgrades, and gateway updates (on-prem and cloud), validating stability and policy integrity post-change. Monitor service capacity and performance (latency impact, throughput, node utilization) to ensure the WAAP layer does not degrade application performance. Execute all production policy and configuration changes through a formal Change Management (CAB) process, documenting change requests, rollback plans, and post-change validation. Execute Imperva's Discover → Assess → Mitigate process: continuous discovery of REST, GraphQL, gRPC, and SOAP endpoints including shadow APIs, unmanaged endpoints, and "zombie" APIs, as well as onboarding/offboarding of web applications, classifying both by data sensitivity (PII, PHI, PCI, financial) and business criticality. Design, implement, and tune Imperva security policies, profiles, and rules: blocking adjusting signatures, exceptions, allowlisting, rate limiting, bot score, and geo-controls to minimize false positives. Analyze Imperva traffic and logs to identify abuse patterns, bot attacks, scraping, anomalies, and application-layer attacks (SQLi, XSS, DDoS); apply inline, client-session-level actions to stop abuse without coarse IP-level blocking. Support onboarding applications and APIs into the Imperva environment: requirements gathering, architecture and exposure review, DNS/SSL-TLS certificate validation, and cutover coordination; manage certificate renewals and IP/URL/country blocking. Automate ingestion of Imperva findings (API and WAF) into ServiceNow VR, integrating with SOAR platforms (e.g., Tines, Torq) to automate ticket creation, configuration validation, and response to low-risk incidents without manual intervention. Develop, optimize, and scale automation (Python, PowerShell, Bash) that integrates Imperva with ServiceNow VR & CC, SIEM/SOAR, and ITSM to reduce manual effort and accelerate response times. Design custom API integrations between Imperva, ServiceNow, and ITSM/SOAR platforms to automate security workflows. Embed API and web application security into CI/CD pipelines: schema validation, tests aligned to the OWASP API Top 10, Infrastructure-as-Code components (Terraform), and policy-as-code at pull-request time. Act as the L2/L3 escalation point for L1/SOC teams on Imperva-related events and incidents, validating triage, guiding lower-level engineers, and maintaining runbooks and knowledge articles. Apply expert knowledge of networking and security protocols (TCP/IP, HTTP/S, SSH, FTP, DNS, SSL/TLS, VPNs, RDP) for troubleshooting incidents across layers 3, 4, and 7, including DoS/DDoS attacks, brute force, and application vectors (XSS, SQLi, RCE). Define and track operational security KPIs blocked events, top attacks/attackers, false positive (FP) rate, mean time to remediation (MTTR), exposed/unmanaged endpoints, protection coverage, and inline action rate and produce periodic (weekly/monthly) reports for stakeholders and leadership. Manage AI Protection solutions (AI Prompt Jailbreak defense, AI Model protection) and DLP technologies including CASB SaaS and Email Security SaaS. Collaborate with product, DevOps, and support teams to investigate root cause of false positive/negative cases and implement corresponding changes to Imperva policies. Participate in recurring reviews with internal customers and business stakeholders ("customer/business review calls") to communicate risk posture, attack trends, and remediation status. Lead technical design reviews, evaluate security tools, and drive architectural discussions to improve the effectiveness of Imperva and complementary tools. Provide technical leadership in API security, WAF, container security, and security automation, mentoring junior and mid-level analysts on best practices for Imperva operations, API development, and risk prioritization. Develop security documentation, playbooks, SOPs, and network diagrams related to the day-to-day operation of Imperva. Stay current on emerging API and web application threats, regulatory changes, and vulnerability trends, continuously refining security automation strategies. Accountabilities Execute on projects, objectives, and deliverables in alignment with team vision, mission, and goals. Act as the organi