Senior Container Application Security Engineer

ADP - Atlanta, GA

Full-time - Mid Level

Atlanta, GA

Professional, Scientific, and Technical Services

About the position

The Senior Container Application Security Engineer at ADP is responsible for safeguarding critical information by managing container security operations. This role involves designing, implementing, and overseeing container security scanning services, assessing security risks, and establishing governance frameworks for secure container image usage. The engineer will work closely with development teams to integrate security controls early in the product development lifecycle, ensuring compliance and addressing security threats effectively.

Responsibilities

• Drive container security operations including supply chain risk initiatives across ADP's different business units.
• Build and support security into the DevOps pipelines & help institutionalize the security scanning of container images in line with shift left strategy.
• Provide support for managing supply chain vulnerabilities, image provenance, adversarial container security, and governance risk, and compliance (GRC).
• Assist in developing solutions to generate a Container Security Bill of Materials (CSBom) and Vulnerability Exchange (VEX).
• Promote a culture around secure container development through training, governance, and metrics.
• Maintain awareness of container cybersecurity threats and best practices to enable securing and hardening at scale.
• Customize policies, rules, and alerts to comply with established policies and settings.
• Bring thought leadership into the program and drive excellence.
• Identify meaningful KPIs/KRI's to drive progress and improvement.
• Provide weekly scanning and monitoring reports.
• Create and maintain Standard Operating Procedures (SOP).
• Perform other duties as required.

Requirements

• Basic knowledge and understanding of container security vulnerabilities (OWASP).
• Understanding of container image formats such as Docker, OCI, etc.
• Experience in implementing and rolling out container scanning solutions as part of container development.
• Familiarity with internet technologies and web development secure coding best practices.
• Understanding CI/CD pipelines covering source control, integration, and deployment (ex: Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, SonarQube, git, Snyk).
• Previous software engineering/architecture experience (Java, C#, .Net, JavaScript, Python) preferred.
• Strong analytical/problem-solving skills and basic cross-functional knowledge across multiple development and security disciplines.
• Experience in training development teams on secure container practices.
• Basic understanding of Test Automation tools and framework - NIST Container Security Framework.
• Ability to communicate security-related concepts to technical and non-technical staff.
• Understanding of Agile methodologies, Cloud, and Container Security.
• Good problem-solving skills, communication and presentation skills.
• Ability to work effectively as part of a remote team.
• Self-motivated with a positive attitude.

Nice-to-haves

• Degree in computer science, Information / Cyber Security, Computer Systems Engineering, Computer Information Systems, or equivalent education and experience required.
• Any of the following are a plus but not necessary: CEH, CISSP, CSSLP, GCIA, GPEN, GWAPT.

Benefits

• Diversity and inclusion programs
• Professional development opportunities
• Flexible work arrangements
• Health insurance coverage
• Retirement savings plan (401k)
• Paid time off and holidays
• Employee assistance programs