Dev Sec Ops Engineer

The role

You will embed security into infrastructure, CI/CD pipelines, and cloud environments. You will own technical controls for PCI DSS 4.0 and SOC 2 Type II compliance and drive vulnerability remediation across container and VM fleets.

What you will do

• Own technical security controls across GCP and AWS
• Drive vulnerability remediation end to end
• Build automated scanning and remediation into pipelines
• Tune WAF policies and the OWASP Core Rule Set
• Run PCI DSS vulnerability scanning and drive remediation
• Contribute to incident response planning and exercises
• Produce and automate evidence for technical controls
• Serve as technical expert for audits, customer security reviews, and vendor assessments

Required qualifications

• 3+ years in DevSecOps, security engineering, cloud security, or a closely related role
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS)
• Container and vulnerability management, including building automated remediation (tools such as Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP)
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar)
• Least-privilege access management across cloud services (IAM, RBAC)
• Working Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images
• Scripting in Python, Bash, or similar
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar)
• Experience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls
• Clear written communication with both technical and non-technical audiences

Nice to have

• Low-downtime patching approaches (rolling updates, blue/green, live patching such as kpatch or Livepatch)
• PCI ASV scanning with Tenable or a comparable platform
• Drata or a similar compliance automation platform
• Serverless platforms (Cloud Run, Cloud Functions, AWS Lambda)
• Cloud security posture tools such as ScoutSuite or Mondoo
• Contributing to third-party risk reviews involving PII
• Agentic or AI-assisted penetration testing
• Certifications such as OSCP, CISSP, CISM, or AWS/GCP Security Specialty

About the company

Peek is the operating system powering the experiences industry. Its AI-powered platform helps merchants increase revenues and deliver guest experiences.