DevSecOps Architect

Seminole Hard Rock; United States; On-site; USD 150,000 - 210,000; Full time

Job summary

Seminole Hard Rock is seeking a DevSecOps Architect to define and implement secure-by-default development frameworks across the Secure SDLC. You will embed security into CI/CD, cloud infrastructure, and delivery processes, building tooling and automation to shift security left across all deployments.

The role partners with engineering and cybersecurity leadership to codify standards, enable automated testing, and enforce governance and compliance.

Qualifications

• Define and embed security into the Secure SDLC across CI/CD pipelines.
• Establish secure coding standards and reference architectures for dev teams.
• Architect threat modeling and gate criteria to speed secure delivery.
• Lead automation and policy-as-code to enforce compliance at scale.
• Review security for new apps, platforms, and major changes with actionable guidance.

Responsibilities

• Design an enterprise DevSecOps architecture with automated testing and compliance.
• Maintain secure coding standards and security design patterns for teams.
• Create threat modeling frameworks to identify risks early in design.
• Governing CI/CD security gates for code, containers, and IaC.
• Own security architecture reviews to accelerate secure delivery.

Skills

DevSecOps

Security architecture

Threat modeling

CI/CD security

Automation

Governance & compliance

Tools

Terraform

Ansible

CloudFormation

ARM/Bicep

Kubernetes

Job description

Our team members are the key to our company's success, and their health and well-being, as well as that of their families, is very important to us. We offer a comprehensive benefits package that allows our team members stay healthy, plan for their future and maintain a healthy work-life balance. Benefits may vary with employment status. To see our fill list of Team Member Benefits please visit our career site: www.gotoworkhappy.com/benefits

Job Description:

At Seminole Hard Rock Support Services, we are on a mission to protect our guests, team members, and enterprise assets through world-class cybersecurity practices. As the DevSecOps Architect, you will define, build, and champion the integration of security into every stage of the Secure Software Development Lifecycle (S-SDLC), embedding automated security controls, governance, and compliance into CI/CD pipelines, cloud infrastructure, and application delivery processes across the enterprise. Reporting to the Director II of Cybersecurity Architecture, Engineering & IAM, this role requires a deeply technical, security-minded architect and engineer who bridges the worlds of software development, cloud operations, and cybersecurity. You will design and implement secure-by-default development frameworks, automate security testing and compliance enforcement, and drive a cultural shift toward shared security ownership, ensuring that every application and infrastructure deployment across all Seminole Hard Rock business units is built secure from the ground up. This is a shift-left architecture role. The ideal candidate does not sit at the end of the pipeline reviewing what others have built, they embed themselves into the engineering lifecycle, define the standards developers work within, and build the tooling and automation that makes security the path of least resistance. You architect at scale, write production-grade code, and measure your impact in vulnerabilities prevented, not just discovered.

Responsibilities

Security Architecture & Secure SDLC

• Design and implement an enterprise DevSecOps architecture that embeds security controls, automated testing, and compliance validation into every phase of the software development lifecycle, from code commit through production deployment
• Define and maintain secure coding standards, application security reference architectures, and security design patterns that development teams adopt as foundational building blocks, not optional guidelines
• Architect threat modeling frameworks and processes that enable development teams to proactively identify and mitigate security risks during design and development phases, before code is written
• Establish and govern security gate criteria within CI/CD pipelines, ensuring that code, container images, infrastructure-as-code templates, and third-party dependencies meet security and compliance thresholds before promotion to production
• Own the security architecture review process for new applications, platforms, and major system changes, providing timely, actionable guidance that accelerates delivery rather than blocking it

Pipeline Engineering & Automation

• Design, build, and maintain secure CI/CD pipelines integrating automated security tooling across the full spectrum: static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), container scanning, infrastructure-as-code (IaC) scanning, and secrets detection
• Develop and maintain custom pipeline integrations, security automation scripts, and policy-as-code frameworks using Python, PowerShell, Go, or similar languages, enforcing security controls programmatically at scale
• Implement automated compliance-as-code solutions that continuously validate infrastructure and application configurations against regulatory requirements (PCI-DSS, SOX, tribal gaming regulations) and internal security policies, eliminating manual evidence collection
• Engineer automated remediation workflows that detect, alert, and resolve common security misconfigurations and vulnerabilities without manual intervention, reducing mean time to remediate across the portfolio
• Build developer-facing security tooling and integrations that surface security findings directly within developer workflows (IDE plugins, pull request gates, ticketing integrations), making security feedback immediate and actionable

Cloud & Infrastructure Security

• Architect and enforce security guardrails across cloud environments (Azure, AWS, Google Cloud), including network segmentation, identity and access policies, encryption standards, logging configurations, and monitoring baselines
• Design and implement secure infrastructure-as-code (Terraform, Ansible, ARM/Bicep, CloudFormation) templates and modules that serve as hardened, reusable baselines for all cloud and on-premises deployments
• Oversee container and Kubernetes security architecture, including image hardening, runtime protection, network policies, secrets management, an