Cybersecurity Engineer Senior, Identity and Automation

Lead security and automation work for identity and gateway integrations that allow AI agents and non-human workloads to access enterprise systems safely.

Responsibilities

• Design, implement, and operate secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service
• Own service configuration, integration lifecycle, and release planning while coordinating with vendors on managed capabilities
• Assess security and reliability tradeoffs and validate normal, failure, and recovery scenarios
• Build reusable infrastructure-as-code configurations and modules for gateway policies and onboarding
• Manage providers, dependencies, and versioning; protect state; use Git with peer review, automated validation, and controlled deployments to reduce drift and support recovery
• Use APIs for unsupported workflows while keeping clear configuration ownership
• Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering, and downstream user context
• Validate boundaries for authentication, authorization, and policy enforcement
• Engineer secure identity integrations for enterprise applications, AI assistants, and agentic tools
• Configure application and workload identities, API permissions, consent, and access policies across supported cloud platforms
• Preserve appropriate user or workload context while maintaining separation between infrastructure, identity, and application permissions
• Build, debug, and maintain PowerShell and API-based automation
• Diagnose issues across HTTP, DNS, TLS, certificates, and authentication flows using sign-in and audit evidence to improve reliability and security
• Own service reliability through telemetry, monitoring, and runbooks
• Troubleshoot integrations, respond to incidents, lead root-cause analysis, and coordinate vendor escalations
• Participate in support rotations and planned maintenance as needed
• Partner with application owners, Security Architecture, cloud/platform teams, and vendors
• Create design documentation and operational handoffs, explaining business and security tradeoffs, and provide constructive code and design reviews
• Mentor teammates to improve operational resilience and backup coverage
• Maintain primary service ownership and contribute to shared Identity engineering, incident response, and cross-training as needed

Requirements

• 5+ years of experience in information technology with a focus on cybersecurity, identity, or cloud security engineering
• 3+ years hands-on experience in identity and access management (IAM), including authentication, authorization, and identity lifecycle management
• Experience with cloud identity platforms, enterprise applications, and API-based integrations
• Strong understanding of identity standards and technologies: OAuth 2.0, OpenID Connect, SAML, SCIM, MFA, and certificate-based authentication
• Experience with scripting, automation, or infrastructure-as-code
• Proven ability to assess, mitigate, and respond to cybersecurity risks, vulnerabilities, and access control weaknesses
• Demonstrated experience contributing to or mentoring high-performing engineering teams
• Excellent written and verbal communication skills to convey complex technical concepts to diverse audiences
• Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals and managed identities, with experience securing non-human identities and workloads
• Experience with Microsoft Azure and Microsoft Entra, including identity, application, and workload security services
• Experience with AWS or Google Cloud Platform is preferred
• Hands-on production service engineering across design, implementation, testing, monitoring, release management, and operational support, with a record of improving reliability and resolving integration failures
• Strong Terraform experience: reusable modules, provider management, state protection, automated validation, and controlled deployment
• Strong PowerShell and REST API integration skills, including troubleshooting across HTTP, DNS, TLS, certificates, and authentication flows
• Experience with certificate-based authentication and trust chains, including certificate lifecycle management and private-key protection

Technologies

• PowerShell
• OAuth 2.0, OpenID Connect, SAML, SCIM, MFA
• Model Context Protocol (MCP)
• Terraform, Git
• REST API, HTTP, DNS, TLS, certificates
• Microsoft Azure, Microsoft Entra
• AWS, Google Cloud Platform
• Infrastructure-as-code
• Microsoft 365, Teams
• GitHub Copilot, Copilot Studio
• Power Platform connectors
• Python, Go, C#, JavaScript/TypeScript
• Active Directory
• Privileged access management (PAM)

Benefits

• Medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits
• Short-term and long-term disability
• Paid parental leave
• Family expansion reimbursement
• Paid vacation from date of hire
• Sick time (accrued at 1 hour for every 25 hours worked)
• Eight paid holidays
• Two personal days per year
• 401(k) retirement plan with employer match
• Discounted company stock program (S.I.P.)
• Starbucks equity program (Bean Stock)
• Incentivized emergency savings
• Financial well-being tools
• 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
• Student loan management resources
• Access to other educational opportunities
• Backup care
• DACA reimbursement
• Reasonable accommodations for job applicants with disabilities

Preferred Qualifications

• Experience securing AI agents, assistants, or agentic applications through identity, authentication, authorization, and credential management
• Engineering experience with Copilot Studio, Power Platform connectors, MCP security or identity integrations for Microsoft 365, Teams, and GitHub Copilot
• Experience developing automation, integrations, or platform services using Python, Go, C#, JavaScript/TypeScript, or similar languages in addition to PowerShell
• Hands-on experience with certificate lifecycle automation and PKI integrations supporting non-human identities and workloads
• Experience with Active Directory or privileged access management (PAM) is a plus
• Relevant cybersecurity, IAM, cloud, or infrastructure certifications are a plus

Location: Seattle, WA (onsite) | Salary: USD 127,100 - 211,800 per year | Minimum experience: 5 years