cybersecurity engineer senior, Identity and Automation

Now Brewing - cybersecurity engineer senior, Identity and Automation! #tobeapartner

From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.

As a cybersecurity engineer senior, Identity and Automation organization, you will design, implement and operate security capabilities that enable AI agents and non-human workloads to access enterprise systems safely. Your primary focus will be secure gateway integrations, identity-based authorization and dependable automation for the deployment and management of service configurations, policies and integrations throughout their lifecycle.

This hands-on role combines identity engineering, production operations and automation to secure AI agents, non-human workloads and enterprise services through strong authentication, authorization and credential management.

As a Starbucks partner, you will…

• Design and deliver secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service. Own service configuration, integration lifecycle and release planning while coordinating with vendors on managed capabilities. Evaluate security and reliability tradeoffs and validate normal, failure and recovery scenarios.
• Engineer reusable infrastructure-as-code configurations and modules for gateway policies and onboarding. Manage providers, dependencies and versioning, protect state and use Git, peer review, automated validation and controlled deployments to manage drift and recovery. Use APIs for unsupported workflows while maintaining clear configuration ownership.
• Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering and downstream user context. Validate authentication, authorization and policy enforcement boundaries.
• Engineer secure identity integrations for enterprise applications, AI assistants and agentic tools. Configure application and workload identities, API permissions, consent and access policies across supported cloud platforms. Preserve appropriate user or workload context and separation between infrastructure, identity and application permissions.
• Build, debug and maintain PowerShell and API-based automation. Diagnose issues across HTTP, DNS, TLS, certificates and authentication flows using sign-in and audit evidence to improve reliability and security.
• Own service reliability through telemetry, monitoring and runbooks. Troubleshoot integrations, respond to incidents, lead root-cause analysis and coordinate vendor escalations. Participate in support rotations and planned maintenance as needed.
• Partner with application owners, Security Architecture, cloud and platform teams and vendors. Produce design documentation and operational handoffs, explain business and security tradeoffs and provide constructive code and design reviews.
• Mentor teammates to build operational resilience and backup coverage. Maintain primary service ownership and contribute to shared Identity engineering, incident response and cross-training as needed.

We'd love to hear from people with:

Basic Qualifications

• 5+ years of experience in information technology, with a focus on cybersecurity, identity or cloud security engineering.
• 3+ years of hands-on experience in identity and access management (IAM), including authentication, authorization and identity lifecycle management.
• Experience with cloud identity platforms, enterprise applications and API-based integrations.
• Solid understanding of identity standards and technologies including OAuth 2.0, OpenID Connect, SAML, SCIM, MFA and certificate-based authentication.
• Experience with scripting, automation or infrastructure-as-code.
• Proven ability to assess, mitigate and respond to cybersecurity risks, vulnerabilities and access control weaknesses.
• Demonstrated experience contributing to or mentoring high-performing engineering teams.
• Excellent written and verbal communication skills, with the ability to convey complex technical concepts to diverse audiences

Role-specific experience - In addition to the Basic Qualifications, this role requires:

• Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals and managed identities, with experience securing non-human identities and workloads.
• Experience with Microsoft Azure and Microsoft Entra, including identity, application and workload security services. Experience with AWS or Google Cloud Platform is preferred.
• Hands-on production service engineering, from design and implementation through testing, monitoring, release management and operational support, with a track record of improving service reliability and resolving integration failures.
• Strong Terraform experience, including reusable modules, provider management, state protection, automated validation and controlled deployment
• Strong PowerShell and REST API integration skills, including automation development and troubleshooting across HTTP, DNS, TLS, certificates and authentication flows.
• Experience with certificate-based authentication and trust chains for applications, services and non-human workloads, including certificate lifecycle management and private-key protection.

Preferred Qualifications

• Experience securing AI agents, assistants or agentic applications through identity, authentication, authorization and credential management.
• Engineering experience with Copilot Studio, Power Platform connectors, MCP security or identity integrations for Microsoft 365, Teams and GitHub Copilot.
• Experience developing automation, integrations or platform services using Python, Go, C#, JavaScript/TypeScript or similar languages, in addition to PowerShell.
• Hands-on experience with certificate lifecycle automation and PKI integrations supporting non-human identities and workloads. Experience with Active Directory or privileged access management (PAM) is a plus.
• Relevant cybersecurity, IAM, cloud or infrastructure certifications are a plus.

As a Starbucks partner, you (and your family) will have access to medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits. Partners have access to short-term and long-term disability, paid parental leave, family expansion reimbursement, paid vacation from date of hire*, sick time (accrued at 1 hour for every 25 hours worked), eight paid holidays, and two personal days per year. Starbucks also offers eligible partners participation in a 401(k) retirement plan with employer match, a discounted company stock program (S.I.P.), Starbucks equity program (Bean Stock), incentivized emergency savings, and financial well-being tools. Additionally, Starbucks offers 100% upfront tuition coverage for a first-time bachelor's degree through Arizona State University's online program via the Starbucks College Achievement Plan, student loan management resources, and access to other educational opportunities. You will also have access to backup care and DACA reimbursement. Starbucks will comply with any applicable state and local laws regarding employee leave benefits, including, but not limited to providing time off pursuant to the Colorado Healthy Families and Workplaces Act, and in accordance with its plans and policies. This list is subject to change depending on collective bargaining in locations where partners have a certified bargaining representative. For additional information regarding partner perks and more detailed information about benefits, go to starbucksbenefits.com.

• If you are working in CA, CO, IL, LA, ME, MA, NE, ND or RI, you will accrue vacation up to a maximum of 120 hours (190 in CA) for roles below director and 200 hours (316 in CA) for roles at director or above. For roles in other states, you will be granted vacation time starting at 120 hours annually for roles below director and 200 hours annually for roles director and above.

The actual base pay offered to the successful candidate will be based on multiple factors, including but not limited to job-related knowledge/skills, experience, geographical location, and internal equity.  At Starbucks, it is not typical for an individual to be hired at the high end of the range for their role, and compensation decisions are dependent upon the facts and circumstances of each position and candidate.

We believe we do our best work when we"re together, which is why we"re onsite four days a week.

Join us and inspire with every cup. Apply today!

Starbucks Coffee Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or protected veteran status, or any other characteristic protected by law.

Qualified applicants with criminal histories will be considered for employment in a manner consistent with all federal, state and local ordinances.

Starbucks Coffee Company is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at applicantaccommodation@starbucks.com or 1(888) 611-2258.