Cybersecurity Incident Response Engineer, Lead

Starbucks - Seattle, WA

Full-time - Senior

Remote - Seattle, WA

Food Services and Drinking Places

About the position

As a Cybersecurity Incident Response Engineer, Lead at Starbucks, you will play a crucial role in safeguarding the organization against cybersecurity threats. This position is integral to the success of Starbucks, as it involves the investigation and response to cybersecurity incidents. You will be expected to demonstrate strong problem-solving skills and excellent communication abilities, along with a deep technical understanding of modern cybersecurity threats and the relevant protections against them. Your proactive approach will be essential; you will take ownership of issues, leading others to take action rather than waiting for someone else to address problems. Collaboration is key in this role, as you will work with various teams to ensure effective incident response. In this leadership position, you will lead the identification, triage, and investigation of potential security incidents. You will orchestrate containment, remediation, and root cause analysis for security incidents, ensuring that all actions taken are thorough and effective. Your responsibilities will also include executing endpoint, network, and cloud forensics, as well as communicating security incident status updates to executive audiences. You will review and implement runbooks and standard operating procedures for incident response, crafting and advancing tooling and capabilities to support and automate response activities. Additionally, you will guide and mentor junior members of the threat response team, serving as a key escalation point and modeling the guiding principles of Starbucks. This role requires a deep commitment to cybersecurity and a passion for continuous learning and improvement. You will be expected to stay abreast of the latest developments in the field and to drive yourself to become an expert in cybersecurity practices. Your ability to juggle multiple priorities and meet deadlines will be essential, as will your capacity to promote a strong collaboration mindset within your team and across the organization.

Responsibilities

• Leads identification, triage, and investigation of potential security incidents.
• Orchestrates containment, remediation, and root cause analysis for security incidents.
• Executes endpoint, network, and cloud forensics.
• Communicates security incident status updates to executive audiences.
• Reviews and implements runbooks and standard operating procedures for incident response.
• Crafts and advances tooling and capabilities to support and automate response activities.
• Guides and mentors junior members of the threat response team as a key escalation point.
• Models and acts in accordance with Starbucks guiding principles.

Requirements

• 8+ years of experience working in an information technology / information security discipline.
• 4+ years of experience leading cybersecurity incident response.
• 1+ years of additional experience performing digital forensics.
• Deep technical understanding of modern cybersecurity threats.
• Leads threat hunting for threat actor TTPs based on MITRE ATT&CK framework.
• Quickly assimilates new technology concepts.
• Exceptional communication skills with both technical and non-technical audiences.
• Comprehends and applies understanding of compliance and regulatory requirements such as SOX and PCI.
• Can adeptly juggle multiple priorities to meet deadlines.
• Promotes a strong collaboration mindset.
• Excellent problem-solving abilities.
• Demonstrates passion about cybersecurity and drives self to become an expert.

Nice-to-haves

• Strong knowledge and experience in programming with at least one modern language such as Java, Python, Ruby, Go, or C#.
• Capable of leading the automation of tasks and interacting with APIs using common scripting languages.
• Demonstrates seasoned expertise deploying, configuring, and troubleshooting cybersecurity controls in enterprise environments.
• Certifications such as CISSP, GCIH, OSCP, or others focused on cybersecurity, incident response, or threat actor techniques.

Benefits

• Medical, dental, and vision insurance coverage.
• Basic and supplemental life insurance.
• Short-term and long-term disability benefits.
• Paid parental leave.
• Family expansion reimbursement.
• Paid vacation from date of hire.
• Sick time accrued at 1 hour for every 25 hours worked.
• Eight paid holidays and two personal days per year.
• 401(k) retirement plan with employer match.
• Discounted company stock program (S.I.P.).
• Starbucks equity program (Bean Stock).
• Incentivized emergency savings and financial well-being tools.
• 100% upfront tuition coverage for a first-time bachelor's degree through Arizona State University's online program.
• Student loan management resources and access to other educational opportunities.
• Backup care and DACA reimbursement.