director, cybersecurity - strategy, portfolio, and awareness

Now Brewing - director cybersecurity - Strategy, Portfolio, and Awareness! #tobeapartner

From the beginning, Starbucks set out to be a different kind of company. One that not only celebrated coffee and the rich tradition, but that also brought a feeling of connection. We are known for developing extraordinary leaders who share this passion and are guided by their service to others.

At Starbucks, our mission is to inspire and nurture the human spirit – one person, one cup, and one neighborhood at a time. Starbucks Technologists work to achieve this mission using secure, resilient, and innovative technology delivered to our partners, customers, stores, roasters, and global communities.

This position contributes to Starbucks’ success by leading the Global Cybersecurity Services portfolio, strategy, and cybersecurity training and awareness functions in support of the Chief Information Security Officer (CISO). The director translates CISO direction and enterprise risk priorities into an integrated strategy, funded roadmap, and measurable program outcomes; leads portfolio prioritization and delivery governance; and owns training and awareness that strengthens secure behaviors across the business. The role brings clear decisions, investment trade-offs, and evidence-based reporting to the CISO and executive leaders, partnering with cybersecurity domain owners who remain accountable for technical delivery and control effectiveness.

As director, cybersecurity - strategy, portfolio, and awareness you will...

Leadership \- Setting goals for the work group, developing organizational capability, and modeling how we work together:

• Establishes and maintains influential working relationships at all levels necessary to advance cybersecurity strategy and enterprise risk outcomes.
• Acts as a trusted advisor and integrator for the CISO across strategy, execution, and communications.
• Partners with senior leadership to identify priority opportunities, align them to enterprise objectives, and drive execution.
• Leads development, refresh, and communication of the cybersecurity strategy and operating plan for ciso approval, translating business priorities, threat and risk insights, and regulatory obligations into clear objectives, investment choices, and accountable roadmaps.
• Collaborates with cross-functional leaders to ensure alignment with Starbucks business strategy, technology priorities, and risk posture.

Planning and Execution \- Developing strategic and operational plans for the work group, managing execution, and measuring results:

• Owns the integrated cybersecurity portfolio and program management function, including intake, prioritization, delivery standards, and benefits realization against approved strategy and commitments.
• Establishes decision forums, operating rhythms, accountability, and escalation thresholds; resolves issues within delegated authority and brings timely recommendations to the ciso for decisions beyond it.
• Maintains an integrated view of milestones, dependencies, capacity, delivery risks, and remediation commitments; drives recovery plans with accountable program and domain owners.
• Leads multi-year roadmaps and annual planning with Finance and cybersecurity leaders, aligning investment, resource capacity, and sequencing to risk reduction and business priorities
• Defines and reports portfolio outcomes, key performance indicators, financial performance, and realized benefits, with clear data ownership and evidence supporting executive decisions.

Business Requirements \- Providing functional expertise and executing functional responsibilities:

• Translates cybersecurity strategy and risk priorities into coordinated execution across domains such as Identity, Data Protection, Threat Detection & Response, Governance Risk & Compliance, Product Security, and regional teams.
• Partners with Finance, sourcing, and cybersecurity domain leaders to develop business cases, track approved spend and forecasts, evaluate investment trade-offs, and measure value delivered; supports governance and compliance without assuming independent assurance responsibilities.
• Identifies gaps, overlaps, and execution risks across cybersecurity initiatives and drives resolution.
• Owns the planning, synthesis, and quality assurance of cybersecurity materials for executive leadership and the Audit & Compliance Committee, translating validated risk, delivery, and financial information into clear decisions, trade-offs, and actions for ciso review.
• Owns the enterprise cybersecurity training and awareness strategy, roadmap, and delivery, partnering with Partner Resources, Legal, Privacy, Communications, and business leaders to provide accessible, role-based learning for corporate and frontline partners. Confirm audience scope, delivery resources, and interfaces with existing learning teams so the accountability is achievable.
• Leads behavior-focused awareness campaigns and learning interventions informed by relevant threats, incidents, and business workflows; coordinates appropriate delivery across regions and languages and, where in scope, licensed operations.
• Measures training reach, completion, learning effectiveness, reporting behaviors, and human-risk trends; uses findings to improve outcomes rather than relying on completion rates alone.

Partner Development & Team Building \- Providing partners with coaching, feedback, and developmental opportunities and building effective teams:

• Challenges and inspires partners across Global Cybersecurity Services to achieve enterprise outcomes.
• Builds and leads the portfolio/program management, strategy, and training and awareness team, setting clear accountabilities, priorities, and development expectations.
• Develops team capability through coaching, feedback, succession planning, and meaningful career opportunities; aligns employee and external delivery capacity to approved priorities
• Supports development of leadership capability, succession planning, and organizational effectiveness.
• Promotes a culture of accountability, collaboration, and continuous improvement.

We would love to hear from people with...

Basic Qualifications

• Bachelor's degree in Information Security, Computer Science, or a related field and/or 10+ years of experience in a cybersecurity role, with a focus on areas such as security operations, incident response, or risk management.
• CISSP, CISA, CIPP, CISM, GSEC and other technical certifications are desired, at least one is required.
• Leverages expertise in multidisciplinary business principles and practices to steer cross-functional projects and initiatives towards strategic success.
• Navigates challenging conversations leading to constructive, impactful outcomes, setting precedents for conflict resolution at a high level.
• Demonstrates exceptional written and verbal communication competence, effectively translating intricate, technical subjects into understandable, business-centric communications.
• Orchestrates collaboration across a variety of departments and spearheads complex internal and external project teams, providing vision and unifying diverse perspectives.
• Communicates and advocates for strategic and tactical roadmaps and objectives to all tiers of leadership, employing a high-level perspective to guide and influence decisions.
• Harnesses a robust technical foundation and a holistic understanding of multiple facets of information security technologies and principles, providing authoritative guidance and setting the tone for information security strategies.

Preferred Qualifications:

• Demonstrated success leading a complex cybersecurity or technology portfolio, including prioritization, dependencies, resource planning, and measurable outcomes.
• Experience translating business strategy and cyber risk into multi-year roadmaps, investment cases, and actionable operating plans.
• Ability to turn complex risk, delivery, and financial information into concise, evidence-based recommendations for executives.
• A successful history of building, leading, and developing multidisciplinary teams through delivery and organizational change.
• Ability to align business, technology, Finance, and risk stakeholders and resolve competing priorities through influence and sound judgment.
• Experience leading cybersecurity training, awareness, or behavior-change programs and evaluating their effectiveness.
• Strong written and verbal communication, facilitation, and change leadership skills across executive, technical, and frontline audiences

As a Starbucks partner, you (and your family) will have access to medical, dental, vision, basic and supplemental life insurance, and other voluntary insurance benefits. Partners have access to short-term and long-term disability, paid parental leave, family expansion reimbursement, paid vacation from date of hire*, sick time (accrued at 1 hour for every 25 hours worked), eight paid holidays, and two personal days per year. Starbucks also offers eligible partners participation in a 401(k) retirement plan with employer match, a discounted company stock program (S.I.P.), Starbucks equity program (Bean Stock), incentivized emergency savings, and financial well-being tools. Additionally, Starbucks offers 100% upfront tuition coverage for a first-time bachelor’s degree through Arizona State University’s online program via the Starbucks College Achievement Plan, student loan management resources, and access to other educational opportunities. You will also have access to backup care and DACA reimbursement. Starbucks will comply with any applicable state and local laws regarding employee leave benefits, including, but not limited to providing time off pursuant to the Colorado Healthy Families and Workplaces Act, and in accordance with its plans and policies. This list is subject to change depending on collective bargaining in locations where partners have a certified bargaining representative. For additional information regarding partner perks and more detailed information about benefits, go to starbucksbenefits.com.

*If you are working in CA, CO, IL, LA, ME, MA, NE, ND or RI, you will accrue vacation up to a maximum of 120 hours (190 in CA) for roles below director and 200 hours (316 in CA) for roles at director or above. For roles in other states, you will be granted vacation time starting at 120 hours annually for roles below director and 200 hours annually for roles director and above.

The actual base pay offered to the successful candidate will be based on multiple factors, including but not limited to job-related knowledge/skills, experience, geographical location, and internal equity. At Starbucks, it is not typical for an individual to be hired at the high end of the range for their role, and compensation decisions are dependent upon the facts and circumstances of each position and candidate.

We believe we do our best work when we're together, which is why we're onsite four days a week.

Join us and inspire with every cup. Apply today!

Starbucks Coffee Company is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, or protected veteran status, or any other characteristic protected by law.

Qualified applicants with criminal histories will be considered for employment in a manner consistent with all federal, state and local ordinances.

Starbucks Coffee Company is committed to offering reasonable accommodations to job applicants with disabilities. If you need assistance or an accommodation due to a disability, please contact us at [email protected] or 1(888) 611-2258.