Sr Application Security Engineer

A World-Class Team BJ’s Wholesale Club is powered by more than 30,000 team members who make a real impact every day. Whether you're stocking shelves, solving problems or shaping strategy, your work helps families save on what matters most. We’re a team built on purpose and opportunity. Join us and be part of something meaningful.

At BJ’s Wholesale Club, our team members are at the heart of everything we do. That’s why we offer a comprehensive benefits package designed to support your health, well-being and future – both on and off the job. When you grow, we grow. Here’s just some of what you can look forward to:

• Weekly Pay:
  Get paid every week so that you can manage your money on your terms.
• Daily Pay:
  Access your earned pay before payday, giving you more flexibility when you need it. (fee may apply.)
• Free BJ’s Memberships:
  Enjoy a complimentary The Club Card Membership, plus a free Supplemental Membership for someone in your household.
• Generous Paid Time Off:
  Take the time you need with vacation, personal, sick days, holidays, bereavement, and jury duty leave.
• Flexible and Affordable
  
  Health Benefits:
  
  Choose from three medical plans, and access optional dental, vision, Health Savings Account (HSA), and flexible spending account options to fit your lifestyle.
• 401(k) Retirement Savings Plan:
  Build your financial future with a company match (available to team members 18 and older).
• Employee Stock Purchase Plan:
  Accumulate funds through after-tax payroll deductions that can be used to purchase shares of BJ’s common stock at a 15% discount.

* Eligibility requirements vary by position.

BJ’s is seeking a Senior Application Security Engineer to secure the software behind our digital, e-commerce, and club-facing experiences. This is a hands-on engineering role responsible for threat modeling, operating the application security testing tool chain, and partnering with development, platform, and product teams to build and ship secure software. This is an individual contributor role on the Application Security team, with no direct reports.

The engineer in this role is expected to work independently, apply sound technical judgment, and contribute to maturing our Secure SDLC practices against OWASP SAMM, BSIMM, and NIST SSDF. It is well-suited for an engineer with a software development or security engineering background who wants to deepen their application security specialization, prefers technical depth over management, and can build credibility with developers in a PCI-regulated retail environment.

Perform threat modeling and security reviews of new and existing applications, APIs, microservices, and third-party integrations across customer-facing and internal platforms. Operate and tune the application security testing toolchain — SAST, DAST, SCA and dependency analysis, secrets detection, infrastructure-as-code scanning, and container image scanning — including onboarding applications, expanding coverage, and reducing false positive rates. Work directly with development teams to remediate security defects and provide recommendations on secure coding practices and fixes.

Implement and maintain security controls within CI/CD pipelines, including policy-as-code and automated testing capabilities to support secure software delivery. Execute Secure SDLC improvements aligned to OWASP SAMM, BSIMM, and NIST SSDF, contributing to maturity assessments and closing assigned gaps. Work alongside embedded and co-sourced team members to support application security activities and promote consistent security practices. Support API security across discovery and inventory, schema and specification validation, and identification of shadow and zombie APIs.

Sup…