Info Security Assoc Manager (San Nicolás de los Garza)

Overview

We Are PepsiCo. Join PepsiCo and Dare for Better! We are the perfect place for curious people, thinkers and change agents. From leadership to front lines, we're excited about the future and working together to make the world a better place. Being part of PepsiCo means being part of one of the largest food and beverage companies in the world, with our iconic brands consumed more than a billion times a day in more than 200 countries. Our product portfolio, which includes 22 of the world's most iconic brands, such as Sabritas, Gamesa, Quaker, Pepsi, Gatorade and Sonrics, has been a part of Mexican homes for more than 116 years. A career at PepsiCo means working in a culture where all people are welcome. Here, you can dare to be you. No matter who you are, where you're from, or who you love, you can always influence the people around you and make a positive impact in the world.

Responsibilities

The Info Security Assoc Manager is responsible for safeguarding PepsiCo's digital assets by assessing the compliance of new and changing systems against information security requirements and managing risks associated with IT and Information Security systems throughout the project lifecycle. The ISA Lead will collaborate with various security teams and businesses to facilitate compliance with Information Security standards, provide technical guidance for key strategic initiatives, and drive the secure delivery of technology solutions within PepsiCo. The role heavily focuses on security risk‑based assessments, data‑driven decision‑making and automation.

Scope of responsibilities:

• Security Design Expertise: Proven track record in assessing security designs, including data flow diagrams, architectural blueprints, low‑level designs, networking diagrams, authentication mechanisms, and authorization schemes. Demonstrated experience in aligning these designs with industry standards such as NIST ******, ISO *****, CIS, and OWASP to ensure robust security postures. Skilled at identifying potential security gaps and implementing best practices to fortify system architectures against emerging threats. Familiarity with the latest security tools and technologies, and experience in integrating security measures into complex IT environments.
• Project Lifecycle Reviews: Review IT and Information Security systems throughout the project lifecycle, identifying risks and security requirements, and recommending paths to eliminate identified risks and implement compensating controls.
• Automated Risk Assessments: Conduct risk‑based assessments using automated tools and techniques to prioritize and address security risks.
• Threat Modeling: Utilize expert knowledge in threat modeling techniques and methodologies to proactively identify, assess, and prioritize security risks, enabling the organization to implement targeted mitigation strategies and maintain a robust information security posture.
• Collaboration and Education: Collaborate with various IT and Business teams to ensure they are knowledgeable about Information Security processes and requirements, influencing them to eliminate or reduce risks.
• ServiceNow Utilization: Experience using ServiceNow to gather necessary information and data, automating security assessment processes to enhance efficiency and effectiveness.
• Metrics Management and Reporting: Manage operational metrics related to the ISA and GRC processes, utilizing Power BI for advanced reporting, tracking project progress, and developing corrective action plans.
• Process Improvement and Proactive Security: Govern Information Security services from the ISA, tracking process metrics, identifying issues, and driving process improvement initiatives. Stay updated with threat intelligence, leverage Azure and cloud security knowledge, and implement Agile and DevSecOps methodologies to integrate security into the development process.

Qualifications

• A minimum of 5 years of experience in Information Security, IT Risk Management, or a similar role.
• Advanced conversational English is a must.
• Mandatory Technical Skills:
  • In-depth technical experience and knowledge of infrastructure technologies, networks, web, computing, cloud services, manufacturing equipment, mobile devices, and information (cyber) security.
  • Strong understanding of information security frameworks, regulations, and standards such as NIST ******, CIS, MITRE ATT&CK, and ISO *****.
  • Proficient in ServiceNow with the ability to leverage its modules for information gathering, data analysis, and automation of the ISA service.
  • Proficient in Power BI for developing reports and dashboards to support data‑driven decision‑making.
  • Strong skills in developing ad hoc reports and managing metrics.
  • Knowledge of AWS, Azure, Salesforce, Serv