cybersecurity engineer senior, Identity and Automation

Starbucks Coffee Company•Seattle, WA

10d•$127,100 - $211,800•Onsite

About The Position

As a Cybersecurity Engineer Senior in the Identity and Automation organization, you will design, implement, and operate security capabilities that enable AI agents and non-human workloads to access enterprise systems safely. The role focuses on secure gateway integrations, identity-based authorization, and dependable automation for deploying and managing service configurations, policies, and integrations throughout their lifecycle. It combines identity engineering, production operations, and automation to secure AI agents, non-human workloads, and enterprise services through strong authentication, authorization, and credential management. You will own service configuration, integration lifecycle, release planning, reliability, and operational support for gateway services and identity integrations. You will build reusable infrastructure-as-code and automation, implement least-privilege access, secure cloud and enterprise application identities, and troubleshoot authentication and integration issues. The role also involves incident response, vendor coordination, design documentation, operational handoffs, code and design reviews, mentoring, and collaboration across application, security, cloud, and platform teams. The position is onsite four days a week. Starbucks describes partner benefits including health and insurance coverage, paid leave, retirement and stock programs, tuition coverage, and other financial and family-support resources. Actual base pay depends on job-related knowledge and skills, experience, location, and internal equity; a pay range is not stated in the supplied posting.

Requirements

At least 5 years of experience in information technology, focused on cybersecurity, identity, or cloud security engineering.
At least 3 years of hands-on identity and access management (IAM) experience, including authentication, authorization, and identity lifecycle management.
Experience with cloud identity platforms, enterprise applications, and API-based integrations.
Solid understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, MFA, and certificate-based authentication.
Experience with scripting, automation, or infrastructure-as-code.
Ability to assess, mitigate, and respond to cybersecurity risks, vulnerabilities, and access-control weaknesses.
Experience contributing to or mentoring high-performing engineering teams.
Excellent written and verbal communication skills and ability to explain complex technical concepts to diverse audiences.
Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals, and managed identities, with experience securing non-human identities and workloads.
Experience with Microsoft Azure and Microsoft Entra identity, application, and workload security services.
Hands-on production service engineering from design and implementation through testing, monitoring, release management, and operational support, with a record of improving reliability and resolving integration failures.
Strong Terraform experience, including reusable modules, provider management, state protection, automated validation, and controlled deployment.
Strong PowerShell and REST API integration skills, including automation development and troubleshooting HTTP, DNS, TLS, certificates, and authentication flows.
Experience with certificate-based authentication and trust chains for applications, services, and non-human workloads, including certificate lifecycle management and private-key protection.

Nice To Haves

Experience with AWS or Google Cloud Platform.
Experience securing AI agents, assistants, or agentic applications through identity, authentication, authorization, and credential management.
Engineering experience with Copilot Studio, Power Platform connectors, MCP security, or identity integrations for Microsoft 365, Teams, and GitHub Copilot.
Experience developing automation, integrations, or platform services using Python, Go, C#, JavaScript/TypeScript, or similar languages in addition to PowerShell.
Hands-on experience with certificate lifecycle automation and PKI integrations supporting non-human identities and workloads.
Experience with Active Directory or privileged access management (PAM).
Relevant cybersecurity, IAM, cloud, or infrastructure certifications.

Responsibilities

Design and deliver secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service.
Own service configuration, integration lifecycle, and release planning, coordinating with vendors on managed capabilities.
Evaluate security and reliability tradeoffs and validate normal, failure, and recovery scenarios.
Engineer reusable infrastructure-as-code configurations and modules for gateway policies and onboarding; manage providers, dependencies, versioning, protected state, Git workflows, peer review, automated validation, controlled deployments, drift, and recovery.
Use APIs for unsupported workflows while maintaining clear configuration ownership.
Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering, and downstream user context; validate authentication, authorization, and policy boundaries.
Engineer secure identity integrations for enterprise applications, AI assistants, and agentic tools, including application and workload identities, API permissions, consent, and access policies across supported cloud platforms.
Preserve appropriate user or workload context and separation between infrastructure, identity, and application permissions.
Build, debug, and maintain PowerShell and API-based automation; diagnose HTTP, DNS, TLS, certificate, and authentication-flow issues using sign-in and audit evidence.
Own service reliability through telemetry, monitoring, and runbooks; troubleshoot integrations, respond to incidents, lead root-cause analysis, and coordinate vendor escalations.
Participate in support rotations and planned maintenance as needed.
Partner with application owners, Security Architecture, cloud and platform teams, and vendors; produce design documentation and operational handoffs, explain business and security tradeoffs, and provide code and design reviews.
Mentor teammates to build operational resilience and backup coverage; maintain primary service ownership and contribute to shared Identity engineering, incident response, and cross-training.

Benefits

Medical, dental, and vision insurance.
Basic and supplemental life insurance and other voluntary insurance benefits.
Short-term and long-term disability.
Paid parental leave and family expansion reimbursement.
Paid vacation from date of hire and sick time accrued at 1 hour for every 25 hours worked.
Eight paid holidays and two personal days per year.
Eligible participation in a 401(k) retirement plan with employer match.
Discounted company stock program (S.I.P.) and Starbucks equity program (Bean Stock).
Incentivized emergency savings and financial well-being tools.
100% upfront tuition coverage for a first-time bachelor's degree through Arizona State University's online program via the Starbucks College Achievement Plan.
Student loan management resources and access to other educational opportunities.
Backup care and DACA reimbursement.