This role partners with application owners, developers, architects, platform teams, cybersecurity colleagues, and business stakeholders to embed secure design, threat modeling, code and dependency scanning, repository governance, CI/CD security, API security, and remediation practices. The engineer also supports fit-for-purpose guardrails for Power Platform solutions, SaaS/vendor-managed applications, and SAP/ERP-connected applications, while maintaining evidence, exceptions, and metrics that demonstrate adoption and risk reduction.
Why this role: Application security is essential to protecting business, customer, and partner data and sustaining trust. This role helps move security earlier in delivery, reduce late-stage rework, improve software supply-chain visibility, and make secure delivery easier, repeatable, and auditable—without creating unnecessary friction. The engineer will have direct impact by focusing first on the applications and changes that present the highest business risk.
Key Responsibilities
Description
Maintain a risk-based view of the application portfolio, including application ownership, criticality, external exposure, sensitive-data use, and key integrations. Help prioritize application security activities toward the highest-risk applications, major technology changes, and business-critical services.
Partner with application, architecture, and project teams to define practical security requirements and perform security design reviews for new applications and significant changes. Facilitate threat modeling for high-risk applications and externally exposed services, escalating specialized concerns to appropriate cybersecurity or technical teams.
Provide practical secure coding guidance, reusable standards, and developer-facing support to help teams address common application vulnerabilities. Promote security awareness and incorporate secure development practices into normal engineering workflows without creating unnecessary delivery friction.
Support the rollout, integration, and effective use of application security tooling, including SAST, SCA, secrets scanning, and targeted dynamic or API testing where appropriate. Work with delivery teams to tune results, reduce false positives, and focus remediation on exploitable or high-risk findings.
Partner with engineering and platform teams to introduce proportionate security checks into existing source-control and CI/CD workflows. Support foundational repository controls, dependency visibility, secrets management, and secure build practices, while applying more advanced controls such as artifact signing, container scanning, or infrastructure-as-code checks only where the technology and risk justify them.
Coordinate application-security findings through triage, ownership, prioritization, remediation tracking, and validation. Maintain clear risk-acceptance and exception records, including compensating controls and expiry dates. Support security assurance for vendor-managed, Power Platform, SAP/ERP-connected, and API-based solutions by coordinating with the relevant platform, vendor-risk, data, and architecture teams.
Track coverage, remediation progress, exception aging, and adoption of key controls. Work closely with development, architecture, platform, vendor, data, and cybersecurity teams to improve standards, documentation, automation, and application-security maturity over time.
Participate in tool evaluations, new security projects, and ongoing improvements to our tech stack.
Share insights and updates with management—on tool performance, incidents, risks, and opportunities for improvement.
Preferred Qualifications
Bachelor’s degree in computer science, software engineering, information security, information technology, or a related discipline; equivalent practical experience will be considered.
One or more relevant industry certifications such as GIAC, CCSK, OCSP, CISSP, AWS/GCP/Azure Cloud certifications, CEH, ITIL, CCNS, CISC, CPFA, RHCE, Microsoft Certification, Security+, or other related security credentials.
Minimum of 8+ years of total experience.
3–5 years of relevant experience in application security, product security, software engineering with security responsibilities, or a closely related field.
Practical understanding of risk-based SSDLC activities, including security requirements, secure design review, threat modeling, secure coding, security testing, release criteria, and vulnerability remediation. Understanding of common web, API, identity/access, data-flow, dependency, and software supply-chain risks. Ability to review designs and integrations and communicate practical security requirements.
Hands-on experience supporting or using SAST, SCA, secrets scanning, and other risk-appropriate application or API testing methods; able to help teams interpret findings and prioritize remediation.
Working knowledge of version-control and CI/CD concepts, including repository ownership, branch protections, code-owner controls, dependency visibility, release checks, and documented exceptions. Experience with GitHub governance is preferred.
Proven ability to work with technical evidence, metrics, and structured data. Scripting or automation experience that improves repeatability and reporting is an advantage.
Relevant application-security, software-security, cloud, or cybersecurity certifications are valued but not required. Demonstrated commitment to continued learning is important.
Other skills and competencies
Must be able to multi-task and set priorities
Must have experience leading and working in a collaborative, multi-disciplined, globally diverse team environment.
Effective communication skills and the ability to communicate appropriately at all levels of the organization; this includes written and verbal communications as well as visualizations
Are hands-on and take ownership of tools and processes
Positive approach to customer service with demonstrated ability to handle high pressure support needs in a calm, respectful, and efficient manner
Conflict resolution skills.
Attention to detail and follow through.
Demonstrated ability to manage both technical and business relationships and liaise on the information needs of the business to IT and system constraints back to the business.
Ability to maintain confidential and personal information.
Demonstrated leader of continuous improvement ideas and implementations
Ability to operate a multi-cultural and multi-lingual environment both with team members and internal customers (critical)
Ability to discuss technical information with non-technical individuals across multiple cultures in multiple countries. (critical)
English fluency (critical)
Agencies: McCormick as needed will work with external recruitment vendors through our Agency Portal. Unless previously contacted, McCormick does not accept unsolicited resumes from external recruiting agencies.
McCormick & Company is an equal opportunity/affirmative action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, colour, religion, national origin, disability, protected veteran status, age, or any other characteristic protected by law.
As users of the disability confident scheme, we guarantee to interview all disabled applicants who meet the minimum criteria for the vacancy/ies.
WHY WORK AT MCCORMICK?
As a McCormick employee you’ll be empowered to focus on more than your individual responsibilities. You’ll have the opportunity to be part of something bigger than yourself—to have a say in where the company is going and how it’s growing.
Between our passion for flavor, our 130-year history of leadership and integrity, the competitive and comprehensive benefits we offer, and our culture, which is built on respect and opportunities for growth, there are many reasons to join us at McCormick.
Apply now »
Find similar jobs
- View All Jobs,
- Information Technology Jobs
McCormick Corporate
Join Our Talent Community
Privacy
Legal
Cookie Policy
Opens in a new tab.
Opens in a new tab.
Opens in a new tab.
