Senior Application Security Engineer - Containers

Senior Application Security Engineer - Containers role focused on building and running container security scanning services and governance before container images reach production.

Responsibilities

• Own container security operations, including supply chain risk initiatives across ADP business units
• Build and support security in DevOps pipelines, aligning container image scanning with a shift-left approach
• Support supply chain security activities, including vulnerability management, image provenance, adversarial container security, and related governance risk/compliance (GRC) needs
• Help develop solutions for Container Security Bill of Materials (CSBom) generation and Vulnerability Exchange (VEX)
• Promote secure container development through training, governance, and metrics
• Stay current on container cybersecurity threats and best practices to enable securing and hardening at scale
• Customize policies, rules, and alerts to match established policies and settings
• Serve as a technical SME and drive program excellence
• Identify meaningful KPIs/KRIs to measure progress and improvement
• Provide weekly scanning and monitoring reports
• Create and maintain Standard Operating Procedures (SOP)
• Perform other duties as required

Requirements

• 5+ years of experience in various IT or cybersecurity roles, including 3+ years in software engineering roles
• Bachelor’s degree or equivalent
• Basic knowledge and understanding of container security vulnerabilities (OWASP)
• Understanding of container image formats such as Docker and OCI
• Experience implementing and rolling out container scanning solutions as part of container development
• Familiarity with secure coding best practices and internet technologies
• Understanding of CI/CD pipelines across source control, integration, and deployment (examples: Bitbucket, Jenkins, Rally, JIRA, Artifactory, Nexus, SonarQube, git, Snyk)
• Strong analytical and problem-solving skills with basic cross-functional knowledge across multiple development and security disciplines
• Experience training development teams on secure container practices
• Basic understanding of Test Automation tools and framework aligned to the NIST Container Security Framework
• Ability to communicate security concepts to both technical and non-technical staff
• Understanding of Agile methodologies, Cloud, Container, and Application Security
• Ability to work effectively as part of a remote team; self-motivated with a positive attitude
• Good problem-solving, communication, and presentation skills
• Familiarity with microservices architecture and design patterns
• Analytic skills to support data-driven decision-making around threats, vulnerabilities, and risk (qualitative and quantitative)
• CEH, CISSP, CSSLP, GCIA, GPEN, or GWAPT are a plus but not required

Technologies

• OWASP, Docker, OCI
• Bitbucket, Jenkins, Rally, JIRA
• Artifactory, Nexus, SonarQube, git, Snyk
• Java, C#, .Net, JavaScript, Python
• NIST Container Security Framework
• Container Security Bill of Materials (CSBom)
• Vulnerability Exchange (VEX)

Location

• Alpharetta, GA (hybrid)

Salary

• USD 74,800 - 183,900 per year

Benefits

• Medical, Dental, Vision
• Life Insurance
• Matched Retirement Savings
• Wellness Program
• Short-and Long-Term Disability
• Charitable Contribution Match
• Holidays
• Personal Days & Vacation
• Paid Volunteer Time Off