application security engineer senior (Nashville, TN)

Starbucks Coffee Company•Nashville, TN

22h•$112,400 - $187,400•Onsite

About The Position

This position contributes to Starbucks’ success through the development and execution of Application Security Engineering Program practices. The role provides security guidance and conducts security assessments to help ensure technology platforms across the organization comply with established standards and policies. The senior engineer owns application security services, including static and dynamic application security testing (SAST and DAST), software composition analysis (SCA), penetration testing, bug bounty, and code review. The role builds and improves these services, including using AI-driven capabilities where they can improve speed, accuracy, and scale, and validating AI-generated analysis before it informs decisions. The engineer partners with cybersecurity teams to facilitate threat remediation, advises on secure development and cloud deployment workflows, recommends improvements to tools and processes, contributes to security training, and participates in security incident response. The position is onsite four days a week. Starbucks describes partner benefits including insurance coverage, leave and time off, retirement and stock programs, tuition coverage, and other support and educational resources; eligibility and details may vary.

Requirements

Bachelor's degree in a relevant field or at least 5 years of equivalent experience in cybersecurity engineering-related roles.
At least 6 years of experience working in an information technology discipline.
At least 6 years of infrastructure or information security experience.
At least 4 years of experience working with infrastructure-as-code technologies.
Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
Advanced knowledge of cybersecurity principles and practices.
Experience with firewalls, antivirus software, and intrusion detection systems.
Experience with security frameworks and compliance requirements.
Proficiency implementing and managing security controls and technologies.
Knowledge of network security protocols and concepts, operating systems, and network architectures.
In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies.
Proficiency conducting security assessments and audits.
Ability to develop and implement security policies and procedures.
Experience managing and responding to security incidents.
Advanced experience with at least one modern programming language, such as Java, Go, Python, Ruby, C++, or C#.
Advanced proficiency interacting with APIs and automating tasks using common scripting languages.
Exceptional problem-solving and troubleshooting skills.
Excellent communication and collaboration skills, including the ability to work effectively with cross-functional teams and stakeholders.

Nice To Haves

Development expertise in two or more of Python, JavaScript, C#, Java, Scala, Objective-C, Swift, and Kotlin.
Understanding of PCI practices and experience working in PCI environments.
Experience with cloud platforms such as AWS or Azure from developer and security perspectives.
Experience working with bug bounty or vulnerability disclosure programs.
Certifications such as CEH, CSSLP, CISSP, or GIAC (GWAPT, GMOB, etc.).
Strong communication and relationship-building skills.
Experience performing security-focused application design reviews and static and manual code reviews.
Experience using security testing tools and techniques to assess multiple platforms, with significant expertise in web or mobile penetration testing.
Experience implementing and operating static and dynamic analysis tools.
Strong understanding of authentication and authorization options and standards.
Deep knowledge of security vulnerabilities, including identifying them, assessing risk, and providing remediation guidance.
Experience as a software engineer and knowledge of modern web, mobile, and API development practices.
Ability to read and write code in multiple programming languages.
Experience with Git and GitHub.
Knowledge of CI/CD practices.
Experience incorporating security requirements into a software development life cycle.
Certifications such as CISSP, CISSM, or others focused on cybersecurity, data privacy, or information risk management.
Ability to apply multidisciplinary business principles and practices to cross-functional projects and activities.
Proficiency with Microsoft Word, Excel, and PowerPoint.
Ability to work within large collaborative organizations.
Knowledge of and ability to apply process improvement principles.
Strong written, verbal, and active listening skills.
Ability to model and act in accordance with Starbucks guiding principles.
Ability to remain effective during changes in tasks, work environment, or conditions affecting the organization.
Strong analytical and problem-solving skills.
Ability to balance multiple priorities and meet deadlines.

Responsibilities

Own application security services, including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
Build and improve application security services, leveraging AI-driven capabilities where they can increase speed, accuracy, and scale.
Evaluate AI-provided analysis for accuracy, risk relevance, and remediation quality, and validate outputs before using them to guide decisions.
Partner with other cybersecurity teams to facilitate threat remediation and provide expert analysis and context.
Provide guidance on source code management platforms, CI/CD workflows, and secure cloud deployment practices.
Explain and help correct OWASP Top 10 and SANS Top 25 issues.
Recommend modifications and improvements to the application security toolset, development processes, and production application security support.
Contribute to the development and delivery of security training programs.
Participate as a key member in security incident response activities.
Conduct security assessments and audits, and help ensure technology platforms follow established standards and policies.

Benefits

Medical, dental, and vision insurance.
Basic and supplemental life insurance and other voluntary insurance benefits.
Short-term and long-term disability.
Paid parental leave and family expansion reimbursement.
Paid vacation from date of hire, sick time, eight paid holidays, and two personal days per year.
Eligible participation in a 401(k) retirement plan with employer match.
Discounted company stock program (S.I.P.) and Starbucks equity program (Bean Stock).
Incentivized emergency savings and financial well-being tools.
100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan.
Student loan management resources and access to other educational opportunities.
Backup care and DACA reimbursement.