Sr Application Security Engineer

BJ's Wholesale Club • BJ's Club Support Center Marlborough, MA

2d • $100,000 - $131,500 • Hybrid

About The Position

BJ’s Wholesale Club is seeking a Senior Application Security Engineer to secure the software behind its digital, e-commerce, and club-facing experiences. This hands-on individual contributor role is responsible for threat modeling, operating the application security testing toolchain, and partnering with development, platform, and product teams to build and ship secure software. The position has no direct reports and calls for independent work, sound technical judgment, and contributions to maturing Secure SDLC practices against OWASP SAMM, BSIMM, and NIST SSDF. It is suited to someone with a software development or security engineering background who wants to deepen an application security specialization and build credibility with developers in a PCI-regulated retail environment.

The role is hybrid: Tuesday through Thursday are in-office at BJ’s Club Support Center in Marlborough, Massachusetts, while Monday and Friday are remote. The stated pay range is $100,000 to $131,500. BJ’s notes that actual compensation may vary based on factors such as location, education, experience, and qualifications.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.
• 4–6 years of hands-on security or software engineering experience, including at least 2 years focused specifically on application or product security.
• Working knowledge of at least one modern programming language: Java, C#/.NET, JavaScript/TypeScript, Python, or Go; ability to read application code and recognize vulnerable patterns.
• Working knowledge of the OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, and ability to explain exploitability and appropriate fixes to developers.
• Hands-on experience operating enterprise SAST, DAST, and SCA tools, including onboarding applications and tuning rulesets.
• Experience participating in threat modeling using STRIDE or a comparable methodology and translating findings into actionable security requirements.
• Experience integrating security testing into CI/CD pipelines.
• Experience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads; Docker is required and Kubernetes is preferred.
• Hands-on scripting and automation experience using Python, Bash, or PowerShell.
• Familiarity with security frameworks and compliance requirements such as PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001 as they apply to software development.
• Ability to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.
• Strong communication skills and ability to work effectively with engineering teams.

Nice To Haves

• Experience in retail, e-commerce, or other high-volume PCI in-scope environments.
• Experience with API security platforms and discovery tooling.
• Experience working in an embedded, co-sourced, or managed application security delivery model alongside external partners.
• Experience contributing to a security champions program.
• Experience supporting bug bounty or responsible disclosure programs.
• Offensive security or exploit development background, including CTF or hands-on web application exploitation experience.
• Familiarity with infrastructure-as-code tools such as Terraform or CloudFormation.
• Familiarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.
• Familiarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.
• Preferred certifications: CompTIA Security+; GIAC GWAPT or GWEB; (ISC)² CSSLP; AWS or Azure Security certifications; OSCP or OSWE; CCSP.

Responsibilities

• Perform threat modeling and security reviews of new and existing applications, APIs, microservices, and third-party integrations across customer-facing and internal platforms.
• Operate and tune application security testing tools, including SAST, DAST, SCA and dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning; onboard applications, expand coverage, and reduce false positives.
• Work with development teams to remediate security defects and recommend secure coding practices and fixes.
• Implement and maintain security controls in CI/CD pipelines, including policy-as-code and automated testing capabilities.
• Improve Secure SDLC practices in alignment with OWASP SAMM, BSIMM, and NIST SSDF; contribute to maturity assessments and close assigned gaps.
• Work with embedded and co-sourced team members to support application security activities and promote consistent security practices.
• Support API security discovery and inventory, schema and specification validation, and identification of shadow and zombie APIs.
• Develop and maintain secure coding guidance and reusable security resources for development teams.
• Provide secure coding guidance and participate in developer security awareness and security champions initiatives.
• Support PCI DSS 4.0.1 application requirements, including secure development practices, change control, payment-page client-side script integrity and monitoring, and audit evidence collection.
• Support penetration testing and responsible disclosure activities, including scoping input, findings validation, retesting, and root cause analysis.
• Automate security testing tasks and evidence collection through integrations across security tooling, source control, and Jira.
• Conduct software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.
• Support incident response for application-layer events, including exploit reproduction, root cause analysis, and recommended control improvements.
• Write and maintain application security documentation, runbooks, and standard operating procedures.
• Produce metrics and reporting on scanning coverage, Secure SDLC adoption, and application portfolio security posture.

Benefits

• Weekly pay.
• Daily Pay access to earned wages before payday; a fee may apply.
• Complimentary BJ’s Club Card Membership and a free Supplemental Membership for someone in the household.
• Paid time off, including vacation, personal, sick days, holidays, bereavement, and jury duty leave.
• Choice of three medical plans, with optional dental and vision insurance, Health Savings Account (HSA), and flexible spending account options.
• 401(k) retirement savings plan with a company match, available to team members age 18 and older.
• Employee Stock Purchase Plan, with shares of BJ’s common stock available at a 15% discount; eligibility requirements vary by position.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior