application security engineer senior at Starbucks

Job description

Now Brewing – application security engineer senior! #tobeapartner From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others. This position contributes to Starbucks success through the development and execution of Application Security Engineering Program practices. You will provide security guidance and conduct security assessments to ensure the technology platforms within the organization are implemented in accordance with established standards and policies. As an application security engineer senior, you will... • Owns application security services, including SAST, DAST, SCA, penetration testing, bug bounty, and code review. • Build and improve application security services with a fresh perspective, leveraging AI-driven capabilities where they can increase speed, accuracy, and scale. • Facilitate remediation of threats by partnering with other cybersecurity teams, providing expert analysis and context. • Deep expertise in source code management platforms and CI/CD workflows like GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with deep understanding of secure cloud deployment workflow practices. • Provide hands-on expertise in explaining and correcting OWASP Top 10 and SANS Top 25 issues • Ability to evaluate AI-provided analysis for accuracy, risk relevance, and remediation quality, ensuring outputs are validated before being used to guide decisions • Makes recommendations on toolset modifications and improvements, improvements on development processes and production application security support. • Contributes to the development and delivery of security training programs. • Participate as a key member in security incident response activities. We'd love to hear from people with... Basic Qualifications • Bachelor's degree in a relevant field or 5+ years of equivalent experience in cybersecurity engineering related roles. • 6+ years of experience working in an information technology discipline. • 6+ years of infrastructure / information security experience. • 4+ years of experience working with infrastructure as code technologies. • Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments. • Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy or information risk management. • Advanced knowledge of cybersecurity principles and practices • Experience with technologies such as firewalls, antivirus software, and intrusion detection systems • Experience with security frameworks and compliance requirements • Proficiency in implementing and managing security controls and technologies • Knowledge of network security protocols and concepts • Familiarity with operating systems and network architectures • In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies • Proficiency in conducting security assessments and audits • Ability to develop and implement security policies and procedures • Experience in managing and responding security incidents • Exceptional problem-solving and troubleshooting skills. • Excellent communication and collaboration skills, with the ability to work effectively with cross-functional teams and stakeholders. • Advanced experience with at least one modern programming language such as Java, Go, Python, Ruby, C++, or C#. • Advanced Proficiency interacting with API's and automating tasks using common scripting languages. Preferred Qualifications • Development expertise in 2 or more of the following: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin • An understanding of PCI practices and experience working with PCI environments. • Experience working with cloud platforms such as AWS, Azure, from both a developer and security perspective. • Experience working with Bug Bounty or VDP programs. • Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.). • Strong communication and relationship building skills. • Skilled at performing security focused application design reviews, static & manual code reviews. • Experience using common security testing tools and techniques to perform a variety of security assessments across multiple platforms with significant expertise in either web or mobile penetration testing. • Experience implementing and operating static and dynamic analysis tools. • Strong understanding of authentication and authorization options and standards. • Deeply knowledgeable about security vulnerabilities with the ability to identify them, assess risk, and provide remediation guidance. • Experience working as a software engineer and knowledgeable about modern web, mobile, and API development practices. • The ability to read and write code in multiple programming languages. • Experience with Git and Github • Knowledgable about CI/CD practices • Experience incorporating security requirements into a SDLC. Additional Qualifications • Ability to apply knowledge of multidisciplinary business principles and practices to achieve successful outcomes in cross-functional projects and activities • Microsoft Word, Excel and PowerPoint • Ability to work within large collaborative organizations • Knowledge and ability to apply process improvement principles • Strong written, verbal and active listening skills • Models and acts in accordance with Starbucks guiding principles • Foster effectiveness during changes in tasks, work environment or condition affecting the organization • Strong analytical and problem-solving skills • Ability to balance multiple priorities and meet deadlines As a Starbucks partner, you (and your family) will have access to medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits. Partners have access to short-term and long-term disability, paid parental leave, family expansion reimbursement, paid vacation from date of hire*, sick time (accrued at 1 hour for every 25 hours worked), eight paid holidays, and two personal days per year. Starbucks also offers eligible partners participation in a 401(k) retirement plan with employer match, a discounted company stock program (S.I.P.), Starbucks equity program (Bean Stock), incentivized emergency savings, and financial well-being tools. Additionally, Starbucks offers 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan, student loan management resources, and access to other educational opportunities. You will also have access to backup care and DACA reimbursement. Starbucks will comply with any applicable state and local laws regarding employee leave benefits, including, but not limited to providing time off pursuant to the Colorado Healthy Families and Workplaces Act, and in accordance with its plans and policies. This list is subject to change depending on collective bargaining in locations where partners have a certified bargaining representative. For additional information regarding partner perks and more detailed information about benefits, go to starbucksbenefits.com . *If you are working in CA, CO, IL, LA, ME, MA, NE, ND or RI, you will accrue vacation up to a maximum of 120 hours (190 in CA) for roles below director and 200 hours (316 in CA) for roles at director or above. For roles in other states, you will be granted vacation time starting at 120 hours annually for roles below director and 200 hours annually for roles director and above. The actual base pay offered to the successful candidate will be based on multiple factors, including but not limited to job-related knowledge/skills, experience, geographical location, and internal equity.  At Starbucks, it is not typical for an individual to be hired at the high end of the range for their role, and compensation decisions are dependent upon the facts and circumstances of each position and candidate. We believe we do our best work when we're together, which is why we're onsite four days a week. Join us and inspire with every cup. Apply today! Starbucks Coffee Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or protected veteran status, or any other characteristic protected by law. Qualified applicants with criminal histories will be considered for employment in a manner consistent with all federal, state and local ordinances.   Starbucks Coffee Company is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at  applicantaccommodation@starbucks.com or 1(888) 611-2258.

Requirements

Must-haves

Now Brewing – application security engineer senior! #tobeapartner
As an application security engineer senior, you will...
Owns application security services, including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
Build and improve application security services with a fresh perspective, leveraging AI-driven capabilities where they can increase speed, accuracy, and scale.
Facilitate remediation of threats by partnering with other cybersecurity teams, providing expert analysis and context.
Deep expertise in source code management platforms and CI/CD workflows like GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with deep understanding of secure cloud deployment workflow practices.
Provide hands-on expertise in explaining and correcting OWASP Top 10 and SANS Top 25 issues
Ability to evaluate AI-provided analysis for accuracy, risk relevance, and remediation quality, ensuring outputs are validated before being used to guide decisions
Makes recommendations on toolset modifications and improvements, improvements on development processes and production application security support.
Contributes to the development and delivery of security training programs.
Participate as a key member in security incident response activities.
We'd love to hear from people with...

Nice-to-haves

Development expertise in 2 or more of the following: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin
An understanding of PCI practices and experience working with PCI environments.
Experience working with cloud platforms such as AWS, Azure, from both a developer and security perspective.
Experience working with Bug Bounty or VDP programs.
Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
Strong communication and relationship building skills.
Skilled at performing security focused application design reviews, static & manual code reviews.
Experience using common security testing tools and techniques to perform a variety of security assessments across multiple platforms with significant expertise in either web or mobile penetration testing.
Experience implementing and operating static and dynamic analysis tools.
Strong understanding of authentication and authorization options and standards.
Deeply knowledgeable about security vulnerabilities with the ability to identify them, assess risk, and provide remediation guidance.
Experience working as a software engineer and knowledgeable about modern web, mobile, and API development practices.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aici/cdazurejavagopythonapijavascriptswiftkotlinaws

Platform: eightfold
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)

Parental Leave