Senior DevSecOps Engineer

The posting, as Heavy Construction Systems Specialists wrote it

We are HCSS. For the last 40 years, we have been developing software to help construction companies streamline their operations . Based in Sugar Land, TX, our mission is helping customers achieve excellence through our proven customer-centric, end-to-end solutions and exceptionally helpful service, while providing a great life for our employees. With this mission at the core of everything we do, HCSS is a pioneer and leader in the construction software space and a consistently recognized employer. We have earned Best Companies to Work for in Texas honors for 18 consecutive years and have been named a USA Today Top Workplace . HCSS has also been recognized by Built In as a Best Place to Work in Greater Houston and by Construction Executive for our technology innovation, reflecting our strong culture, industry leadership, and commitment to excellence.

WHO WE NEED

As a Senior DevOps Engineer specializing in DevSecOps and Application Security , you will play a pivotal role in improving, securing, and standardizing software delivery practices across development teams. This role combines senior-level DevOps engineering experience with a strong focus on application security, secure SDLC practices, CI/CD security automation, vulnerability management, secrets management, cloud security, and developer enablement.

This role is especially focused on application security , including SAST, DAST, SCA, secrets scanning, API security, secure coding practices, threat modeling, vulnerability triage, risk-based remediation, and security integration withinC I/CD pipelines. The successful candidate will serve as a technical leader and trusted advisor who helps development
teams deliver secure software at scale.

Requirements

• 8+ years of experience in DevOps, DevSecOps, application security, security engineering, software engineering, platform engineering, or a related technical field.
• Strong hands-on experience with cloud services, preferably Azure, including application hosting, networking, storage, databases, identity, monitoring, access control, and security services.
• 5+ years of experience designing, developing, securing, and maintaining CI/CD pipelines using tools such as Azure DevOps, GitHub Actions, YAML, GitLab CI, Jenkins, or similar platforms.
• Strong experience embedding security tools and controls into CI/CD pipelines, including SAST, DAST, SCA, secrets scanning, dependency scanning, container scanning, and other automated security validation tools
• Deep understanding of secure SDLC, DevSecOps principles, secure software development practices, and modern application security concepts.
• Strong understanding of OWASP Top 10, API security, authentication, authorization, input validation, session management, encryption, secure error handling, secrets handling, and software supply chain risk.
• Experience identifying, triaging, prioritizing, and driving remediation of application security vulnerabilities across new and existing applicat

[…]
Top 10, API security, secure coding, CI/CD security, secrets management, dependency risk, and cloud security.

• Mentor and guide junior DevOps engineers and help raise the overall security maturity of engineering teams.
• Promote a collaborative security culture where security is embedded into engineering practices rather than treated as a blocker.
• Influence teams through partnership, automation, practical guidance, and risk-based decision-making.

Governance, Compliance, and Standards

• Contribute to application security standards, secure coding policies, cloud security standards, pipeline requirements, and DevSecOps governance.
• Ensure applications, cloud environments, pipelines, and development workflows align with organizational security and compliance requirements.
• Support compliance with frameworks and standards such as OWASP, NIST, CIS, SOC 2, ISO 27001, PCI DSS, GDPR, or similar.
• Help define and enforce security policies related to application security, cloud security, vulnerability remediation, secrets management, and CI/CD practices.
• Continuously evaluate the effectiveness of security tooling, automation, standards, and processes.

Travel Requirements

• Occasional travel to our office may be requested up to once or twice a year

BENEFITS & PERKS

Part of our mission is to provide a great life for our employees. We believe that when our people are happy, they do their best work. Some of the benefits and perks we offer include:

• Flexibility to work Remotely
• Medical, dental, and vision coverage with company-paid and employee-paid options
• Paid holidays, sick days, and personal time off
• Employee Resource Groups ( ERGs ) that foster connection and inclusion
• On-site amenities including a covered basketball court, soccer field, track, pickleball/tennis courts, gym, etc.
• Dog-friendly campus and WiFi-accessible courtyards
• 401(k) with a 5% company match
• Coverage for employee professional development and wellness
• And more!