Build safer applications with Starbucks as a Senior Application Security Engineer in Nashville, TN (onsite). This role focuses on developing and executing application security engineering program practices, pairing hands-on security work with guidance that helps technology platforms meet established standards and policies. You will also have the opportunity to leverage AI-driven capabilities when they can improve speed, accuracy, and scale.
Responsibilities
- Own application security services including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
- Build and continuously improve application security services using a fresh perspective, including AI-driven capabilities where they can increase speed, accuracy, and scale.
- Partner with other cybersecurity teams to facilitate threat remediation, providing expert analysis and context.
- Bring deep expertise in source code management platforms and CI/CD workflows such as GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with strong secure cloud deployment workflow knowledge.
- Provide hands-on expertise explaining and correcting OWASP Top 10 and SANS Top 25 issues.
- Evaluate AI-provided analysis for accuracy, risk relevance, and remediation quality, ensuring outputs are validated before being used to guide decisions.
- Recommend changes and improvements to toolsets, development processes, and production application security support.
- Contribute to the development and delivery of security training programs.
- Participate as a key member in security incident response activities.
Requirements
- Bachelor’s degree in a relevant field or 5+ years of equivalent experience in cybersecurity engineering related roles.
- 6+ years of experience working in an information technology discipline.
- 6+ years of infrastructure or information security experience.
- 4+ years of experience working with infrastructure as code technologies.
- Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
- Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy, or information risk management.
- Advanced knowledge of cybersecurity principles and practices, including experience with firewalls, antivirus software, and intrusion detection systems.
- Experience with security frameworks and compliance requirements, and proficiency implementing and managing security controls and technologies.
- Knowledge of network security protocols and concepts; familiarity with operating systems and network architectures.
- In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies.
- Proficiency in conducting security assessments and audits, and ability to develop and implement security policies and procedures.
- Experience managing and responding to security incidents.
- Exceptional problem-solving and troubleshooting skills; excellent communication and collaboration skills with cross-functional stakeholders.
- Advanced experience with at least one modern programming language: Java, Go, Python, Ruby, C++, or C#.
- Advanced proficiency interacting with APIs and automating tasks using common scripting languages.
- Ability to apply multidisciplinary business principles to achieve outcomes in cross-functional projects and activities.
- Proficiency with Microsoft Word, Excel, and PowerPoint.
- Ability to work within large collaborative organizations; knowledge and ability to apply process improvement principles.
- Strong written, verbal, and active listening skills, and alignment with Starbucks guiding principles.
- Foster effectiveness during changes in tasks, work environment, or conditions affecting the organization.
- Strong analytical and problem-solving skills, with ability to balance multiple priorities and meet deadlines.
Preferred Qualifications
- Development expertise in 2+ of: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin.
- Understanding of PCI practices and experience working with PCI environments.
- Experience with cloud platforms such as AWS and Azure from both a developer and security perspective.
- Experience working with Bug Bounty or VDP programs.
- Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
- Skilled at performing security focused application design reviews and static and manual code reviews.
- Experience using common security testing tools and techniques for security assessments across multiple platforms, with significant expertise in either web or mobile penetration testing.
- Experience implementing and operating static and dynamic analysis tools.
- Strong understanding of authentication and authorization options and standards.
- Deep knowledge of security vulnerabilities, including identification, risk assessment, and remediation guidance.
- Experience as a software engineer and knowledge of modern web, mobile, and API development practices.
- Ability to read and write code in multiple programming languages.
- Experience with Git and GitHub and knowledge of CI/CD practices.
- Experience incorporating security requirements into an SDLC.
Benefits
- Medical, dental, vision
- Basic and supplemental life insurance; other voluntary insurance benefits
- Short-term and long-term disability
- Paid parental leave, plus family expansion reimbursement
- Paid vacation starting from date of hire; sick time accrued at 1 hour per 25 hours worked
- Eight paid holidays and two personal days per year
- 401(k) retirement plan with employer match (eligible partners)
- Discounted company stock program (S.I.P.) and Starbucks equity program (Bean Stock)
- Incentivized emergency savings; financial well-being tools
- 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
- Student loan management resources and access to other educational opportunities
- Access to backup care and DACA reimbursement
Compensation: USD 112,400 - 187,400 per year.
Technologies you may work with: SAST, DAST, SCA, GitHub Enterprise, GitHub Cloud, GitLab, Azure Devops, OWASP Top 10, SANS Top 25, CISSP, CISSM, firewalls, antivirus software, intrusion detection systems, infrastructure as code technologies, Java, Go, Python, Ruby, C#, APIs.
