Senior Application Security Engineer - Containers

This Hybrid role can sit in Roseland, NJ or Alpharetta, GA

Unlock Your Career Potential:
Global Security Organization at ADP.

Do you have a passion for going on the offensive to safeguard critical information?

As ADP’s Global Security Organization (GSO), we know that our clients rely on us for human capital management solutions, but beyond that, they entrust us with one of their most valuable assets — their employee data. We are honored by this trust and are laser focused on securing data at every step in the information lifecycle, ensuring integrity, confidentiality and compliance with industry and government regulations at all times.

From the cloud to the data center and across every emerging device, you’ll join a team of experts in the GSO who are always staying one step ahead in this ever-changing world of data by continually evolving our strategies and technologies to protect ADP and our clients.

The mission of the GSO Enterprise Application Security [EAS] team is to protect ADP's internally developed products from existing and emerging security threats. We improve internal product security posture by integrating and automating security controls early in the product development life cycle and aid in uncovering security risks. This work empowers and supports development teams to recognize and address security risks in a timely manner.

The EAS team has an opening for a Senior Container Application Security Engineer to design, implement, and manage container security scanning services. This role involves partnering with key stakeholders to assess security risks and establish a governance framework for the secure use of container images before their release into production.

Like what you see?

Learn more about ADP at

• Drive container security operations including supply chain risk initiatives across ADP’s different business units.
• Build and Support security into the Dev Ops pipelines & help institutionalize the security scanning of container images in line with shift left strategy.
• Provide support for managing supply chain vulnerabilities, image provenance, adversarial container security, and governance risk, and compliance (GRC)
• Assist in developing solutions to generate a Container Security Bill of Materials (CSBom) and Vulnerability Exchange (VEX)
• Promote a culture around secure container development through training, governance, and metrics.
• Maintain awareness of container cybersecurity threats and best practices to enable securing and hardening at scale.
• Customize policies, rules, and alerts to comply with established policies and settings.
• Bring technical SME knowledge into the program and drive excellence.
• Metrics/Reporting
• Identify meaningful KPIs/KRI’s to drive progress and improvement
• Provide weekly Scanning and Monitoring reports.
• Create and maintain Standard Operating Procedures (SOP)
• Perform other duties as required.

• Basic knowledge and understanding of container security vulnerabilities (OWASP).
• Understanding of container image formats such as Docker, OCI, etc.
• Experience in implementing and rolling out container scanning solutions as part of container development.
• Familiarity with internet technologies and web development secure coding best practices.
• Understanding CI/CD pipelines covering source control, integration, and deployment (ex: Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, Sonar Qube, git, Snyk).
• Previous software engineering/architecture experience (Java, C#, .Net, JavaScript, Python) preferred.
• Strong analytical/problem-solving skills and basic cross-functional knowledge across multiple development and security disciplines.
• Experience in training development teams on secure…