Sr Application Security Engineer

BJ’s Wholesale Club, Inc. is hiring a Sr Application Security Engineer to help secure software powering digital, e-commerce, and club-facing experiences. This is an individual contributor role with a focus on threat modeling, running and tuning an application security testing tool chain, and partnering with engineering teams to deliver secure software.

Based in Marlborough, MA (hybrid), the role supports security activities across customer-facing and internal platforms, including application and API security, Secure SDLC improvements, and application-layer incident support.

What you’ll do

• Conduct threat modeling and security reviews for new and existing applications, APIs, microservices, and third-party integrations.
• Operate and tune the application security testing tool chain, including SAST, DAST, SCA, dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning.
• Work with development teams to remediate security defects and provide recommendations for secure coding practices and fixes.
• Implement and maintain security controls in CI/CD using policy-as-code and automated testing capabilities for secure software delivery.
• Drive Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, including maturity assessments and gap closure.
• Support API security across discovery and inventory, schema and specification validation, and identification of shadow and zombie APIs.
• Develop and maintain secure coding guidance and reusable security resources for development teams, including participation in developer security awareness and security champions initiatives.
• Support PCI DSS 4.0.1 application requirements, including secure development practices, change control, client-side script integrity and monitoring for payment pages, and audit evidence collection.
• Contribute to penetration testing and responsible disclosure workflows, including scoping input, validating findings, retesting, and root cause analysis.
• Automate security testing and evidence collection by integrating security tooling, source control, and Jira to reduce manual effort.
• Perform software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.
• Support incident response for application-layer events by performing exploit reproduction, root cause analysis, and recommending control improvements.
• Write and maintain application security documentation, runbooks, and standard operating procedures.
• Produce metrics and reporting for scanning coverage, Secure SDLC adoption, and the security posture of the application portfolio.

Minimum qualifications

• Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.
• 4-6 years of hands-on security or software engineering experience, with at least 2 years focused on application or product security.
• Working knowledge of at least one modern programming language: Java, C#/.NET, JavaScript/TypeScript, Python, or Go, including the ability to read application code and recognize vulnerable patterns.
• Working knowledge of OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, including explaining exploitability and correct fixes.
• Hands-on experience operating enterprise SAST, DAST, and SCA tooling, including onboarding applications and tuning rulesets.
• Experience participating in threat modeling using STRIDE (or comparable methodology) and translating findings into actionable security requirements.
• Experience integrating security testing into CI/CD pipelines.
• Experience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads (Docker required, Kubernetes preferred).
• Hands-on scripting and automation experience with Python, Bash, or PowerShell.
• Familiarity with frameworks and compliance such as PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001 as they apply to software development.
• Ability to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.
• Strong communication skills and ability to work effectively with engineering teams.

Technologies

• Java, C#/.NET, JavaScript/TypeScript, Python, Go
• OWASP Top 10, OWASP API Security Top 10, OWASP ASVS
• SAST, DAST, SCA, dependency analysis, secrets detection, infrastructure-as-code scanning, container image scanning
• CI/CD, policy-as-code
• OWASP SAMM, BSIMM, NIST SSDF, PCI DSS 4.0.1
• STRIDE
• Docker, Kubernetes, AWS, Azure, GCP
• Bash, PowerShell, SBOM, Jira, source control, SLSA, Terraform, CloudFormation

Salary

USD 100,000 - 131,500 per year

Benefits

• Weekly Pay
• Daily Pay
• Free BJ’s Memberships
• Generous Paid Time Off
• Flexible and Affordable Health Benefits
• 401(k) Retirement Savings Plan
• Employee Stock Purchase Plan

Nice to have

• Experience in retail, e-commerce, or other high-volume PCI in-scope environments.
• Experience with API security platforms and discovery tooling.
• Experience working within an embedded, co-sourced, or managed application security delivery model alongside external partners.
• Experience contributing to a security champions program.
• Experience supporting bug bounty or responsible disclosure programs.
• Offensive security or exploit development background, including CTF or hands-on web application exploitation experience.
• Familiarity with infrastructure-as-code such as Terraform or CloudFormation.
• Familiarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.
• Familiarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.

Preferred certifications

• CompTIA Security+
• GIAC GWAPT, GWEB, or (ISC)² CSSLP
• AWS or Azure Security certifications
• OSCP or OSWE
• CCSP

Hybrid / work schedule

• Tuesday through Thursday: in-office days at BJ’s Club Support Center in Marlborough, MA
• Monday and Friday: remote days