Among computer occupations, all other, AI is already used for a large share of the tasks. Measured exposure for computer occupations, all other: 31% (high).

Share of this job’s tasks that AI is already used for at work, from real usage. It is not a forecast of job loss, and a low number means no use seen yet. Source: Anthropic Economic Index.

Check how this applies to your own job

Starbucks has filed 6 layoff notices in the last twelve months, covering 792 workers, most recently October 2026. These are public filings with state labor departments, and an open role can sit alongside them. See the filings

Skills this job asks for

Say which you have and which you want to build. We use it to match you to jobs like this one.

About the job

Now Brewing – cybersecurity engineer senior, Identity and Automation! #tobeapartner

From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.

As a cybersecurity engineer senior, Identity and Automation organization, you will design, implement and operate security capabilities that enable AI agents and non-human workloads to access enterprise systems safely. Your primary focus will be secure gateway integrations, identity-based authorization and dependable automation for the deployment and management of service configurations, policies and integrations throughout their lifecycle.

This hands-on role combines identity engineering, production operations and automation to secure AI agents, non-human workloads and enterprise services through strong authentication, authorization and credential management.

As a Starbucks partner, you will…

Design and deliver secure gateway and Model Context Protocol (MCP) integrations, including the Starbucks MCP Gateway service. Own service configuration, integration lifecycle and release planning while coordinating with vendors on managed capabilities. Evaluate security and reliability tradeoffs and validate normal, failure and recovery scenarios.

Engineer reusable infrastructure-as-code configurations and modules for gateway policies and onboarding. Manage providers, dependencies and versioning, protect state and use Git, peer review, automated validation and controlled deployments to manage drift and recovery. Use APIs for unsupported workflows while maintaining clear configuration ownership.

Implement least-privilege, deny-by-default access for workloads and AI agents, including tool-level permissions, credential brokering and downstream user context. Validate authentication, authorization and policy enforcement boundaries.

Engineer secure identity integrations for enterprise applications, AI assistants and agentic tools. Configure application and workload identities, API permissions, consent and access policies across supported cloud platforms. Preserve appropriate user or workload context and separation between infrastructure, identity and application permissions.

Build, debug and maintain PowerShell and API-based automation. Diagnose issues across HTTP, DNS, TLS, certificates and authentication flows using sign-in and audit evidence to improve reliability and security.

Own service reliability through telemetry, monitoring and runbooks. Troubleshoot integrations, respond to incidents, lead root-cause analysis and coordinate vendor escalations. Participate in support rotations and planned maintenance as needed.

Partner with application owners, Security Architecture, cloud and platform teams and vendors. Produce design documentation and operational handoffs, explain business and security tradeoffs and provide constructive code and design reviews.

Mentor teammates to build operational resilience and backup coverage. Maintain primary service ownership and contribute to shared Identity engineering, incident response and cross-training as needed.

We’d love to hear from people with:

Basic Qualifications

5+ years of experience in information technology, with a focus on cybersecurity, identity or cloud security engineering.

3+ years of hands-on experience in identity and access management (IAM), including authentication, authorization and identity lifecycle management.

Experience with cloud identity platforms, enterprise applications and API-based integrations.

Solid understanding of identity standards and technologies including OAuth 2.0, OpenID Connect, SAML, SCIM, MFA and certificate-based authentication.

Experience with scripting, automation or infrastructure-as-code.

Proven ability to assess, mitigate and respond to cybersecurity risks, vulnerabilities and access control weaknesses.

Demonstrated experience contributing to or mentoring high-performing engineering teams.

Excellent written and verbal communication skills, with the ability to convey complex technical concepts to diverse audiences

Role-specific experience - In addition to the Basic Qualifications, this role requires:

Practical OAuth 2.0 and OpenID Connect expertise, including delegated and application access, service principals and managed identities, with experience securing non-human identities and workloads.

Experience with Microsoft Azure and Microsoft Entra, including identity, application and workload security services. Experience with AWS or Google Cloud Platform is preferred.

Hands-on production service engineering, from design and implementation through testing, monitoring, release management and operational support, with a track record of improving service reliability and resolving integration failures.

Strong Terraform experience, including reusable modules, provider management, state protection, automated validation and controlled deployment

Strong PowerShell and REST API integration skills, including automation development and troubleshooting across HTTP, DNS, TLS, certificates and authentication flows.

Experience with certificate-based authentication and trust chains for applications, services and non-human workloads, including certificate lifecycle management and private-key protection.

Preferred Qualifications

Experience securing AI agents, assistants or agentic applications through identity, authentication, authorization and credential management.

Engineering experience with Copilot Studio, Power Platform connectors, MCP security or identity integrations for Microsoft 365, Teams and GitHub Copilot.

Experience developing automation, integrations or platform services using Python, Go, C#, JavaScript/TypeScript or similar languages, in addition to PowerShell.

Hands-on experience with certificate lifecycle automation and PKI integrations supporting non-human identities and workloads. Experience with Active Directory or privileged access management (PAM) is a plus.

Relevant cybersecurity, IAM, cloud or infrastructure certifications are a plus.

As a Starbucks partner, you (and your family) will have access to medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits. Partners have access to short-term and long-term disability, paid parental leave, family expansion reimbursement, paid vacation from date of hire*, sick time (accrued at 1 hour for every 25 hours worked), eight paid holidays, and two personal days per year. Starbucks also offers eligible partners participation in a 401(k) retirement plan with employer match, a discounted company stock program (S.I.P.), Starbucks equity program (Bean Stock), incentivized emergency savings, and financial well-being tools. Additionally, Starbucks offers 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan, student loan management resources, and access to other educational opportunities. You will also have access to backup care and DACA reimbursement. Starbucks will comply with any applicable state and local laws regarding employee leave benefits, including, but not limited to providing time off pursuant to the Colorado Healthy Families and Workplaces Act, and in accordance with its plans and policies. This list is subject to change depending on collective bargaining in locations where partners have a certified bargaining representative. For additional information regarding partner perks and more detailed information about benefits, go to starbucksbenefits.com .

*If you are working in CA, CO, IL, LA, ME, MA, NE, ND or RI, you will accrue vacation up to a maximum of 120 hours (190 in CA) for roles below director and 200 hours (316 in CA) for roles at director or above. For roles in other states, you will be granted vacation time starting at 120 hours annually for roles below director and 200 hours annually for roles director and above.

The actual base pay offered to the successful candidate will be based on multiple factors, including but not limited to job-related knowledge/skills, experience, geographical location, and internal equity.  At Starbucks, it is not typical for an individual to be hired at the high end of the range for their role, and compensation decisions are dependent upon the facts and circumstances of each position and candidate.

We believe we do our best work when we're together, which is why we're onsite four days a week.

Join us and inspire with every cup. Apply today!

Starbucks Coffee Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or protected veteran status, or any other characteristic protected by law.

Qualified applicants with criminal histories will be considered for employment in a manner consistent with all federal, state and local ordinances.

Starbucks Coffee Company is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at  applicantaccommodation@starbucks.com or 1(888) 611-2258.