cybersecurity engineer senior, Identity and Automation

Starbucks; Seattle (WA); On-site; USD 180,000 - 230,000; Full time

Job summary

Starbucks Corp. is seeking a senior cybersecurity engineer within Identity and Automation to design, implement and operate security capabilities for AI agents and non-human workloads across enterprise systems.

You will own secure gateway integrations, identity-based authorization and automation for deployment and management of service configurations, policies and integrations—ensuring least-privilege access and strong authentication across cloud platforms.

Qualifications

• 5+ years of experience in information technology, with a focus on cybersecurity, identity or cloud security engineering.
• 3+ years of hands-on experience in identity and access management (IAM), with a focus on authentication, authorization and identity lifecycle management.
• Experience with cloud identity platforms, enterprise applications and API-based integrations.
• Solid understanding of identity standards and technologies including OAuth 2.0, OpenID Connect, SAML, SCIM, MFA and certificate-based authentication.
• Experience with scripting, automation or infrastructure-as-code.
• Proven ability to assess, mitigate and respond to cybersecurity risks, vulnerabilities and access control weaknesses.
• Demonstrated experience contributing to or mentoring high-performing engineering teams.
• Excellent written and verbal communication skills, with the ability to convey complex technical concepts to diverse audiences

Responsibilities

• Design, implement, and operate security capabilities for AI agents and non-human workloads.
• Own secure gateway integrations and identity-based authorization.
• Develop automation for deployment and management of service configurations and policies.
• Engineer reusable IaC configurations for gateway policies and onboarding.
• Enforce least-privilege, deny-by-default access for workloads and agents.
• Configure identity integrations for enterprise apps and workloads across cloud platforms.
• Build and maintain PowerShell and API-based automation.
• Monitor reliability, respond to incidents, and coordinate vendor escalations.
• Provide design documentation and operational handoffs with stakeholders.
• Mentor teammates to build operational resilience and cross-training.

Skills

Cybersecurity engineering

IAM

Cloud security

Scripting & IaC

OAuth 2.0 / OIDC

Tools

Terraform

Azure Entra

AWS / GCP

Job description

Now Brewing - cybersecurity engineer senior, Identity and Automation! #tobeapartner

From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.

As a cybersecurity engineer senior, Identity and Automation organization, you will design, implement and operate security capabilities that enable AI agents and non-human workloads to access enterprise systems safely. Your primary focus will be secure gateway integrations, identity-based authorization and dependable automation for the deployment and management of service configurations, policies and integrations throughout their lifecycle.

This hands-on role combines identity engineering, production operations and automation to secure AI agents, non-human workloads and enterprise services through strong authentication, authorization and credential management.

As a Starbucks partner, you will...

Design and deliver secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service. Own service configuration, integration lifecycle and release planning while coordinating with vendors on managed capabilities. Evaluate security and reliability tradeoffs and validate normal, failure and recovery scenarios.

Engineer reusable infrastructure-as-code configurations and modules for gateway policies and onboarding. Manage providers, dependencies and versioning, protect state and use Git, peer review, automated validation and controlled deployments to manage drift and recovery. Use APIs for unsupported workflows while maintaining clear configuration ownership.

Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering and downstream user context. Validate authentication, authorization and policy enforcement boundaries.

Engineer secure identity integrations for enterprise applications, AI assistants and agentic tools. Configure application and workload identities, API permissions, consent and access policies across supported cloud platforms. Preserve appropriate user or workload context and separation between infrastructure, identity and application permissions.

Build, debug and maintain PowerShell and API-based automation. Diagnose issues across HTTP, DNS, TLS, certificates and authentication flows using sign-in and audit evidence to improve reliability and security.

Own service reliability through telemetry, monitoring and runbooks. Troubleshoot integrations, respond to incidents, lead root-cause analysis and coordinate vendor escalations. Participate in support rotations and planned maintenance as needed.

Partner with application owners, Security Architecture, cloud and platform teams and vendors. Produce design documentation and operational handoffs, explain business and security tradeoffs and provide constructive code and design reviews.

Mentor teammates to build operational resilience and backup coverage. Maintain primary service ownership and contribute to shared Identity engineering, incident response and cross-training as needed.

We'd love to hear from people with:

Basic Qualifications

• 5+ years of experience in information technology, with a focus on cybersecurity, identity or cloud security engineering.


• 3+ years of hands-on experience in identity and access management (IAM), with a focus on authentication, authorization and identity lifecycle management.


• Experience with cloud identity platforms, enterprise applications and API-based integrations.


• Solid understanding of identity standards and technologies including OAuth 2.0, OpenID Connect, SAML, SCIM, MFA and certificate-based authentication.


• Experience with scripting, automation or infrastructure-as-code.


• Proven ability to assess, mitigate and respond to cybersecurity risks, vulnerabilities and access control weaknesses.


• Demonstrated experience contributing to or mentoring high-performing engineering teams.


• Excellent written and verbal communication skills, with the ability to convey complex technical concepts to diverse audiences

Role-specific experience - In addition to the Basic Qualifications, this role requires:

• Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals and managed identities, with experience securing non-human identities and workloads.


• Experience with Microsoft Azure and Microsoft Entra, including identity, application and workload security services. Experience with AWS or Google Cloud Platform is preferred.


• Hands-on production service engineering, from design and implementation through testing, monitoring, release management and operational support, with a track record of improving service reliability and resolving integration failures.


• Strong Terraform experience, including reusable modules, provider m