{"id":4265413,"url":"https://alion.io/job/bjs-wholesale-club-sr-application-security-engineer","title":"Sr Application Security Engineer","company":{"id":1764350,"name":"BJ's Wholesale Club","domain":"bjs.com","url":"https://alion.io/company/bjs-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Marlborough, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":100000,"max":131500,"currency":"USD","period":"year","gross":null,"usd_annual":131500},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"ISO 27001","optional":false},{"name":"JavaScript","optional":false},{"name":"Jira","optional":false},{"name":"Kubernetes","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"ChatGPT","optional":true},{"name":"CloudFormation","optional":true},{"name":"LLM","optional":true},{"name":"SLSA","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-10-26T00:00:00Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-11-13T16:33:31Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"A World-Class Team\nBJ’s Wholesale Club is powered by more than 30,000 team members who make a real impact every day. Whether you're stocking shelves, solving problems or shaping strategy, your work helps families save on what matters most.\nWe’re a team built on purpose and opportunity. Join us and be part of something meaningful.\nWhy You’ll Love Working at BJ’s\nAt BJ’s Wholesale Club, our team members are at the heart of everything we do. That’s why we offer a comprehensive benefits package designed to support your health, well-being and future - both on and off the job. When you grow, we grow.\nHere’s just some of what you can look forward to:\nWeekly Pay: Get paid every week so that you can manage your money on your terms.\n Daily Pay: Access your earned pay before payday, giving you more flexibility when you need it. (fee may apply.)\nFree BJ’s Memberships: Enjoy a complimentary The Club Card Membership, plus a free Supplemental Membership for someone in your household.*\nGenerous Paid Time Off: Take the time you need with vacation, personal, sick days, holidays, bereavement, and jury duty leave.*\n Flexible and Affordable Health Benefits: Choose from three medical plans, and access optional dental, vision, Health Savings Account (HSA), and flexible spending account options to fit your lifestyle.*\n 401(k) Retirement Savings Plan: Build your financial future with a company match (available to team members 18 and older).*\nEmployee Stock Purchase Plan: Accumulate funds through after-tax payroll deductions that can be used to purchase shares of BJ’s common stock at a 15% discount.*\n*Eligibility requirements vary by position.\nJob Summary:\nBJ’s is seeking a Senior Application Security Engineer to secure the software behind our digital, e-commerce, and club-facing experiences. This is a hands-on engineering role responsible for threat modeling, operating the application security testing tool chain, and partnering with development, platform, and product teams to build and ship secure software.\nThis is an individual contributor role on the Application Security team, with no direct reports. The engineer in this role is expected to work independently, apply sound technical judgment, and contribute to maturing our Secure SDLC practices against OWASP SAMM, BSIMM, and NIST SSDF. It is well-suited for an engineer with a software development or security engineering background who wants to deepen their application security specialization, prefers technical depth over management, and can build credibility with developers in a PCI-regulated retail environment.\nJob Responsibiliies:\nPerform threat modeling and security reviews of new and existing applications, APIs, microservices, and third-party integrations across customer-facing and internal platforms.\nOperate and tune the application security testing toolchain - SAST, DAST, SCA and dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning - including onboarding applications, expanding coverage, and reducing false positive rates.\nWork directly with development teams to remediate security defects and provide recommendations on secure coding practices and fixes.\nImplement and maintain security controls within CI/CD pipelines, including policy-as-code and automated testing capabilities to support secure software delivery.\nExecute Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, contributing to maturity assessments and closing assigned gaps.\nWork alongside embedded and co-sourced team members to support application security activities and promote consistent security practices.\nSupport API security across discovery and inventory, schema and specification validation, and identification of shadow and zombie APIs.\nSupport the development and maintenance of secure coding guidance and reusable security resources for development teams.\nProvide guidance on secure coding practices and participate in developer security awareness and security champions initiatives.\nSupport PCI DSS 4.0.1 application requirements, including secure development practices, change control, client-side script integrity and monitoring for payment pages, and evidence collection for audits.\nSupport penetration testing and responsible disclosure activity - scoping input, findings validation, retesting, and root cause analysis to prevent recurrence.\nAutomate security testing tasks and evidence collection through integrations across security tooling, source control, and Jira to eliminate manual effort.\nPerform software supply chain security reviews, including open-source governance, SBOM generation and review, and evaluation of third-party and SaaS applications.\nSupport incident response for application-layer events, including exploit reproduction, root cause analysis, and recommended control improvements.\nWrite and maintain application security documentation, runbooks, and standard operating procedures.\nProduce metrics and reporting that provide visibility into scanning coverage, Secure SDLC adoption, and the security posture of the application portfolio.\nRequired Qualifications:\nBachelor’s degree in Computer Science, Information Security, or equivalent practical experience.\n4-6 years of hands-on security or software engineering experience, with at least 2 years focused specifically on application or product security.\nWorking knowledge of at least one modern programming language - Java, C#/.NET, JavaScript/TypeScript, Python, or Go - with the ability to read application code and recognize vulnerable patterns.\nWorking knowledge of the OWASP Top 10, OWASP API Security Top 10, and OWASP ASVS, with the ability to explain both exploitability and the correct fix to developers.\nHands-on experience operating enterprise SAST, DAST, and SCA tooling, including onboarding applications and tuning rulesets.\nExperience participating in threat modeling using STRIDE or a comparable methodology and translating findings into actionable security requirements.\nExperience integrating security testing into CI/CD pipelines.\nExperience securing cloud-native applications in AWS, Azure, and/or GCP, including containerized workloads (Docker required, Kubernetes preferred).\nHands-on experience with scripting and automation (Python, Bash, PowerShell).\nFamiliarity with security frameworks and compliance requirements such as PCI DSS, NIST SSDF, OWASP SAMM, BSIMM, CIS, or ISO 27001 as they apply to software development.\nAbility to work independently, manage competing priorities, and make sound technical decisions with limited day-to-day oversight.\nStrong communication skills and the ability to work effectively with engineering teams.\nNice to Have\nExperience in retail, e-commerce, or other high-volume PCI in-scope environments.\nExperience with API security platforms and discovery tooling.\nExperience working within an embedded, co-sourced, or managed application security delivery model alongside external partners.\nExperience contributing to a security champions program.\nExperience supporting bug bounty or responsible disclosure programs.\nOffensive security or exploit development background, including CTF or hands-on web application exploitation experience.\nFamiliarity with infrastructure-as-code such as Terraform or CloudFormation.\nFamiliarity with software supply chain security practices such as SBOM, SLSA, and artifact signing.\nFamiliarity with securing AI-assisted development workflows and LLM-integrated applications, including the OWASP Top 10 for LLM Applications.\nPreferred Certifications\nCompTIA Security+\nGIAC GWAPT, GWEB, or (ISC)² CSSLP\nAWS or Azure Security certifications\nOSCP or OSWE\nCCSP\nThis is a hybrid role. Tuesday through Thursday are in-office days at BJ's Club Support Center in Marlborough, MA and Monday and Friday are remote days.\nIn accordance with the Pay Transparency requirements, the following represents a good faith estimate of the compensation range for this position. At BJ’s Wholesale Club, we carefully consider a wide range of non-discriminatory factors when determining salary. Actual salaries will vary depending on factors including but not limited to location, education, experience, and qualifications. The pay range for this position is $100,000.00 - $131,500.00We recognize the growing role of AI tools, including ChatGPT, and value familiarity with them. That said, we want to hear from your authentic self. Your application should reflect your own skills, experiences, and insights rather than AI-generated responses.","description_format":"text","description_chars":8520,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Retail & Shop Systems","Wholesale"],"lifecycle":[{"event":"open","at":"2026-11-13T16:33:31Z"}],"visa":[],"liveness":{"score":75,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.83,"p_room":0.9,"age_days":18,"expected_fill_days":30,"reasons":["conf:1","win:mid","comp:brand"],"computed_at":"2026-11-13T18:33:07Z"},"pay":{"stated_usd_annual":131500,"is_top_pay":false},"html_url":"https://alion.io/job/bjs-wholesale-club-sr-application-security-engineer","json_url":"https://alion.io/job/bjs-wholesale-club-sr-application-security-engineer.json","meta":{"generated_at":"2026-11-13T18:33:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":37091,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1764350},"rest":"https://alion.io/mcp/rest/get_company?id=1764350"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbjs-wholesale-club-sr-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbjs-wholesale-club-sr-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbjs-wholesale-club-sr-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/bjs-wholesale-club-sr-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbjs-wholesale-club-sr-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4265413}},{"tool":"search_jobs","arguments":{"company":"bjs.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4265413},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}