Dev Sec Ops Engineer

Responsibilities

• Own technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.
• Drive vulnerability remediation end to end: triage, prioritize, and automate fixes, partnering with the rest of the DevOps team on production rollout.
• Build automated scanning and remediation into our pipelines.
• Tune WAF policies and the OWASP Core Rule Set to protect public-facing applications without blocking legitimate traffic.
• Run PCI DSS vulnerability scanning, including quarterly external ASV scans, and drive remediation of findings.
• Contribute to incident response planning and exercises, and ensure backups and recovery processes meet security requirements for encryption, access, and integrity.
• Produce and automate evidence for technical controls, and keep our cloud environments connected to our compliance platform (Drata).
• Serve as technical expert for audits, customer security reviews, and vendor assessments involving sensitive data.

Requirements

• 3+ years in DevSecOps, security engineering, cloud security, or a closely related role
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS)
• Least-privilege access management across cloud services (IAM, RBAC)
• Working Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images
• Scripting in Python, Bash, or similar
• Clear written communication with both technical and non-technical audiences

Preferred

• Low-downtime patching approaches (rolling updates, blue/green, live patching such as kpatch or Livepatch)
• PCI ASV scanning with Tenable or a comparable platform
• Drata or a similar compliance automation platform
• Serverless platforms (Cloud Run, Cloud Functions, AWS Lambda)
• Cloud security posture tools such as ScoutSuite or Mondoo
• Contributing to third-party risk reviews involving PII
• Agentic or AI-assisted penetration testing
• Certifications such as OSCP, CISSP, CISM, or AWS/GCP Security Specialty

About the Team

We’re a small DevOps team supporting the whole Engineering organization, building applications on top of GCP and AWS. We own all aspects of the SDLC but strive to automate self-service wherever possible. Being a small team, we also practice SRE, continuously improving our observability and building with Infrastructure-as-Code. Security and compliance best practices are integral to our workflows, ensuring systems are secure by design and meet regulatory and organizational standards. Our team is remote but highly organized to meet the demand of a fast-paced environment. Our primary business language is English, and we emphasize strong communication skills.

About You

You're a security-minded engineer who's as comfortable in a Kubernetes cluster or CI/CD pipeline as you are explaining a control to an auditor. You own remediation end to end, like automating away repetitive security work, and are energized by helping a growing company scale security without slowing the business down.

Requirements

• Container and vulnerability management, including building automated remediation (tools such as Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP)
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar)
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar)
• Experience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls

Nice to Haves

Peek Travel Inc. is an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, veteran status, disability, or other legally protected status.

If you are unable to apply due to incompatible assistive technology or a disability, please contact us at talent@peek.com. We will make every effort to respond to your request for disability assistance as soon as possible.