Application Security Engineer Senior

Starbucks is seeking a Senior Application Security Engineer in Nashville, TN (onsite) to develop and execute Application Security Engineering Program practices. This role delivers security guidance and performs assessments to help ensure technology platforms align with established standards and policies.

Key Responsibilities

• Own application security services, including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
• Build and improve application security services, using new approaches and AI-driven capabilities when they can improve speed, accuracy, and scale.
• Support threat remediation by partnering with other cybersecurity teams and providing expert analysis and context.
• Apply deep expertise in source code management platforms and CI/CD workflows, including GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with a strong understanding of secure cloud deployment workflows.
• Provide hands-on guidance for OWASP Top 10 and SANS Top 25 issues, including explaining and correcting findings.
• Evaluate analysis produced by AI for accuracy, risk relevance, and remediation quality, ensuring validation before using results to guide decisions.
• Recommend improvements to toolsets, development processes, and production application security support.
• Contribute to the development and delivery of security training programs.
• Participate as a key member in security incident response activities.

Required Qualifications

• Bachelor’s degree in a relevant field, or 5+ years of equivalent experience in cybersecurity engineering related roles.
• 6+ years of experience in an information technology discipline.
• 6+ years of infrastructure or information security experience.
• 4+ years of experience working with infrastructure as code technologies.
• Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
• Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy, or information risk management.
• Advanced knowledge of cybersecurity principles and practices.
• Experience with firewalls, antivirus software, and intrusion detection systems.
• Experience with security frameworks and compliance requirements.
• Proficiency in implementing and managing security controls and technologies.
• Knowledge of network security protocols and concepts.
• Familiarity with operating systems and network architectures.
• In-depth understanding of enterprise-level cybersecurity strategies, frameworks, and technologies.
• Proficiency conducting security assessments and audits.
• Ability to develop and implement security policies and procedures.
• Experience managing and responding to security incidents.
• Exceptional problem-solving and troubleshooting skills.
• Excellent communication and collaboration skills across cross-functional teams and stakeholders.
• Advanced experience with at least one modern programming language: Java, Go, Python, Ruby, C++, or C#.
• Advanced proficiency interacting with API’s and automating tasks using common scripting languages.
• Ability to apply multidisciplinary business principles to achieve successful outcomes in cross-functional projects.
• Proficiency with Microsoft Word, Excel, and PowerPoint.
• Ability to work effectively within large collaborative organizations.
• Knowledge and ability to apply process improvement principles.
• Strong written, verbal, and active listening skills.
• Ability to model and act in accordance with Starbucks guiding principles.
• Capability to foster effectiveness during changes in tasks, work environment, or organizational conditions.
• Strong analytical and problem-solving skills, with the ability to balance multiple priorities and meet deadlines.

Preferred Qualifications

• Development expertise in 2 or more of: Python, JavaScript, C#, Java, Scala, Objective-C, Swift, Kotlin.
• Understanding of PCI practices and experience working with PCI environments.
• Experience working with cloud platforms such as AWS and Azure from both a developer and security perspective.
• Experience working with Bug Bounty or VDP programs.
• Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
• Strong communication and relationship-building skills.
• Experience performing security-focused application design reviews and static and manual code reviews.
• Experience using common security testing tools and techniques across multiple platforms, with significant expertise in either web or mobile penetration testing.
• Experience implementing and operating static and dynamic analysis tools.
• Strong understanding of authentication and authorization options and standards.
• Deep knowledge of security vulnerabilities, including the ability to identify them, assess risk, and provide remediation guidance.
• Experience working as a software engineer and familiarity with modern web, mobile, and API development practices.
• Ability to read and write code in multiple programming languages.
• Experience with Git and GitHub.
• Knowledge of CI/CD practices.
• Experience incorporating security requirements into a SDLC.

Technologies

• SAST
• DAST
• SCA
• GitHub Enterprise
• GitHub Cloud
• GitLab
• Azure Devops
• OWASP Top 10
• SANS Top 25
• CISSP, CISSM
• Firewalls, antivirus software, intrusion detection systems
• Infrastructure as code technologies
• Java, Go, Python, Ruby, C++, C#
• API’s

Compensation and Location

• Location: Nashville, TN (onsite)
• Salary: USD 112,400 - 187,400 per year
• Minimum experience: 5 years

Benefits

• Medical, dental, vision
• Basic and supplemental life insurance
• Other voluntary insurance benefits
• Short-term and long-term disability
• Paid parental leave
• Family expansion reimbursement
• Paid vacation from date of hire
• Sick time (accrued at 1 hour for every 25 hours worked)
• Eight paid holidays
• Two personal days per year
• 401(k) retirement plan with employer match (eligible partners)
• Discounted company stock program (S.I.P.)
• Starbucks equity program (Bean Stock)
• Incentivized emergency savings
• Financial well-being tools
• 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
• Student loan management resources
• Access to other educational opportunities
• Access to backup care and DACA reimbursement