Lead Security Engineer
Global Cybersecurity Services (GCS)
Global Security Organization
MISSION
At ADP we are driven by your success. We engage your unique talents and perspectives. We welcome your ideas on how to do things differently and better. In your efforts to achieve, learn and grow, we support you all the way. If success motivates you, you belong at ADP.
Technology at ADP. It’s the foundation of the products and services that have made us a world-wide leader in workforce solutions. With us, you can combine technical skills and business acumen, to effectively consult as well as solve technical challenges. You have the opportunity to train on leading-edge technologies that continually redefine what’s possible in our industry.
The Threat Intelligence Team within ADP’s Global Security Organization (GSO) is responsible for Collection, Correlation, Automation and Reporting of various Cyber Threat and Fraud Data.
In this role, the Lead Security Engineer will be responsible for the design, development, enhancement, and maintenance of the Threat Intelligence Program’s Platform Operations, Automation, and Integrations. The Lead Security Engineer will demonstrate the ability to perform in a fast-paced team, technical expertise, and leadership in threat intelligence, application development, brand protection, and data analysis.
You will work alongside infrastructure security engineers, threat intelligence analysts, threat hunters, and the security operations team to help improve our current automation processes and future integrations. You will work with various intelligence collection, reporting tools, and frameworks to automate the processes, develop playbooks, and/or integrate processes with other platforms. You will review documentations, develop plans, catalog and document processes, communicate with stakeholders and application support teams, follow up on requests, and improve processes.
To thrive in this position, you’ll need to be an expert in application development, API integration, automation processes, understand the Threat Intelligence Lifecycle, and know how threat intelligence products and services work. You’ll also need experience working with structured and unstructured data and are great at maintaining situation awareness. You know how to work with the Security Operations team to create the most value and identify gaps in available intelligence information and engage with leadership on strategies to meet intelligence requirements through Intelligence collection processes.
ROLES AND RESPONSIBILITIES
• Develop Indicator Enhancement/Enrichment Playbook for the Threat Intelligence Platform (TIP).
• Collect and ingest data from various sources to the TIP.
• Develop systems integration between multiple Threat Intelligence Source APIs and the TIP to ingest indicators of compromise.
• Develop threat intelligence data dashboards, based on various tagging, and indicator types along with their threat severity and confidence levels.
• Develop and maintained API connections with various security stack solutions.
• Understand and maintain API that enables the system integration between Apache Nifi and the indicators database (mirror of the Threat Intelligence Platform Database). This API handles requests to build IOC feeds based on indicator types, indicator attributes or tags, and indicators severity, and handles the enrichment of indicators.
• Develop and maintain threat intelligence system to gather IOC data from multiple external threat
intelligence feeds.
• Collect, review, and analyze internal, open source, and dark web datasets to integrate with TIP and other security monitoring solutions.
• Apply knowledge of current cyber threats and the associated tactics, techniques, and procedures used to infiltrate computer networks.
• Understand and maintain VPN infrastructure.
• Understand and maintain email servers used to deliver notifications and automated projects.
• Provide accurate and priority-driven analysis on cyber activity/threats and present complex operational/technical topics to senior managers and stakeholders.
• Establish and maintain excellent working relationships/partnerships with the cyber security and infrastructure support teams throughout the organization, as well as different business segments.
• Ability to develop processes, scripts, and code in a quick manner to support current operations and to improve automation processes.
• Ability to work in a fast-paced environment with minimal supervision.
• Create and evaluate trend/correlation analysis for scenario forecasting at both the tactical and operational levels.
• Develop and refine cyber-threat intelligence collection and analysis processes.
• Generate presentations that illustrate research through visualizations, charts, graphs, infographics, and evidence capture for senior leadership.
• Provide input for developing objectives, key results, and program metrics.
• Exhibit strong critical thinking and problem-solving skills with sound judgment.
• Maintain or develop professional contacts in the various communities to support operations.
• Support the Critical Incident Response Center (CIRC)/SOC with intelligence collection, and/or dissemination as it relates to ongoing investigations.
BASIC REQUIREMENTS/TECHNICAL SKILLS REQUIRED
•
Excellent English verbal and written communications skills.
•
Firm understanding and implementation of Software Development Life Cycle (SDLC) processes and executions.
•
Firm understanding of programming languages: Python, Perl. PHP, Java, .net, and C.
•
Good understanding of JQuery/Javascript web client applications.
•
Firm understanding of database infrastructure development and management (PosgreSQL, MySQL, etc.) and NOSQL (MongoDB, DocumentDB, Elasticsearch, etc.) databases.
•
Firm understanding of STIX/TAXII formats and integration with security stack.
•
Firm understanding of Apache Nifi and Kafka.
•
8+ years of cybersecurity, threat intelligence, or network security experience; experience can include one or more of the following cyber-security functions: Cyber Threat Intelligence, Threat Hunting, System Administration, Intrusion Detection/Prevention, Monitoring, Incident Response, Digital Forensics, Vulnerability Management.
•
Firm understanding of network security concepts, including threat and risk analysis, security event/incident monitoring, asset and risk management, and intrusion detection and prevention sensors.
•
Experienced configuring both Windows and Linux networks.
•
Prior experience as a technical cyber threat intelligence (or related) subject matter expert that has worked across organizational boundaries to analyze cyber threats to their organization’s infrastructure and services.
•
A strong understanding of the cyber security principles, methodologies and best practices including knowledge of common threats, attack vectors, zero-days and exploitation techniques.
•
A strong understanding of the Threat Intelligence terminology, the threat intelligence life cycle (cyber threat intel collection, data processing, analysis and findings reporting).
•
Familiar with Threat Intelligence tools, platforms, and technologies e.g.: Threat Intelligence Platforms, SIEM, WAF, Etc.
•
Experience writing code in any programming language (Python Prog Language knowledge desirable) for tasks automation and data manipulation.
•
Knowledge about network protocols, log analysis and simple data structures (JSON, YAML, CSV, XML, Parquet, etc.) and data transformation across theses popular data structures using programming languages.
•
Proficiency developing and orchestrating automations threat intelligence life cycle writing code that can handle collection, data analysis and interpretation from various sources to identify potential threats and assess relevance to the organization.
EDUCATION:
•
A Bachelor of Science in Computer Science degree is a plus, but not required. What’s more important is having the skills and experience to do the job.
•
Holds certifications such as CLA, PCAP, CMDBA, Azure or AWS Developer Associate, OCAJP or similar training and certification.
OTHER COMPETENCIES
•
Knowledge of advanced cyber threats, threat vectors, and attacker methodology to include tools, tactics, and procedures and how they tie into the Cyber Kill Chain or ATT&CK framework.
•
Experience in threat detection and analysis solutions.
•
Knowledge of cloud services, infrastructure, and operations.
•
Experience with premium threat intelligence tooling and/or open-source intelligence techniques.
•
Experience with TIP automation development, collection, maintenance, and integrations.
•
Experience with disseminating information in accordance with TLP classification and handling protocols to the sector through the appropriate mechanisms.
•
Organizational and self-directing skills — ability to initiate, coordinate and prioritize responsibilities and follow through on tasks to completion
•
Experience with developing tools to enhance cyber-threat intelligence capabilities.
•
Security operations experience in the financial industry.
•
Snowflake
•
MongoDB
•
Redis (Data Caching System)
•
Any AMQS (Advanced Message Queuing System) e.g.: Apache Kafka, RabbitMQ, etc.
About ADP: We power organizations with insightful solutions that drive business success. Consistently named one of the “Most Admired Companies” by FORTUNE® Magazine, and recognized by Forbes® as one of “The World’s Most Innovative Companies,” ADP has over a half-million clients around the globe and 70+ years of experience as a world-wide leader of business outsourcing solutions.
ADP is an Equal Opportunity Employer. ADP believes that diversity leads to strength.

BASIC REQUIREMENTS/TECHNICAL SKILLS REQUIRED
•
Excellent English verbal and written communications skills.
•
Firm understanding and implementation of Software Development Life Cycle (SDLC) processes and executions.
•
Firm understanding of programming languages: Python, Perl. PHP, Java, .net, and C.
•
Good understanding of JQuery/Javascript web client applications.
•
Firm understanding of database infrastructure development and management (PosgreSQL, MySQL, etc.) and NOSQL (MongoDB, DocumentDB, Elasticsearch, etc.) databases.
•
Firm understanding of STIX/TAXII formats and integration with security stack.
•
Firm understanding of Apache Nifi and Kafka.
•
8+ years of cybersecurity, threat intelligence, or network security experience; experience can include one or more of the following cyber-security functions: Cyber Threat Intelligence, Threat Hunting, System Administration, Intrusion Detection/Prevention, Monitoring, Incident Response, Digital Forensics, Vulnerability Management.
•
Firm understanding of network security concepts, including threat and risk analysis, security event/incident monitoring, asset and risk management, and intrusion detection and prevention sensors.
•
Experienced configuring both Windows and Linux networks.
•
Prior experience as a technical cyber threat intelligence (or related) subject matter expert that has worked across organizational boundaries to analyze cyber threats to their organization’s infrastructure and services.
•
A strong understanding of the cyber security principles, methodologies and best practices including knowledge of common threats, attack vectors, zero-days and exploitation techniques.
•
A strong understanding of the Threat Intelligence terminology, the threat intelligence life cycle (cyber threat intel collection, data processing, analysis and findings reporting).

Diversity, Equity, Inclusion & Equal Employment Opportunity at ADP: ADP affirms that inequality is detrimental to our associates, our clients, and the communities we serve. Our goal is to impact lasting change through our actions. Together, we unite for equality and equity. ADP is committed to equal employment opportunities regardless of any protected characteristic, including race, color, genetic information, creed, national origin, religion, sex, affectional or sexual orientation, gender identity or expression, lawful alien status, ancestry, age, marital status, or protected veteran status and will not discriminate against anyone on the basis of a disability. We support an inclusive workplace where associates excel based on personal merit, qualifications, experience, ability, and job performance.

Ethics at ADP: ADP has a long, proud history of conducting business with the highest ethical standards and full compliance with all applicable laws. We also expect our people to uphold our values with the highest level of integrity and behave in a manner that fosters an honest and respectful workplace. Click https://jobs.adp.com/life-at-adp/ to learn more about ADP’s culture and our full set of values.