Job description

Paylocity is an award-winning provider of cloud-based HR and payroll software solutions, offering the most complete platform for the modern workforce. The company has become one of the fastest-growing HCM software providers worldwide by offering an intuitive, easy-to-use product suite that helps businesses automate and streamline HR and payroll processes, attract and retain talent, and build a strong workplace culture. While traditional HR and payroll providers automate basic HR processes such as payroll and benefits administration, Paylocity goes further by developing tools that HR and businesses need to compete for talent and deliver against the expectations of the modern workforce. We give our employees what they need to succeed, including great benefits and perks! We offer medical, dental, vision, life, disability, and a 401(k) match, as well as perks that support you, your family, and your finances. And if it’s career development you desire, we provide that, too! At Paylocity, people matter most and have always been at the heart of our business. When you feel like you belong, work is no longer work – it's personal. At Paylocity, we believe better employees lead to better companies. Workplaces and cultures that care will build the future, and at Paylocity, we’re doing just that. Join us as we change the future and transform your career! There are jobs and then there are careers . Since 1997, Paylocity has been hiring talented people, giving them big challenges, and providing the right resources to help them succeed. Our award-winning culture ensures all employees feel truly welcome, appreciated, and free to be themselves. While other companies talk about it, we make it happen. Join Paylocity and launch your career! This is a fully remote position, allowing you to work from home or location of record within the U.S. with no in-office requirements. You must be available five days per week during designated work hours. The work arrangement for this role is subject to change based on business needs and individual performance. This may include adjustments to on-site requirements or schedule expectations, as necessary. Position Overview We are seeking a highly motivated DevSecOps Manager to lead the evolution of secure software engineering across Paylocity. This role will focus on making security an inherent part of how software is designed, built, packaged, and delivered, with an emphasis on secure-by-design practices, software hardening, trusted software supply chains, and automation. As the DevSecOps Manager, you will lead a team responsible for modern application and software supply chain security capabilities, set technical and program direction, and partner closely with Product Development, Platform, Architecture, Information Security, Governance, Risk, and Compliance (GRC) teams. The role will drive practical engineering guardrails that reduce risk while enabling teams to deliver software securely at scale. Primary Responsibilities The below represents the primary duties of the position, others may be assigned as needed. To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. • Lead and mentor the DevSecOps team and define the roadmap for application security and software supply chain security. • Drive secure-by-design practices through threat modeling, architecture and design reviews, reusable security patterns, and developer-focused engineering guidance. • Advance software hardening by standardizing trusted, minimal container images and secure base components, including adoption of technologies such as Chainguard where appropriate. • Establish software provenance and artifact integrity controls, including software bills of materials (SBOMs), signing, attestations, and verification throughout build and deployment workflows. • Embed automated security controls and policy guardrails into CI/CD and developer workflows, with an emphasis on securing GitHub Actions at scale through reusable hardened workflows, least-privilege permissions, trusted dependencies, and secure authentication patterns. • Partner with engineering and platform teams to reduce exploitable vulnerabilities and software supply chain risk through automation, secure defaults, and paved-road patterns. • Define meaningful metrics for secure-development adoption, software supply chain integrity, vulnerability reduction, and control effectiveness. • Evaluate emerging application security and software supply chain technologies and translate security strategy into scalable engineering outcomes. Education and Experience • 5 + years of experience in application security, DevSecOps, product security, software security, or a related information security discipline. • 2+ years people management experience • Experience leading technical teams or security engineering initiatives, with demonstrated ability to mentor engineers and drive cross-functional outcomes. • Strong knowledge of secure software development, secure-by-design principles, threat modeling, risk-based vulnerability management, and the NIST Secure Software Development Framework (SSDF). • Hands-on experience integrating security controls into CI/CD pipelines and modern software delivery workflows; experience securing GitHub Actions at scale is preferred. • Demonstrated experience leading change management efforts related to software delivery, CI/CD platforms, developer workflows, or security controls, including driving adoption across large engineering organizations. • Experience with software supply chain security concepts including hardened container images, SBOMs, artifact signing, attestations, provenance, and dependency risk. • Working knowledge of application security testing and automation, including SAST, SCA, secrets detection, and related technologies. • Experience working in cloud, SaaS, containerized, and agile/DevOps engineering environments. • Strong communication and leadership skills with the ability to translate technical security risk into practical engineering direction and measurable outcomes. Physical Requirements • Ability to sit for extended periods: The role requires sitting at a desk or workstation for long periods, typically 7-8 hours a day. • Use of computer and phone systems: The employee must be able to operate a computer, use phone systems, and type. This includes using multiple software programs and inquiries simultaneously. Paylocity is an equal-opportunity employer. Paylocity is committed to the full inclusion of all individuals. We recruit, train, compensate, and promote regardless of race, religion, color, national origin, sex, disability, age, veteran status, and other protected status as required by applicable law. At Paylocity, we believe diversity makes us better. We embrace and encourage our employees’ differences in age, culture, ethnicity, family or marital status, gender identity or expression, language, national origin, physical and mental ability, political affiliation, race, religion or spiritual belief, sexual orientation, socio-economic status, veteran status, and other characteristics that make our employees unique. We actively cultivate these differences through our employee resource groups (ERGs), employee experiences, perspectives, talents, and approaches to drive innovation in the software and services we provide our customers. We comply with federal and state disability laws and make reasonable accommodations for applicants and employees with disabilities. To request reasonable accommodation in the job application or interview process, please contact accessibility@paylocity.com. This email address is exclusively designated for such requests, aligning with federal and state disability laws. Please do not send resumes to this email address, as they will be removed. The base pay range for this position is $131k - $187k/yr; however, base pay offered may vary depending on job-related knowledge, skills, and experience. This position is eligible for an annual bonus and restricted stock unit grant based on individual performance in addition to a full range of benefits outlined here. This information is provided per the relevant state and local pay transparency laws for the location in which this position will be performed. Base pay information is based on market location. Applicants should apply via www.paylocity.com/careers.

Requirements

Must-haves

Position Overview
Lead and mentor the DevSecOps team and define the roadmap for application security and software supply chain security.
Drive secure-by-design practices through threat modeling, architecture and design reviews, reusable security patterns, and developer-focused engineering guidance.
Advance software hardening by standardizing trusted, minimal container images and secure base components, including adoption of technologies such as Chainguard where appropriate.
Establish software provenance and artifact integrity controls, including software bills of materials (SBOMs), signing, attestations, and verification throughout build and deployment workflows.
Partner with engineering and platform teams to reduce exploitable vulnerabilities and software supply chain risk through automation, secure defaults, and paved-road patterns.
Define meaningful metrics for secure-development adoption, software supply chain integrity, vulnerability reduction, and control effectiveness.
Evaluate emerging application security and software supply chain technologies and translate security strategy into scalable engineering outcomes.
Education and Experience
5 + years of experience in application security, DevSecOps, product security, software security, or a related information security discipline.
2+ years people management experience
Experience leading technical teams or security engineering initiatives, with demonstrated ability to mentor engineers and drive cross-functional outcomes.
Strong knowledge of secure software development, secure-by-design principles, threat modeling, risk-based vulnerability management, and the NIST Secure Software Development Framework (SSDF).
Demonstrated experience leading change management efforts related to software delivery, CI/CD platforms, developer workflows, or security controls, including driving adoption across large engineering organizations.
Experience with software supply chain security concepts including hardened container images, SBOMs, artifact signing, attestations, provenance, and dependency risk.
Working knowledge of application security testing and automation, including SAST, SCA, secrets detection, and related technologies.
Experience working in cloud, SaaS, containerized, and agile/DevOps engineering environments.
Strong communication and leadership skills with the ability to translate technical security risk into practical engineering direction and measurable outcomes.
Physical Requirements
Ability to sit for extended periods: The role requires sitting at a desk or workstation for long periods, typically 7-8 hours a day.
Use of computer and phone systems: The employee must be able to operate a computer, use phone systems, and type. This includes using multiple software programs and inquiries simultaneously.

Nice-to-haves

Hands-on experience integrating security controls into CI/CD pipelines and modern software delivery workflows; experience securing GitHub Actions at scale is preferred.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

ci/cdagileaccessibility

Platform: paylocity
Effort: medium

Benefits

Benefits detected in the listing.

Dental

Vision

401(K)