A security assessment in 2017 should be part of the ongoing DevOps cycle in any organization today. As DevOps is focused on continuous integration (CI) and continuous delivery/deployment (CD), security assessments (and QA for that matter) should be conducted regularly to maximize positive outcomes for your clients' end-users.
This makes a "security assessment" as an "event" irrelevant, as server or app security is constantly being implemented, improved, and checked.
For instance, starting with security in mind, you can ensure new API endpoints require proper authentication as developers add them, instead of waiting until a data breach and then doing a large audit of everything to fix security holes. This is something that a "security assessment" might uncover later, except when it's more costly or less time-effective to implement.
It’s about automating as much of your IT security processes as possible and cutting down on wasted time later in the feedback loop. Additionally, security personnel needs to be involved in the development process, helping to plan system architecture along the way. They will generally be eager to get involved as well.
More about implementing security into an agile DevOps process so it isn't an annual "assessment". For more details check here.
Disclosure: The above link is from our own blog.
Continuous Security: Implementing the Critical Controls in a DevOps Environment (PDF)