Sr. Cybersecurity Engineer

Cybersecurity Engineer Technology and Engineering

McCormick & Company, Inc., a world leader in the spice, flavor and seasonings industry, is seeking a full time Cybersecurity Engineer Technology and Engineering. This position will report to the Sr. Manager Cybersecurity - Technology and Engineering.

Position Overview:

The Security Engineer role supports the implementation and day-to-day advancement of a risk-based Secure Software Development Lifecycle (SSDLC) across McCormicks application landscape. The engineer helps establish application ownership, inventory, and risk tiering; translates the control baseline into practical security requirements; and works with delivery teams to apply controls that fit each application and delivery model.

This role partners with application owners, developers, architects, platform teams, cybersecurity colleagues, and business stakeholders to embed secure design, threat modeling, code and dependency scanning, repository governance, CI/CD security, API security, and remediation practices. The engineer also supports fit-for-purpose guardrails for Power Platform solutions, SaaS/vendor-managed applications, and SAP/ERP-connected applications, while maintaining evidence, exceptions, and metrics that demonstrate adoption and risk reduction.

Why this role: Application security is essential to protecting business, customer, and partner data and sustaining trust. This role helps move security earlier in delivery, reduce late-stage rework, improve software supply-chain visibility, and make secure delivery easier, repeatable, and auditablewithout creating unnecessary friction. The engineer will have direct impact by focusing first on the applications and changes that present the highest business risk.

Key Responsibilities:

Description

• Maintain a risk-based view of the application portfolio, including application ownership, criticality, external exposure, sensitive-data use, and key integrations. Help prioritize application security activities toward the highest-risk applications, major technology changes, and business-critical services.
• Partner with application, architecture, and project teams to define practical security requirements and perform security design reviews for new applications and significant changes. Facilitate threat modeling for high-risk applications and externally exposed services, escalating specialized concerns to appropriate cybersecurity or technical teams.
• Provide practical secure coding guidance, reusable standards, and developer-facing support to help teams address common application vulnerabilities. Promote security awareness and incorporate secure development practices into normal engineering workflows without creating unnecessary delivery friction.
• Support the rollout, integration, and effective use of application security tooling, including SAST, SCA, secrets scanning, and targeted dynamic or API testing where appropriate. Work with delivery teams to tune results, reduce false positives, and focus remediation on exploitable or high-risk findings.
• Partner with engineering and platform teams to introduce proportionate security checks into existing source-control and CI/CD workflows. Support foundational repository controls, dependency visibility, secrets management, and secure build practices, while applying more advanced controls such as artifact signing, container scanning, or infrastructure-as-code checks only where the technology and risk justify them.
• Coordinate application-security findings through triage, ownership, prioritization, remediation tracking, and validation. Maintain clear risk-acceptance and exception records, including compensating controls and expiry dates. Support security assurance for vendor-managed, Power Platform, SAP/ERP-connected, and API-based solutions by coordinating with the relevant platform, vendor-risk, data, and architecture teams.
• Track coverage, remediation progress, exception aging, and adoption of key controls. Work closely with development, architecture, platform, vendor, data, and cybersecurity teams to improve standards, documentation, automation, and application-security maturity over time.
• Participate in tool evaluations, new security projects, and ongoing improvements to our tech stack.
• Share insights and updates with managementon tool performance, incidents, risks, and opportunities for improvement.

Key Skills:

• Application Security and risk-based SSDLC
• Secure coding guidance, OWASP web and API risks
• SAST, SCA and secrets scanning
• CI/CD and source-control security, including GitHub governance
• Dependency and software supply-chain security
• API security and authentication/authorization concepts
• Remediation tracking, risk exceptions, and compensating controls
• Security metrics, evidence collection, and reporting
• Strong stakeholder communication across developers, architects, vendors, and business teams
• Scripting or automation for reporting and repeatable security processes