Bachelor's degree or equivalent experience required.
5+ years in IT or cybersecurity roles, with 3+ years in software engineering.
Basic understanding of container security and related risks.
Familiarity with web development best practices.
Strong analytical and problem-solving skills across development and security disciplines.
Ability to communicate security concepts to technical and non-technical stakeholders.
Familiarity with Agile methodologies and container/cloud security.
Responsibilities
Drive container security operations and supply chain risk initiatives.
Integrate security into DevOps pipelines and institutionalize container image scanning.
Manage supply chain vulnerabilities and establish governance frameworks.
Develop solutions for Container Security Bill of Materials (CSBom) and Vulnerability Exchange (VEX).
Promote secure container development through training and governance.
Maintain awareness of container cybersecurity threats and best practices.
Customize policies and alerts to comply with established settings.
Benefits
Hybrid work model with options in Roseland, NJ or Alpharetta, GA.
Opportunity to work with cutting-edge container security technologies.
Engagement in a culture that prioritizes security in product development.
Access to training and professional development resources.
Collaboration with cross-functional teams across various business units.
Full Job Description
ADP is hiring a Senior Application Security Engineer - Containers
This Hybrid role can sit in Roseland, NJ or Alpharetta, GA
The mission of the GSO Enterprise Application Security [EAS] team is to protect ADP's internally developed products from existing and emerging security threats. We improve internal product security posture by integrating and automating security controls early in the product development life cycle and aid in uncovering security risks. This work empowers and supports development teams to recognize and address security risks in a timely manner.
The EAS team has an opening for a Senior Container Application Security Engineer to design, implement, and manage container security scanning services. This role involves partnering with key stakeholders to assess security risks and establish a governance framework for the secure use of container images before their release into production.
What You'll Do:
Drive container security operations including supply chain risk initiatives across ADP's different business units.
Build and Support security into the DevOps pipelines & help institutionalize the security scanning of container images in line with shift left strategy.
Provide support for managing supply chain vulnerabilities, image provenance, adversarial container security, and governance risk, and compliance (GRC)
Assist in developing solutions to generate a Container Security Bill of Materials (CSBom) and Vulnerability Exchange (VEX)
Promote a culture around secure container development through training, governance, and metrics.
Maintain awareness of container cybersecurity threats and best practices to enable securing and hardening at scale.
Customize policies, rules, and alerts to comply with established policies and settings.
Bring technical SME knowledge into the program and drive excellence.
Metrics/Reporting
Identify meaningful KPIs/KRI's to drive progress and improvement
Provide weekly Scanning and Monitoring reports.
Create and maintain Standard Operating Procedures (SOP)
Perform other duties as required.
Experience You'll Need:
Basic knowledge and understanding of container security vulnerabilities (OWASP).
Understanding of container image formats such as Docker, OCI, etc.
Experience in implementing and rolling out container scanning solutions as part of container development.
Familiarity with internet technologies and web development secure coding best practices.
Strong analytical/problem-solving skills and basic cross-functional knowledge across multiple development and security disciplines.
Experience in training development teams on secure container practices.
Basic understanding of Test Automation tools and framework - NIST Container Security Framework.
Ability to communicate security-related concepts to technical and non-technical staff.
Understanding of Agile methodologies, Cloud, Container and Application Security.
Good problem-solving skills, communication and presentation skills.
Ability to work effectively as part of a remote team.
Self-motivated with a positive attitude.
To Succeed in This Role:
You'll have a bachelor's degree or equivalent.
Qualifications:
Five years or more experience in various IT or cybersecurity roles, with three or more years of experience specifically in software engineering roles.
Basic knowledge and understanding of container security and related risks.
Familiarity with internet technologies and web development best practices.
Strong analytical/problem-solving skills and basic cross-functional knowledge across multiple development and security disciplines.
Ability to communicate security-related concepts to a broad range of technical and non-technical stakeholders.
Understanding of Agile methodologies and container & cloud security.
Familiarity with microservices architecture and design patterns.
Good analytic skills, including qualitative and quantitative data analysis to support and defend data-driven decision-making regarding system threats, vulnerabilities, and risk.
Any of the following are a plus but not necessary: CEH, CISSP, CSSLP, GCIA, GPEN, GWAPT
