Software Developer 2

Solicitation Reference Number


Customer Name
Texas Health and Human Services Commission

Category
Applications/Software Development

Customer Entity Name
Health and Human Services Commission

Title
Software Developer

Level
Software Developer

Posted Date
//

Estimated Hours
,SSR

Status
Posted

Number of Positions


Status
New

of Resumes Allowed


Candidates
SubmittedFull/Part Time

Full Time
SSR Cancellation Date

IT STAFFING SERVICES SOLICITATION UNDER
DEPARTMENT OF INFORMATION RESOURCES
IT STAFF AUGMENTATION CONTRACT (ITSAC)
Solicitation Reference Number: Working Title: Software Developer Title/Level: Software Developer Category: Applications/Software Development Full Time

I. DESCRIPTION OF SERVICES

Texas Health and Human Services Commission requires the services of Software Developer , hereafter referred to as Candidate(s), who meets the general qualifications of Software Developer , Applications/Software Development and the specifications outlined in this document for the Texas Health and Human Services Commission.

All work products resulting from the project shall be considered "works made for hire " and are the property of the Texas Health and Human Services Commission and may include pre-selection requirements that potential Vendors (and their Candidates) submit to and satisfy criminal background checks as authorized by Texas law. Texas Health and Human Services Commission will pay no fees for interviews or discussions, which occur during the process of selecting a Candidate(s).

The Software Developer II performs advanced (senior-level) software development work focused on designing, building, testing, and optimizing Microsoft Sentinel capabilities for DSHS projects. This role is responsible for developing custom automation playbooks, analytics rules, behavioral models, connectors, and integrations to support SOAR and UEBA functionality. The position works under limited supervision with considerable latitude for initiative, independent judgment, and technical leadership.

Essential Job Functions (EJFs)

. Microsoft Sentinel SOAR Development (%)

· Designs, develops, tests, and deploys Sentinel SOAR automation playbooks using Azure Logic Apps, Azure Functions, ARM templates, and REST APIs.

· Creates automated workflows for alert enrichment, triage, response actions, notification processes, and case management.

· Integrates Sentinel with third-party systems (EDR, IAM, ticketing systems, email gateways, firewalls, etc.) to automate security operations.

. UEBA & Analytics Engineering (%)

· Develops custom UEBA detection rules, anomaly models, ML-based behavior patterns, and advanced hunting queries (KQL).

· Builds and maintains analytics content, data parsers, normalization rules, and entity behavior profiles.

· Evaluates behavioral anomalies and collaborates with cybersecurity teams to fine-tune detection logic.

. SIEM Content Development & Platform Engineering (%)

· Designs and implements custom data connectors, ingestion pipelines, and data transformation logic.

· Creates dashboards, workbooks, hunting queries, and detection-as-code assets.

· Performs platform tuning to improve performance, reduce noise, and align to MITRE Telecommunication&CK and Zero Trust principles.

. Application Development & Integration (%)

· Develops supporting code modules, scripts, microservices, and helper APIs using Python, PowerShell, .NET, or similar languages.

· Works with DevOps pipelines, CI/CD processes, version control, and infrastructure-as-code where applicable.

. Documentation, Collaboration & Support (%)

· Writes technical design documents, SOPs, architecture diagrams, and automation runbooks.

· Collaborates with DSHS, HHSC CISO Office, and cross-functional stakeholders on requirements, testing, and deployment.

· Provides Tier III support for Sentinel engineering issues and participates in after-action reviews when needed.

Knowledge, Skills, and Abilities (KSAs)

Knowledge of:

· Microsoft Sentinel architecture, SOAR, and UEBA capabilities.

· Azure cloud services, Logic Apps, Azure Functions, Event Hubs, Key Vault, and Azure AD.

· Security operations processes (triage, threat detection, incident response, threat modeling).

· MITRE Telecommunication&CK, NIST CSF, Zero Trust Architecture concepts.

· Programming and scripting languages (Python, PowerShell, KQL, C, JavaScript, or equivalent).

· CI/CD pipelines, DevOps practices, and Git-based version control.

· API integrations and JSON/YAML structures.

Skills in:

· Building Logic App workflows and custom Sentinel automation playbooks.

· Writing complex KQL queries for analytics, hunting, and behavioral detection.

· Developing custom connectors, data maps, and parsers.

· Designing and optimizing UEBA detection models.

· Debugging SOAR workflows and resolving integration issues.

· Communicating technical information clearly to both technical and non-technical audiences.

Abilities to:

· Work independently and take ownership of complex development tasks.

· Translate security requirements into scalable technical solutions.

· Analyze threat behaviors and develop meaningful detections.

· Work collaboratively with cybersecurity, infrastructure, and application teams.

· Manage multiple work assignments and meet deadlines.

II. CANDIDATE SKILLS AND QUALIFICATIONS Minimum Requirements:
Candidates that do not meet or exceed the minimum stated requirements (skills/experience) will be displayed to customers but may not be chosen for this opportunity. Years Required/Preferred Experience Required Graduation from an accredited four-year college or university with major coursework in computer science, computer information systems, software engineering, cybersecurity, or a related field. Required Two () years of full-time experience in software development, cloud engineering, SIEM engineering, or cybersecurity engineering. Required Two () years of full-time experience in software development, cloud engineering, SIEM engineering, or cybersecurity engineering. Preferred Three () or more years of hands-on technical experience with Microsoft Sentinel. Preferred Experience developing UEBA models, anomaly detection rules, and behavior-based analytics. Preferred Experience building Security Automation Playbooks (SOAR). Preferred Microsoft certifications such as: SC-: Security Operations Analyst, AZ- / AZ-, SC- / SC- Preferred Experience integrating Sentinel with EDR, IAM, firewalls, and ticketing systems. Preferred Experience with DevOps pipelines (GitHub, Azure DevOps). Preferred Experience working in a government, healthcare, or regulatory environment.
III. TERMS OF SERVICE


Services are expected to start // and are expected to complete by //. Total estimated hours per Candidate shall not exceed hours. This service may be amended, renewed, and/or extended providing both parties agree to do so in writing.
IV. WORK HOURS AND LOCATION


Services shall be provided during normal business hours unless otherwise coordinated through the Texas Health and Human Services Commission. Normal business hours are Monday through Friday from : AM to : PM, excluding State holidays when the agency is closed.

The primary work location(s) will be at W. st Austin, TX . The working position is On Site. Any and all travel, per diem, parking, and/or living expenses shall be at the Candidate's and/or Vendor's expense. Texas Health and Human Services Commission will provide pre-approved, written authorization for travel for any services to be performed away from the primary work location(s). Pre-approved travel expenses are limited to the rates and comply with the rules prescribed by the State of Texas for travel by its classified employees, including any requirement for original receipts.

The Candidate(s) may be required to work outside the normal business hours on weekends, evenings and holidays, as requested. Payment for work over hours will be at the hourly rate quoted and must be coordinated and pre-approved through Texas Health and Human Services Commission.
V. OTHER SPECIAL REQUIREMENTS TERM OF SERVICE (Required) Services are expected to start on or around January , and are expected to completed by August , . Total estimated hours per Candidate shall not exceed hours for FY.

Initial Purchase Order Term:

Any Purchase Order resulting from this Request for Resumes is effective on the date of issuance and expires on the last day of the State fiscal year in which the Purchase Order was issued, unless sooner stated in the Purchase Order or unless sooner terminated, renewed, or extended as provided in the Purchase Order.

Renewal Option(s):

HHSC, at its sole discretion, may renew the Purchase Order for up to three, one-year optional renewals. Such renewal(s), if exercised, shall be subject to all the requirements and terms and conditions of the Purchase Order.

WORK HOURS AND LOCATION (Required)

A) Services shall be provided during normal business hours unless otherwise coordinated through the Agency. Normal business hours are Monday through Friday from : through : , excluding Texas state holidays when the agency is closed.

B) The primary work location will be W st St., Austin, TX .

Position will be days required to be onsite at the location listed above. Subject to change per manager

Program will only accept LOCAL ONLY candidates for this position.

C) Any and all travel, per diem, parking, and/or living expenses shall be at the worker's and/or Vendor's expense.

D) The worker may be required to work remotely at HHSC discretion, up to percent of the time.

E) The worker may be required to work outside the normal business hours on weekends, evenings and holidays, as requested. Payment for work over hours will be at the hourly rate quoted and must be coordinated and pre-approved through the Agency.

OTHER SPECIAL REQUIREMENTS

Interviews will be conducted: (check all that apply)

☐ By Phone

☒ In person

☒ Through Microsoft Teams

IMPORTANT INFORMATION

A vendor's submission of a candidate may be disqualified if :

• The vendor fails to add the candidate to competitive solicitation, or RFR, in the DIR ITSAC Portal.
• Another vendor submits the same candidate for the same competitive solicitation, also known as a request of resume (RFR).
• The vendor submits more than one candidate for the same competitive solicitation, or RFR.
• The vendor submits a candidate after the response period for a competitive solicitation, or RFR.
• The vendor fails to format the email subject line properly, when submitting a candidate for a competitive solicitation, or RFR: Proper Formatting: Solicitation Number, Vendor Name, Candidate First and Last Name, Position Type and Level Example: , Sanders Technologies, Jane Doe, Project Lead
• The vendor fails to follow any other instructions noted in the competitive solicitation, or RFR.

Initial Purchase Order Term:

Any Purchase Order resulting from this Request for Resumes is effective on the date of issuance and expires on the last day of the State fiscal year in which the Purchase Order was issued, unless sooner stated in the Purchase Order or unless sooner terminated, renewed, or extended as provided in the Purchase Order.

Renewal Option(s):

HHSC, at its sole discretion, may renew the Purchase Order for up to three, one-year optional renewals. Such renewal(s), if exercised, shall be subject to all the requirements and terms and conditions of the Purchase Order.