{"id":471657,"url":"https://alion.io/job/hcss-senior-devsecops-engineer","title":"Senior DevSecOps Engineer","company":{"id":179869,"name":"HCSS","domain":"hcss.com","url":"https://alion.io/company/hcss","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":115000,"max_usd":205000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":362},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"C#","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"GDPR","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Go","optional":false},{"name":"HashiCorp Vault","optional":false},{"name":"ISO 27001","optional":false},{"name":"JavaScript","optional":false},{"name":"Jenkins","optional":false},{"name":"Least Privilege","optional":false},{"name":"Mend","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"PCI DSS","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"Python","optional":false},{"name":"Semgrep","optional":false},{"name":"Snyk","optional":false},{"name":"SOC 2","optional":false},{"name":"SonarQube","optional":false},{"name":"STRIDE","optional":false},{"name":"Swagger","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Vault","optional":false},{"name":"Veracode","optional":false},{"name":"Wi-Fi","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-07-28T15:23:05Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-23T18:45:19Z","board_verified":true,"closed_at":null,"days_open":87,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":87},"description":"We are HCSS. For the last 40 years, we have been developing software to help construction companies streamline their operations.Based in Sugar Land, TX, our mission is helping customers achieve excellence through our proven customer-centric, end-to-end solutions and exceptionally helpful service, while providing a great life for our employees. With this mission at the core of everything we do, HCSS is a pioneer and leader in the construction software space and a consistently recognized employer. We have earned Best Companies to Work for in Texashonors for 18consecutive years and have been named a USA Today Top Workplace. HCSS has also been recognized by Built Inas a Best Place to Work in Greater Houstonand by Construction Executivefor our technology innovation, reflecting our strong culture, industry leadership, and commitment to excellence.\nWHO WE NEED:\nAs a Senior DevOps Engineer specializing in DevSecOps and Application Security, you will play a pivotal role in improving, securing, and standardizing software delivery practices across development teams. This role combines senior-level DevOps engineering experience with a strong focus on application security, secure SDLC practices, CI/CD security automation, vulnerability management, secrets management, cloud security, and developer enablement.\nThis role is especially focused on application security, including SAST, DAST, SCA, secrets scanning, API security, secure coding practices, threat modeling, vulnerability triage, risk-based remediation, and security integration withinC I/CD pipelines. The successful candidate will serve as a technical leader and trusted advisor who helps development\nteams deliver secure software at scale.\nRequirements:\n8+ years of experience in DevOps, DevSecOps, application security, security engineering, software engineering, platform engineering, or a related technical field.\nStrong hands-on experience with cloud services, preferably Azure, including application hosting, networking, storage, databases, identity, monitoring, access control, and security services.\n5+ years of experience designing, developing, securing, and maintaining CI/CD pipelines using tools such as Azure DevOps, GitHub Actions, YAML, GitLab CI, Jenkins, or similar platforms.\nStrong experience embedding security tools and controls into CI/CD pipelines, including SAST, DAST, SCA, secrets scanning, dependency scanning, container scanning, and other automated security validation tools\nDeep understanding of secure SDLC, DevSecOps principles, secure software development practices, and modern application security concepts.\nStrong understanding of OWASP Top 10, API security, authentication, authorization, input validation, session management, encryption, secure error handling, secrets handling, and software supply chain risk.\nExperience identifying, triaging, prioritizing, and driving remediation of application security vulnerabilities across new and existing applications.\nExperience with vulnerability management practices, including security scanning tools, risk assessment, remediation tracking, exception handling, and risk acceptance workflows.\nExperience with secrets management solutions such as Azure Key Vault, HashiCorp Vault, or equivalent technologies\nExperience with scripting and automation using PowerShell, Azure CLI, Bash, Python, Go, or similar technologies.\nAbility to read, understand, and reason about application code in one or more modern programming languages such as C#, Java, JavaScript, TypeScript, Python, Go, or similar.\nFamiliarity with security and compliance frameworks such as OWASP, NIST, CIS, SOC 2, ISO 27001, PCI DSS, GDPR, or similar.\nStrong troubleshooting, analytical, and problem-solving skills\nExcellent communication skills with the ability to explain security concepts, risks, and remediation guidance to both technical and non-technical stakeholders.\nAbility to work independently, manage multiple priorities, and collaborate effectively with cross-functional teams.\nProactive attitude toward continuous improvement, automation, secure engineering practices, and developer enablement.\nBonus Qualifications:\nAdvanced cloud, DevOps, or security certifications such as AZ-400, Microsoft Certified: Azure Security Engineer, CISSP, CSSLP, CCSP, GWEB, GWAPT, or equivalent.\nStrong hands-on experience with Azure security services such as Azure Key Vault,\nMicrosoft Defender for Cloud, Azure Policy, Microsoft Entra ID, Azure Monitor, Azure DevOps, and related Azure-native security capabilities.\nExperience with tools such as SonarQube, Veracode, Checkmarx, Snyk, Black Duck, Mend, GitHub Advanced Security, Semgrep, Burp Suite, OWASP ZAP, Wiz, Prisma Cloud, Aqua, or similar.\nExperience with threat modeling techniques and frameworks such as STRIDE, attack trees, abuse cases, or similar approaches.\nStrong understanding of microservices architecture and API security practices.\nExperience with OpenAPI/Swagger, OAuth2, OIDC, SAML, JWT, identity federation, and modern authentication and authorization patterns.\nExperience creating developer-facing security documentation, secure coding guidance, reusable pipeline templates, and security training materials.\nExperience building vulnerability dashboards, security KPIs, remediation workflows, and risk acceptance processes.\nRole Responsibilities:\nVulnerability Management and Risk Governance \nOwn or support application vulnerability management processes from detection through remediation, exception, or formal risk acceptance. \nTriage findings from security tools, penetration tests, dependency scans, cloud scans, code reviews, and internal assessments.\nPrioritize vulnerabilities based on severity, exploitability, business impact, application criticality, exposure, compensating controls, and compliance requirements.\nPartner with development teams to drive timely remediation of high-risk and recurring vulnerabilities. \nTrack and communicate remediation progress, vulnerability trends, SLA performance, and application security posture to technical and non-technical stakeholders. \nIdentify recurring vulnerability patterns and drive systemic improvements through automation, education, standards, and reusable security controls. \nHelp define vulnerability remediation SLAs, exception processes, risk acceptance criteria, and security reporting standards. \nCloud and Azure Security \nDesign, implement, manage, and secure cloud-based application environments, preferably within Azure. \nApply Azure security best practices using services such as Azure Key Vault, Microsoft Defender for Cloud, Azure Policy, Azure DevOps, identity and access controls, encryption, logging, and monitoring. \nImplement secure access patterns using RBAC, least privilege, managed identities, secure networking, encryption, and policy-based controls. \nMonitor and troubleshoot cloud services to help ensure secure, reliable, and high-performing application environments. \nCollaborate with stakeholders to design cloud solutions that meet current and future business, security, compliance, and operational needs. \nSupport secure configuration and hardening of application hosting environments, databases, networking components, storage, and related platform services. \nSecrets Management\nImplement, manage, and continuously improve secrets management practices across development, test, staging, and production environments. \nUse solutions such as Azure Key Vault, HashiCorp Vault, or equivalent platforms to protect sensitive information. \nPartner with teams to eliminate hardcoded secrets, improve secret rotation, and enforce secure access patterns. \nIntegrate secrets scanning and prevention controls into source code repositories and CI/CD pipelines. \nDefine standards for secret storage, access, lifecycle management, auditability, and remediation of exposed secrets. \nDeveloper Enablement and Security Culture \nAct as a trusted security and DevOps advisor to developers, architects, QA engineers, product teams, and engineering managers.\nCreate practical secure coding guidance, reusable examples, internal documentation, reference patterns, and developer-friendly security standards. \nConduct training, workshops, and coaching on topics such as OWASP Top 10, API security, secure coding, CI/CD security, secrets management, dependency risk, and cloud security. \nMentor and guide junior DevOps engineers and help raise the overall security maturity of engineering teams. \nPromote a collaborative security culture where security is embedded into engineering practices rather than treated as a blocker. \nInfluence teams through partnership, automation, practical guidance, and risk-based decision-making. \nGovernance, Compliance, and Standards \nContribute to application security standards, secure coding policies, cloud security standards, pipeline requirements, and DevSecOps governance. \nEnsure applications, cloud environments, pipelines, and development workflows align with organizational security and compliance requirements. \nSupport compliance with frameworks and standards such as OWASP, NIST, CIS, SOC 2, ISO 27001, PCI DSS, GDPR, or similar. \nHelp define and enforce security policies related to application security, cloud security, vulnerability remediation, secrets management, and CI/CD practices. \nContinuously evaluate the effectiveness of security tooling, automation, standards, and processes. \nTravel Requirements:\nOccasional travel to our office may be requested up to once or twice a year\nBENEFITS & PERKS:\nPart of our mission is to provide a great life for our employees. We believe that when our people are happy, they do their best work. Some of the benefits and perks we offer include:\nFlexibility to work Remotely\nMedical, dental, and vision coverage with company-paid and employee-paid options\nPaid holidays, sick days, and personal time off\nEmployee Resource Groups (ERGs) that foster connection and inclusion\nOn-site amenities including a covered basketball court, soccer field, track, pickleball/tennis courts, gym, etc.\nDog-friendly campus and WiFi-accessible courtyards\n401(k) with a 5% company match\nCoverage for employee professional development and wellness\nAnd more!","description_format":"text","description_chars":10175,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Fleet Management","Construction Management Software"],"lifecycle":[{"event":"open","at":"2026-09-06T13:29:06Z"}],"visa":[],"liveness":{"score":20,"band":"cold","label":"Long shot","p_open":1,"p_active":0.718,"p_room":0.28,"age_days":86,"expected_fill_days":39,"reasons":["conf:1","velocity","win:tail","crowd:"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/hcss-senior-devsecops-engineer","json_url":"https://alion.io/job/hcss-senior-devsecops-engineer.json","meta":{"generated_at":"2026-10-23T19:35:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":626,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":179869},"rest":"https://alion.io/mcp/rest/get_company?id=179869"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhcss-senior-devsecops-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhcss-senior-devsecops-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhcss-senior-devsecops-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hcss-senior-devsecops-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhcss-senior-devsecops-engineer"}]}