Sr Application Security Engineer

BJ’s Wholesale Club, Inc. is hiring a Sr Application Security Engineer to help secure the software that powers BJ’s digital, e-commerce, and club-facing experiences. This individual contributor role partners with development teams to assess risk, improve secure delivery practices, and reduce security exposure across applications and APIs.

Based in Marlborough, MA with a hybrid schedule, the engineer will focus on threat modeling, operating and tuning the application security testing tool chain, and strengthening security controls in CI/CD and the software development lifecycle.

Location and Schedule

• Marlborough, MA (hybrid)
• Tuesday to Thursday: in-office at BJ’s Club Support Center
• Monday and Friday: remote

Compensation

• USD 100,000 - 131,500 per year

Responsibilities

• Conduct threat modeling and security reviews for new and existing applications, APIs, microservices, and third-party integrations across customer-facing and internal platforms.
• Operate and tune the application security testing tool chain, including SAST, DAST, SCA and dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning, with goals to onboard applications, expand coverage, and reduce false positives.
• Partner with development teams to remediate security defects and provide recommendations for secure coding practices and fixes.
• Implement and maintain security controls in CI/CD pipelines, including policy-as-code and automated testing capabilities for secure software delivery.
• Drive Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, including maturity assessments and closing assigned gaps.
• Collaborate with embedded and co-sourced team members to support application security activities and promote consistent practices.
• Support API security across discovery and inventory, schema and specification validation, and identifying shadow and zombie APIs.
• Develop and maintain secure coding guidance and reusable security resources for development teams, including developer security awareness and security champions initiatives.
• Support PCI DSS 4.0.1 application requirements, including secure development practices, change control, client-side script integrity and monitoring for payment pages, and evidence collection for audits.
• Support penetration testing and responsible disclosure workflows, including scoping input, findings validation, retesting, and root cause analysis to prevent recurrence.
• Automate security testing tasks and evidence collection through integrations across security tooling, source control, and Jira.
• Perform software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.
• Support incident response for application-layer events, including exploit reproduction, root cause analysis, and recommended control improvements.
• Write and maintain application security documentation such as runbooks and standard operating procedures.
• Produce metrics and reporting for scanning coverage, Secure SDLC adoption, and security posture across the application portfolio.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or equivalent practical experience.
• 4-6 years of hands-on security or software engineering experience, with at least 2 years focused on application or product security.
• Working knowledge of at least one modern programming language: Java, C#/.NET, JavaScript/TypeScript, Python, or Go, including ability to read application code and recognize vulnerable patterns.
• Working knowledge of OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, including ability to explain exploitability and the correct fix to developers.
• Hands-on experience operating enterprise SAST, DAST, and SCA tooling, including onboarding applications and tuning rulesets.
• Experience participating in threat modeling using STRIDE or a comparable methodology, translating findings into actionable security requirements.
• Experience integrating security testing into CI/CD pipelines.
• Experience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads (Docker required, Kubernetes preferred).
• Hands-on scripting and automation experience with Python, Bash, or PowerShell.
• Familiarity with security frameworks and compliance requirements as they apply to software development, including PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001.
• Ability to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.
• Strong communication skills and ability to work effectively with engineering teams.

Technologies

• Java; C#/.NET; JavaScript/TypeScript; Python; Go
• OWASP Top 10; OWASP API Security Top 10; OWASP ASVS
• SAST; DAST; SCA; dependency analysis; secrets detection; infrastructure-as-code scanning; container image scanning
• CI/CD; policy-as-code
• OWASP SAMM; BSIMM; NIST SSDF; PCI DSS 4.0.1
• STRIDE; Docker; Kubernetes
• AWS; Azure; GCP
• Bash; PowerShell
• SBOM; SBOM generation; Jira; source control
• SLSA; Terraform; CloudFormation

Benefits

• Weekly Pay
• Daily Pay
• Free BJ’s Memberships
• Generous Paid Time Off
• Flexible and Affordable Health Benefits
• 401(k) Retirement Savings Plan
• Employee Stock Purchase Plan

Nice to Have

• Experience in retail, e-commerce, or other high-volume PCI in-scope environments.
• Experience with API security platforms and discovery tooling.
• Experience working within an embedded, co-sourced, or managed application security delivery model alongside external partners.
• Experience contributing to a security champions program.
• Experience supporting bug bounty or responsible disclosure programs.
• Offensive security or exploit development background, including CTF or hands-on web application exploitation experience.
• Familiarity with infrastructure-as-code such as Terraform or CloudFormation.
• Familiarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.
• Familiarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.

Preferred Certifications

• CompTIA Security+
• GIAC GWAPT, GWEB, or (ISC)² CSSLP
• AWS or Azure Security certifications
• OSCP or OSWE
• CCSP