Cybersecurity Engineer Senior, Identity and Automation

As a senior cybersecurity engineer focused on Identity and Automation, you will design, implement, and operate security capabilities that allow AI agents and non-human workloads to access enterprise systems safely. The role emphasizes secure gateway integrations, identity-based authorization, and dependable automation across the full lifecycle of service configurations, policies, and integrations.

Location

Seattle, WA (onsite)

Compensation

USD 127,100 - 211,800 per year

Key Responsibilities

• Design and deliver secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service.
• Own service configuration, integration lifecycle, and release planning, while coordinating with vendors on managed capabilities.
• Evaluate security and reliability tradeoffs and validate normal, failure, and recovery scenarios.
• Engineer reusable infrastructure-as-code configurations and modules for gateway policies and onboarding.
• Manage providers, dependencies, and versioning; protect state and use Git with peer review, automated validation, and controlled deployments to reduce drift and support recovery.
• Use APIs for unsupported workflows while maintaining clear configuration ownership.
• Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering, and downstream user context.
• Validate authentication, authorization, and policy enforcement boundaries.
• Engineer secure identity integrations for enterprise applications, AI assistants, and agentic tools.
• Configure application and workload identities, API permissions, consent, and access policies across supported cloud platforms.
• Preserve appropriate user or workload context and separation between infrastructure, identity, and application permissions.
• Build, debug, and maintain PowerShell and API-based automation.
• Diagnose issues across HTTP, DNS, TLS, certificates, and authentication flows using sign-in and audit evidence to improve reliability and security.
• Own service reliability through telemetry, monitoring, and runbooks.
• Troubleshoot integrations, respond to incidents, lead root-cause analysis, and coordinate vendor escalations.
• Participate in support rotations and planned maintenance as needed.
• Partner with application owners, Security Architecture, cloud and platform teams, and vendors.
• Produce design documentation and operational handoffs, including explanations of business and security tradeoffs, plus constructive code and design reviews.
• Mentor teammates to build operational resilience and backup coverage.
• Maintain primary service ownership and contribute to shared Identity engineering, incident response, and cross-training as needed.

Required Qualifications

• 5+ years of experience in information technology, with focus on cybersecurity, identity, or cloud security engineering.
• 3+ years hands-on experience in identity and access management (IAM), including authentication, authorization, and identity lifecycle management.
• Experience with cloud identity platforms, enterprise applications, and API-based integrations.
• Strong understanding of identity standards and technologies: OAuth 2.0, OpenID Connect, SAML, SCIM, MFA, and certificate-based authentication.
• Experience with scripting, automation, or infrastructure-as-code.
• Proven ability to assess, mitigate, and respond to cybersecurity risks, vulnerabilities, and access control weaknesses.
• Demonstrated experience contributing to or mentoring high-performing engineering teams.
• Excellent written and verbal communication skills, including ability to convey complex technical concepts to diverse audiences.
• Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals and managed identities, with experience securing non-human identities and workloads.
• Experience with Microsoft Azure and Microsoft Entra, including identity, application, and workload security services.
• Hands-on production service engineering from design and implementation through testing, monitoring, release management, and operational support, with a track record of improving reliability and resolving integration failures.
• Strong Terraform experience, including reusable modules, provider management, state protection, automated validation, and controlled deployment.
• Strong PowerShell and REST API integration skills, including automation development and troubleshooting across HTTP, DNS, TLS, certificates, and authentication flows.
• Experience with certificate-based authentication and trust chains for applications, services, and non-human workloads, including certificate lifecycle management and private-key protection.

Technologies

• PowerShell
• OAuth 2.0
• OpenID Connect
• SAML
• SCIM
• MFA
• Model Context Protocol (MCP)
• Terraform
• Git
• REST API
• HTTP, DNS, TLS, certificates
• Microsoft Azure, Microsoft Entra
• AWS, Google Cloud Platform
• Infrastructure-as-code
• Microsoft 365, Teams
• GitHub Copilot, Copilot Studio
• Power Platform connectors
• Python, Go, C#, JavaScript/TypeScript
• Active Directory
• Privileged access management (PAM)

Benefits

• Medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits
• Short-term and long-term disability
• Paid parental leave
• Family expansion reimbursement
• Paid vacation from date of hire
• Sick time (accrued at 1 hour for every 25 hours worked)
• Eight paid holidays
• Two personal days per year
• 401(k) retirement plan with employer match
• Discounted company stock program (S.I.P.)
• Starbucks equity program (Bean Stock)
• Incentivized emergency savings
• Financial well-being tools
• 100% upfront tuition coverage for a first-time bachelor's degree through Arizona State University’s online program via the Starbucks College Achievement Plan
• Student loan management resources
• Access to other educational opportunities
• Backup care
• DACA reimbursement
• Reasonable accommodations for job applicants with disabilities

Preferred Qualifications

• Experience securing AI agents, assistants, or agentic applications through identity, authentication, authorization, and credential management.
• Engineering experience with Copilot Studio, Power Platform connectors, MCP security, or identity integrations for Microsoft 365, Teams, and GitHub Copilot.
• Experience developing automation, integrations, or platform services using Python, Go, C#, JavaScript/TypeScript, or similar languages, in addition to PowerShell.
• Hands-on experience with certificate lifecycle automation and PKI integrations supporting non-human identities and workloads.
• Experience with Active Directory or privileged access management (PAM) is a plus.
• Relevant cybersecurity, IAM, cloud, or infrastructure certifications are a plus.