Cybersecurity Engineer II

At McCormick, we bring our passion for flavor to work each day. We encourage growth, respect everyone's contributions and do what's right for our business, our people, our communities and our planet. Join us on our quest to make every meal and moment better.

Founded in Baltimore, MD in 1889 in a room and a cellar by 25-year-old Willoughby McCormick with three employees, McCormick is a global leader in flavour. With over 14,000 employees around the world and more than $6 Billion in annual sales, the Company manufactures, markets, and distributes spices, seasoning mixes, condiments and other flavourful products to the entire food industry, retail outlets, food manufactures, food service businesses and consumers.

While our global headquarters are in the Baltimore, Maryland, USA area, McCormick operates and serves customers from nearly 60 locations in 25 countries and 170 markets in Asia-Pacific, China, Europe, Middle East and Africa, and the Americas, including North, South and Central America

Cybersecurity Engineer –Technology and Engineering 

McCormick & Company, Inc., a world leader in the spice, flavor and seasonings industry, is seeking a full time Cybersecurity Engineer– Technology and Engineering. This position will report to the Sr. Manager Cybersecurity - Technology and Engineering. 

Position Overview: 

The Security Engineer role supports the implementation and day-to-day advancement of a risk-based Secure Software Development Lifecycle (SSDLC) across McCormick’s application landscape. The engineer helps establish application ownership, inventory, and risk tiering; translates the control baseline into practical security requirements; and works with delivery teams to apply controls that fit each application and delivery model. 

This role partners with application owners, developers, architects, platform teams, cybersecurity colleagues, and business stakeholders to embed secure design, threat modeling, code and dependency scanning, repository governance, CI/CD security, API security, and remediation practices. The engineer also supports fit-for-purpose guardrails for Power Platform solutions, SaaS/vendor-managed applications, and SAP/ERP-connected applications, while maintaining evidence, exceptions, and metrics that demonstrate adoption and risk reduction. 

Why this role: Application security is essential to protecting business, customer, and partner data and sustaining trust. This role helps move security earlier in delivery, reduce late-stage rework, improve software supply-chain visibility, and make secure delivery easier, repeatable, and auditable—without creating unnecessary friction. The engineer will have direct impact by focusing first on the applications and changes that present the highest business risk. 

Key Responsibilities: 

Description 

• Maintain a risk-based view of the application portfolio, including application ownership, criticality, external exposure, sensitive-data use, and key integrations. Help prioritize application security activities toward the highest-risk applications, major technology changes, and business-critical services. 
• Partner with application, architecture, and project teams to define practical security requirements and perform security design reviews for new applications and significant changes. Facilitate threat modeling for high-risk applications and externally exposed services, escalating specialized concerns to appropriate cybersecurity or technical teams. 
• Provide practical secure coding guidance, reusable standards, and developer-facing support to help teams address common application vulnerabilities. Promote security awareness and incorporate secure development practices into normal engineering workflows without creating unnecessary delivery friction. 
• Support the rollout, integration, and effective use of application security tooling, including SAST, SCA, secrets scanning, and targeted dynamic or API testing where appropriate. Work with delivery teams to tune results, reduce false positives, and focus remediation on exploitable or high-risk findings. 
• Partner with engineering and platform teams to introduce proportionate security checks into existing source-control and CI/CD workflows. Support foundational repository controls, dependency visibility, secrets management, and secure build practices, while applying more advanced controls such as artifact signing, container scanning, or infrastructure-as-code checks only where the technology and risk justify them. 
• Coordinate application-security findings through triage, ownership, prioritization, remediation tracking, and validation. Maintain clear risk-acceptance and exception records, including compensating controls and expiry dates. Support security assurance for vendor-managed, Power Platform, SAP/ERP-connected, and API-based solutions by coordinating with the relevant platform, vendor-risk, data, and architecture teams. 
• Track coverage, remediation progress, exception aging, and adoption of key controls. Work closely with development, architecture, platform, vendor, data, and cybersecurity teams to improve standards, documentation, automation, and application-security maturity over time. 
• Participate in tool evaluations, new security projects, and ongoing improvements to our tech stack. 
• Share insights and updates with management—on tool performance, incidents, risks, and opportunities for improvement. 

Preferred Qualifications: 

• Bachelor’s degree in computer science, software engineering, information security, information technology, or a related discipline; equivalent practical experience will be considered. 
• One or more relevant industry certifications such as GIAC, CCSK, OCSP, CISSP, AWS/GCP/Azure Cloud certifications, CEH, ITIL, CCNS, CISC, CPFA, RHCE, Microsoft Certification, Security+, or other related security credentials. 
• Minimum of 8+ years of total experience.
• 3–5 years of relevant experience in application security, product security, software engineering with security responsibilities, or a closely related field. 
• Practical understanding of risk-based SSDLC activities, including security requirements, secure design review, threat modeling, secure coding, security testing, release criteria, and vulnerability remediation. Understanding of common web, API, identity/access, data-flow, dependency, and software supply-chain risks. Ability to review designs and integrations and communicate practical security requirements. 
• Hands-on experience supporting or using SAST, SCA, secrets scanning, and other risk-appropriate application or API testing methods; able to help teams interpret findings and prioritize remediation. 
• Working knowledge of version-control and CI/CD concepts, including repository ownership, branch protections, code-owner controls, dependency visibility, release checks, and documented exceptions. Experience with GitHub governance is preferred. 
• Proven ability to work with technical evidence, metrics, and structured data. Scripting or automation experience that improves repeatability and reporting is an advantage. 
• Relevant application-security, software-security, cloud, or cybersecurity certifications are valued but not required. Demonstrated commitment to continued learning is important. 

Other skills and competencies: 

• Must be able to multi-task and set priorities 
• Must have experience leading and working in a collaborative, multi-disciplined, globally diverse team environment. 
• Effective communication skills and the ability to communicate appropriately at all levels of the organization; this includes written and verbal communications as well as visualizations 
• Are hands-on and take ownership of tools and processes 
• Positive approach to customer service with demonstrated ability to handle high pressure support needs in a calm, respectful, and efficient manner 
• Conflict resolution skills.  
• Attention to detail and follow through. 
• Demonstrated ability to manage both technical and business relationships and liaise on the information needs of the business to IT and system constraints back to the business. 
• Ability to maintain confidential and personal information. 
• Demonstrated leader of continuous improvement ideas and implementations 
• Ability to operate a multi-cultural and multi-lingual environment both with team members and internal customers (critical) 
• Ability to discuss technical information with non-technical individuals across multiple cultures in multiple countries. (critical) 
• English fluency (critical) 

Agencies: McCormick as needed will work with external recruitment vendors through our Agency Portal. Unless previously contacted, McCormick does not accept unsolicited resumes from external recruiting agencies.

McCormick & Company is an equal opportunity/affirmative action employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, colour, religion, national origin, disability, protected veteran status, age, or any other characteristic protected by law.

As users of the disability confident scheme, we guarantee to interview all disabled applicants who meet the minimum criteria for the vacancy/ies.