Senior Application Security Engineer - Containers

ADP • Alpharetta, GA

5d • Hybrid

About The Position

ADP’s Global Security Organization (GSO) protects ADP and its clients’ employee data, focusing on integrity, confidentiality, and compliance throughout the information lifecycle. The Enterprise Application Security (EAS) team protects internally developed products from existing and emerging threats by integrating and automating security controls early in the product development lifecycle and helping development teams identify and address security risks.

The Senior Application Security Engineer will design, implement, and manage container security scanning services. The role partners with stakeholders to assess security risks and establish governance for the secure use of container images before production release. It drives container security operations and supply-chain risk initiatives across business units, builds security into DevOps pipelines, and supports vulnerability management, image provenance, adversarial container security, and governance, risk, and compliance. The engineer also helps develop Container Security Bill of Materials (CSBOM) and Vulnerability Exchange (VEX) solutions, promotes secure container development through training and governance, maintains awareness of threats and best practices, and customizes policies, rules, and alerts. The role includes identifying KPIs and KRIs, issuing weekly scanning and monitoring reports, maintaining standard operating procedures, and performing other duties as required.

The position is hybrid and may be based in Roseland, New Jersey, or Alpharetta, Georgia. ADP describes a culture of collaboration, learning, ownership, community service, and commitment to equality and equity.

Requirements

• Bachelor’s degree or equivalent.
• Five or more years of experience in IT or cybersecurity roles.
• Three or more years of experience specifically in software engineering roles.
• Basic knowledge and understanding of container security vulnerabilities and related risks, including OWASP.
• Understanding of container image formats such as Docker and OCI.
• Experience implementing and rolling out container-scanning solutions as part of container development.
• Familiarity with internet technologies and secure web-development practices.
• Understanding of CI/CD pipelines covering source control, integration, and deployment.
• Strong analytical and problem-solving skills and cross-functional knowledge across development and security disciplines.
• Experience training development teams on secure container practices.
• Basic understanding of test-automation tools and frameworks and the NIST Container Security Framework.
• Ability to communicate security concepts to technical and non-technical stakeholders.
• Understanding of Agile methodologies, cloud security, container security, and application security.
• Familiarity with microservices architecture and design patterns.
• Ability to use qualitative and quantitative data analysis to support data-driven decisions about system threats, vulnerabilities, and risk.
• Good communication and presentation skills.
• Ability to work effectively as part of a remote team.
• Self-motivated with a positive attitude.

Nice To Haves

• Previous software engineering or architecture experience with Java, C#, .NET, JavaScript, or Python.
• Certifications such as CEH, CISSP, CSSLP, GCIA, GPEN, or GWAPT.

Responsibilities

• Drive container security operations, including supply-chain risk initiatives across ADP business units.
• Build and support security in DevOps pipelines and institutionalize container-image security scanning in line with a shift-left strategy.
• Support management of supply-chain vulnerabilities, image provenance, adversarial container security, and governance, risk, and compliance.
• Assist in developing solutions to generate a Container Security Bill of Materials (CSBOM) and Vulnerability Exchange (VEX).
• Promote secure container development through training, governance, and metrics.
• Maintain awareness of container cybersecurity threats and best practices to enable security and hardening at scale.
• Customize policies, rules, and alerts to comply with established policies and settings.
• Provide technical subject-matter expertise and drive program excellence.
• Identify meaningful KPIs and KRIs to measure progress and improvement.
• Provide weekly scanning and monitoring reports.
• Create and maintain standard operating procedures (SOPs).
• Perform other duties as required.

Benefits

• ADP’s Philanthropic Foundation supports associates in times of need.
• A culture emphasizing collaboration, learning, ownership, and community involvement.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior