Application Security Engineer Senior

Cybersecurity Jobs; Nashville (TN); On-site; USD 112,000 - 187,000; Full time

Benefits offered by this job

Medical, dental, vision

Life insurance

Disability insurance

Paid parental leave

Paid vacation

Sick time

401(k) with match

Stock program

Job summary

Starbucks in Nashville, TN seeks a Senior Application Security Engineer to lead security program practices for applications. The role combines hands-on security with guidance to meet standards, including AI-driven capabilities to improve speed and scale.

You will own SAST/DAST/SCA, code reviews, threat remediation, CI/CD security, and security training. Strong coding and cloud security experience is required, aligned with Starbucks principles.

Qualifications

• Bachelor’s degree in a relevant field or 5+ years of equivalent cybersecurity experience.
• 6+ years in information technology and 6+ years in infrastructure or information security.
• 4+ years of infrastructure as code experience and security tooling.

Responsibilities

• Own application security services including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
• Build and improve security services with AI-driven capabilities to increase speed and scale.
• Partner with cybersecurity teams to facilitate threat remediation and provide expert analysis.
• Lead security in CI/CD workflows and production security support.
• Contribute to security training programs and incident response activities.

Skills

Java

Go

Python

Ruby

C++

C#

APIs

Education

Bachelor’s degree

Tools

GitHub Enterprise

GitHub Cloud

GitLab

Azure DevOps

Job description

Build safer applications with Starbucks as a Senior Application Security Engineer in Nashville, TN (onsite). This role focuses on developing and executing application security engineering program practices, pairing hands‑on security work with guidance that helps technology platforms meet established standards and policies. You will also have the opportunity to leverage AI-driven capabilities when they can improve speed, accuracy, and scale.

Responsibilities

• Own application security services including SAST, DAST, SCA, penetration testing, bug bounty, and code review.
• Build and continuously improve application security services using a fresh perspective, including AI-driven capabilities where they can increase speed, accuracy, and scale.
• Partner with other cybersecurity teams to facilitate threat remediation, providing expert analysis and context.
• Bring deep expertise in source code management platforms and CI/CD workflows such as GitHub Enterprise, GitHub Cloud, GitLab, and Azure Devops, with strong secure cloud deployment workflow knowledge.
• Provide hands‑on expertise explaining and correcting OWASP Top 10 and SANS Top 25 issues.
• Evaluate AI‑provided analysis for accuracy, risk relevance, and remediation quality, ensuring outputs are validated before being used to guide decisions.
• Recommend changes and improvements to toolsets, development processes, and production application security support.
• Contribute to the development and delivery of security training programs.
• Participate as a key member in security incident response activities.

Requirements

• Bachelor’s degree in a relevant field or 5+ years of equivalent experience in cybersecurity engineering related roles.
• 6+ years of experience working in an information technology discipline.
• 6+ years of infrastructure or information security experience.
• 4+ years of experience working with infrastructure as code technologies.
• Experience deploying, configuring, and troubleshooting cybersecurity tools in enterprise environments.
• Certifications such as CISSP, CISSM or others focused on cybersecurity, data privacy, or information risk management.
• Advanced knowledge of cybersecurity principles and practices, including experience with firewalls, antivirus software, and intrusion detection systems.
• Experience with security frameworks and compliance requirements, and proficiency implementing and managing security controls and technologies.
• Knowledge of network security protocols and concepts; familiarity with operating systems and network architectures.
• In‑depth understanding of enterprise‑level cybersecurity strategies, frameworks, and technologies.
• Proficiency in conducting security assessments and audits, and ability to develop and implement security policies and procedures.
• Experience managing and responding to security incidents.
• Exceptional problem‑solving and troubleshooting skills; excellent communication and collaboration skills with cross‑functional stakeholders.
• Advanced experience with at least one modern programming language: Java, Go, Python, Ruby, C++, or C#.
• Advanced proficiency interacting with APIs and automating tasks using common scripting languages.
• Ability to apply multidisciplinary business principles to achieve outcomes in cross‑functional projects and activities.
• Proficiency with Microsoft Word, Excel, and PowerPoint.
• Ability to work within large collaborative organizations; knowledge and ability to apply process improvement principles.
• Strong written, verbal, and active listening skills, and alignment with Starbucks guiding principles.
• Foster effectiveness during changes in tasks, work environment, or conditions affecting the organization.
• Strong analytical and problem‑solving skills, with ability to balance multiple priorities and meet deadlines.

Preferred Qualifications

• Development expertise in 2+ of: Python, JavaScript, C#, Java, Scala, Objective‑C, Swift, Kotlin.
• Understanding of PCI practices and experience working with PCI environments.
• Experience with cloud platforms such as AWS and Azure from both a developer and security perspective.
• Experience working with Bug Bounty or VDP programs.
• Certifications such as CEH, CSSLP, CISSP, GIAC (GWAPT, GMOB, etc.).
• Skilled at performing security focused application design reviews and static and manual code reviews.
• Experience using common security testing tools and techniques for security assessments across multiple platforms, with significant expertise in either web or mobile penetration testing.
• Experience implementing and operating static and dynamic analysis tools.
• Strong understanding of authentication and authorization options and standards.
• Deep knowledge of security vulnerabilities, including identification, risk assessment, and remediation guidance.
• Experience as a software engineer and knowledge of modern web, mobile, and API development practices.
• Ability to read and write code in multiple programming languages.
• Experience with Git and GitHub and knowledge of CI/CD practices.
• Experience incorporating security requirements into an SDLC.

Benefits

• Medical, dental, vision
• Basic and supplemental life insurance; other voluntary insurance benefits
• Short‑term and long‑term disability
• Paid parental leave, plus family expansion reimbursement
• Paid vacation starting from date of hire; sick time accrued at 1 hour per 25 hours worked
• Eight paid holidays and two personal days per year
• 401(k) retirement plan with employer match (eligible partners)
• Discounted company stock program (S.I.P.) and Starbucks equity program (Bean Stock)
• Incentivized emergency savings; financial well‑being tools
• 100% upfront tuition coverage for a first‑time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan
• Student loan management resources and access to other educational opportunities
• Access to backup care and DACA reimbursement

Compensation: USD 112,400 - 187,400 per year.

Technologies you may work with: SAST, DAST, SCA, GitHub Enterprise, GitHub Cloud, GitLab, Azure Devops, OWASP Top 10, SANS Top 25, CISSP, CISSM, firewalls, antivirus software, intrusion detection systems, infrastructure as code technologies, Java, Go, Python, Ruby, C#, APIs.