DevSecOps Engineer

About the role

Peek, an AI-powered booking platform for museums, attractions and tours, is looking for a hands-on DevSecOps Engineer to embed security into its infrastructure, CI/CD pipelines and cloud environment. The role owns the technical controls and evidence needed to stay PCI DSS 4.0 and SOC 2 Type II compliant, drives vulnerability remediation across the container and VM fleet, and builds the disaster recovery testing program. It suits someone who moves between technical remediation, audit-facing documentation and cross-functional work with engineering, IT and procurement. The team is 100% remote, prefers candidates in the same time zones as the greater United States (UTC-10 to UTC-4), and may occasionally need work outside normal hours.

Key responsibilities

• Own technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.
• Drive vulnerability remediation end to end: triage, prioritize and automate fixes, partnering with the DevOps team on production rollout.
• Build automated scanning and remediation into the pipelines, tune WAF policies and the OWASP Core Rule Set, and run PCI DSS vulnerability scanning including quarterly external ASV scans.
• Contribute to incident response planning and exercises, and ensure backups and recovery meet encryption, access and integrity requirements.
• Produce and automate evidence for technical controls, connect cloud environments to the compliance platform (Drata), and act as technical expert for audits, customer security reviews and vendor assessments.

Required profile

• 3+ years in DevSecOps, security engineering, cloud security or a closely related role.
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS).
• Experience in a PCI DSS or SOC 2 environment, including producing evidence for technical controls.
• Clear written communication with technical and non-technical audiences.

Required skills

• Container and vulnerability management with automated remediation (e.g. Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP)
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare or similar)
• Least-privilege access management (IAM, RBAC)
• Linux knowledge to remediate OS and package vulnerabilities in VMs and container images
• Scripting in Python, Bash or similar
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh or similar)