Senior Application Security Engineer - Containers

ADP is hiring a Senior Application Security Engineer - Containers for a hybrid role based in Roseland, NJ (also listed as Alpharetta, GA). In this position, you will help establish container security scanning services, governance for secure container image use before production release, and shift left practices that bring security controls earlier in the product lifecycle.

What you’ll focus on

• Lead container security operations, including supply chain risk initiatives across ADP business units.
• Build and support security within DevOps pipelines, helping institutionalize container image scanning aligned with shift left.
• Support supply chain vulnerability management, image provenance, adversarial container security, and governance risk and compliance (GRC).
• Help develop solutions for generating a Container Security Bill of Materials (CSBom) and Vulnerability Exchange (VEX).
• Promote secure container development through training, governance, and metrics.
• Stay current on container cybersecurity threats and best practices to support secure container hardening at scale.
• Customize policies, rules, and alerts to align with established policies and settings.
• Bring strong technical SME knowledge to the program and drive excellence in execution.
• Identify meaningful KPIs/KRIs to measure progress and improvement.
• Provide weekly scanning and monitoring reports.
• Create and maintain Standard Operating Procedures (SOP).
• Perform other duties as required.

What you’ll bring

• Basic understanding of container security vulnerabilities (OWASP).
• Knowledge of container image formats such as Docker and OCI.
• Experience implementing and rolling out container scanning solutions as part of container development.
• Familiarity with internet technologies and secure coding best practices.
• Understanding of CI/CD pipelines including source control, integration, and deployment (for example: Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, SonarQube, git, Snyk).
• Previous software engineering and/or architecture experience (Java, C#, .Net, JavaScript, Python preferred).
• Strong analytical and problem-solving skills, with cross-functional knowledge across development and security disciplines.
• Experience training development teams on secure container practices.
• Basic understanding of Test Automation tools/framework and the NIST Container Security Framework.
• Ability to explain security concepts to technical and non-technical audiences.
• Understanding of Agile, Cloud, and Container and Application Security.
• Ability to work effectively as part of a remote team.
• Self-motivated with a positive attitude.
• Education: Bachelor’s degree or equivalent.
• Experience: five years or more in various IT or cybersecurity roles, including three or more years in software engineering roles.
• Familiarity with microservices architecture and design patterns.
• Analytic skills to support data-driven decisions regarding system threats, vulnerabilities, and risk (qualitative and quantitative).
• Certifications are a plus but not required: CEH, CISSP, CSSLP, GCIA, GPEN, GWAPT.

Technologies you may work with

• Docker, OCI, OWASP
• DevOps, CI/CD, Agile
• Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, SonarQube, git, Snyk
• Java, C#, .Net, JavaScript, Python
• NIST Container Security Framework, CSBom, VEX
• Cloud, Container and Application Security, Microservices architecture

Compensation & benefits

Salary: USD 74,800 - 183,900 per year.

• Medical
• Dental
• Vision
• Life Insurance
• Matched Retirement Savings
• Wellness Program
• Short-and Long-Term Disability
• Charitable Contribution Match
• Holidays
• Personal Days & Vacation
• Paid Volunteer Time Off