Sr Lead Global Security Engineer

ADP • Alpharetta, GA

3h • Hybrid

About The Position

ADP is seeking a Senior Lead Global Security Engineer for its Global Security Organization. The role brings deep network engineering experience to the governance and strengthening of Security Service Edge (SSE) controls that protect associate and server access to the internet and SaaS applications. It involves technical security governance of SASE platforms such as Palo Alto Networks Prisma Access, Zscaler, and Fortinet, along with associated firewall and proxy controls.

This position is intended for experienced network security engineers and architects looking to expand their impact beyond direct platform administration and into technical security governance. The engineer will remain involved in traffic analysis, troubleshooting, policy assessment, and remediation validation while influencing enterprise security decisions. In partnership with infrastructure owners and network and cloud engineering teams, the role defines security requirements and drives corrective action through established change processes.

The role protects company and client data from exploitation or misuse, modernizes internet policies, identifies weak controls, and engineers mitigations to reduce operational risks involving data in motion and at rest. It also provides senior technical direction, supports cross-functional investigations, and helps ensure global network security initiatives meet audit, privacy, legal, and data protection requirements.

Requirements

• Bachelor's degree or equivalent.
• 10+ years of progressive experience in network security engineering, security architecture, or related infrastructure security roles, including substantial hands-on enterprise troubleshooting and policy administration.
• Deep practical expertise with Palo Alto Networks, Zscaler, Netskope, Broadcom/Symantec, Fortinet, or comparable firewall, proxy, or SSE platforms, with the ability to apply that experience to Prisma Access.
• Strong grounding in TCP/IP, routing, NAT, DNS, HTTP/HTTPS, TLS inspection, certificates, VPNs, endpoint connectivity, proxy architectures, and internet egress.
• Experience with GlobalProtect or comparable clients, explicit and transparent proxies, PAC files, and user-to-workload traffic flows.
• Experience managing global policy exceptions, URL categories, application controls, rule reviews, and least-privilege access; ability to distinguish policy intent from observed enforcement.
• Working knowledge of DLP, CASB/SaaS discovery, IDS/IPS, malware prevention and sandboxing such as WildFire, protective DNS, threat intelligence, WAF, and DDoS controls, including how these layers interact.
• Strong understanding of data security, encryption, privacy-by-design, and secure logging and monitoring practices.
• Strong knowledge of security frameworks and standards such as OWASP ASVS, SAMM, NIST 800-53, NIST CSF, ISO 27001, and CIS Controls.
• Demonstrated ability to influence cross-functional teams, coordinate urgent technical investigations, and balance tactical response with strategic improvement.
• Ability to turn incomplete or conflicting evidence into a clear technical hypothesis, defensible recommendation, and verified remediation outcome.
• Excellent interpersonal and communication skills, emotional intelligence, disciplined follow-through, and close attention to technical and procedural detail.

Nice To Haves

• Prisma Access or comparable SASE experience.
• SaaS discovery and AI governance experience.
• API or scripting automation experience.
• SIEM and ServiceNow experience.
• Relevant security or networking certification.
• Experience operating and managing Palo Alto Networks SASE solutions and next-generation firewalls (NGFWs), including core product features.
• Relevant security certifications such as CISSP, CISM, CCSP, CSSLP, CEH, SANS/GIAC certifications, or network security certifications such as Palo Alto Networks Certified Network Security Administrator (PCNSA).

Responsibilities

• Assess Secure Web Gateway (SWG), next-generation firewall, URL filtering, SaaS inline, and related SSE controls against ADP policies and standards; identify configuration, coverage, and enforcement gaps.
• Govern access exceptions, allow/block lists, inspection exclusions, and rule lifecycle reviews, confirming business justification, least privilege, accountable ownership, expiration, and approval evidence.
• Evaluate new platform capabilities and vendor limitations; define acceptance criteria and validate that deployed controls achieve intended security outcomes.
• Lead assessments of enterprise internet egress, including firewalls used as forward proxies, explicit proxies, PAC configurations, and alternate routes serving associates and server workloads.
• Correlate traffic logs, policy configurations, identity, and application dependencies to identify access paths with inconsistent enforcement or bypasses of required SSE controls.
• Partner with Global Network Solutions (GNS) to rationalize legacy egress, close unauthorized access paths, and align approved exceptions with enterprise standards while preserving required business connectivity.
• Investigate complex access issues, suspected vulnerabilities, and control failures using packet captures, session and threat logs, policy matching, DNS analysis, and TLS inspection evidence.
• Lead technical triage with GNS, Digital Workspace Experience (DWE), security partners, application owners, and vendors; define containment and corrective actions, assign owners, and validate resolution.
• Use SaaS discovery, application risk signals, and DLP insights to identify unsanctioned applications, risky AI usage, and potential data exposure; coordinate investigations with accountable teams.
• Improve native SaaS discovery, categorization, and inline controls, and connect findings to application intake, governance decisions, exception processes, and enforceable access requirements.
• Partner with SaaS Governance, AppSec, Privacy, and Legal to implement approved access decisions and location-specific requirements.
• Provide senior technical direction, mentor engineers and analysts, and improve the quality and consistency of team investigations without relying on direct reporting authority.
• Convene working sessions and escalation calls, resolve competing priorities, and communicate immediate actions alongside longer-term corrective plans.
• Maintain technical documentation, audit evidence, and metrics covering enforcement coverage, exception aging, alternate egress findings, and remediation progress; explain business impact to leadership.
• Drive discovery and prioritization of data-control remediation to meet audit, compliance, and ADP network data protection requirements, policies, and standards.
• Ensure global data security network initiatives adhere to changing privacy and legal compliance requirements.
• Assess endpoint and data security control effectiveness and drive improved control effectiveness, consistency, and maturity across the organization.
• Protect company and client data by influencing and partnering with network and cloud engineering teams to develop, deploy, and maintain security controls and services for ADP's network infrastructure and traffic.

Benefits

• ADP's Philanthropic Foundation supports associates in times of need.
• The company describes a commitment to equality and equity and encourages giving back to the community.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior