2 months ago
Responsibilities
- Partner with global product and engineering teams to design, review, and evolve secure application architectures.
- Conduct security architecture reviews and provide security requirements, design guidance, and validation throughout the solution lifecycle.
- Advise on GenAI, LLM, and AI/ML application security, including data protection, model security, prompt injection mitigation, dependency controls, and secure model integration.
- Assess AWS, Azure, GCP, and OCI cloud services against required security controls.
- Influence solution architects, security champions, engineering managers, and developers to adopt secure-by-design principles.
- Support threat modeling using tools such as IriusRisk and maintain architecture diagrams, countermeasures, and threat coverage.
- Develop secure architecture patterns, reference architectures, and application security standards aligned with industry frameworks.
- Embed secure coding, secure API design, CI/CD security controls, and automated security testing throughout the SDLC.
- Assess third-party platforms, SaaS solutions, and cloud-native services for vendor and architecture risk.
- Partner with cloud architecture teams to apply consistent security controls across AWS, Azure, and hybrid environments.
- Communicate complex security concepts to technical and non-technical stakeholders.
Requirements
- Bachelor’s degree in computer science, information security, engineering, or a related field, or equivalent experience.
- At least 8 years of experience in application security, security architecture, or related technical security roles.
- Deep expertise in secure coding, API security, microservices, cloud application security, DevSecOps, and security scanning tools.
- Strong understanding of GenAI, LLM, and agentic AI security, including data governance, RAG, model threats, prompt injection risks, and secure integration patterns.
- Strong knowledge of AWS, Azure, OCI, and/or GCP security capabilities and controls.
- Knowledge of OWASP ASVS, OWASP SAMM, NIST 800-53, NIST CSF, ISO 27001, and CIS Controls.
- Hands-on experience with threat modeling methodologies, IriusRisk, ThreatModeler, Microsoft Threat Modeling Tool, and risk assessment techniques.
- Knowledge of identity and access management, OAuth2/OIDC, JWT security, secrets management, key management, and zero-trust design principles.
- Experience with CI/CD pipeline security and infrastructure-as-code security.
- Strong understanding of data security, encryption, privacy-by-design, and secure logging and monitoring.
- Strong communication, collaboration, stakeholder engagement, and influencing skills.
- Relevant certifications such as CISSP, CISM, CCSP, CSSLP, CEH, SANS/GIAC, or Google Professional Cloud Security Engineer are preferred.
Benefits
- Hybrid work arrangement.
- Opportunity to work within ADP’s Global Security Organization and Product Security organization on global, security-critical products and services.
About ADP
ADP builds human capital management software and outsourced services for businesses of all sizes, including payroll, tax filing, time, benefits, and talent tools. Its revenue comes from subscriptions and service fees, and it also offers a professional employer organization (PEO) and compliance support. Founded in 1949 and headquartered in Roseland, New Jersey, ADP is a public company traded on NASDAQ under the ticker ADP.