Senior Application Security Engineer - Containers

ADP•Alpharetta, GA

6d•Hybrid

About The Position

ADP’s Global Security Organization (GSO) protects company and client data, with the Enterprise Application Security (EAS) team focused on securing internally developed products by integrating and automating security controls early in the product development life cycle. The team helps development teams identify and address security risks in a timely manner. The Senior Application Security Engineer will design, implement, and manage container security scanning services. The role partners with stakeholders to assess security risks and establish a governance framework for secure container image use before images are released into production. It drives container security operations and supply-chain risk initiatives across ADP business units, supports security integration into DevOps pipelines, and promotes secure container development through training, governance, and metrics. This is a hybrid role based in Roseland, New Jersey, or Alpharetta, Georgia.

Requirements

Bachelor’s degree or equivalent.
Five or more years of experience in various IT or cybersecurity roles, including three or more years specifically in software engineering roles.
Basic knowledge and understanding of container security vulnerabilities and related risks, including OWASP.
Understanding of container image formats such as Docker and OCI.
Experience implementing and rolling out container scanning solutions as part of container development.
Familiarity with internet technologies and web development secure-coding best practices.
Understanding of CI/CD pipelines covering source control, integration, and deployment; examples include Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, SonarQube, Git, and Snyk.
Strong analytical and problem-solving skills, with cross-functional knowledge across development and security disciplines.
Experience training development teams on secure container practices.
Basic understanding of test automation tools and frameworks and the NIST Container Security Framework.
Ability to communicate security-related concepts to technical and non-technical stakeholders.
Understanding of Agile methodologies, cloud, container, and application security.
Good communication and presentation skills.
Ability to work effectively as part of a remote team.
Self-motivated with a positive attitude.
Familiarity with microservices architecture and design patterns.
Good analytic skills, including qualitative and quantitative data analysis to support data-driven decisions about system threats, vulnerabilities, and risk.

Nice To Haves

Previous software engineering or architecture experience with Java, C#, .NET, JavaScript, or Python.
CEH, CISSP, CSSLP, GCIA, GPEN, or GWAPT certification.

Responsibilities

Drive container security operations, including supply-chain risk initiatives across ADP business units.
Build and support security in DevOps pipelines and institutionalize container image scanning in line with a shift-left strategy.
Support management of supply-chain vulnerabilities, image provenance, adversarial container security, and governance, risk, and compliance.
Assist in developing solutions to generate a Container Security Bill of Materials (CSBOM) and Vulnerability Exchange (VEX).
Promote secure container development through training, governance, and metrics.
Maintain awareness of container cybersecurity threats and best practices to support securing and hardening at scale.
Customize policies, rules, and alerts to comply with established policies and settings.
Provide technical subject-matter expertise and drive program excellence.
Identify meaningful KPIs and KRIs to drive progress and improvement.
Provide weekly scanning and monitoring reports.
Create and maintain Standard Operating Procedures (SOPs).
Perform other duties as required.