{"id":112975,"url":"https://alion.io/job/allegiant-principal-engineer-devsecops","title":"Principal Engineer, DevSecOps","company":{"id":4864,"name":"Allegiant Travel Company","domain":"allegiantgroup.info","url":"https://alion.io/company/allegiant","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":82,"open_postings":11,"ghost_share":0,"stale_share":0.727,"repost_share":0,"time_to_fill_p50_days":33,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Las Vegas, United States","Saint Paul, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":153000,"max":194600,"currency":"USD","period":"year","gross":null,"usd_annual":194600},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Checkmarx","optional":false},{"name":"Checkov","optional":false},{"name":"CI/CD","optional":false},{"name":"CodeQL","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"Dependabot","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"Jira","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"PCI DSS","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"SIEM","optional":false},{"name":"Snyk","optional":false},{"name":"Terraform","optional":false},{"name":"tfsec","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Tool Use","optional":false},{"name":"Veracode","optional":false},{"name":"Wiz","optional":false},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-05-26T14:54:43Z","employer_posted_date":"2026-05-26","last_verified_at":"2026-10-16T23:49:29Z","board_verified":true,"closed_at":null,"days_open":143,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":142},"description":"Short Description\nThe Principal Engineer, Information Security (DevSecOps) is the technical lead for Allegiant's DevSecOps program. This person owns the security tooling, policies, and automation that protect code, infrastructure, and cloud workloads as they move through CI/CD pipelines into production.\nThis is not a generalist security role. The principal engineer must have production experience across four disciplines simultaneously: application security, pipeline engineering, cloud infrastructure, and infrastructure-as-code (IaC) governance. The role also requires working knowledge of securing agentic AI workflows, including MCP server governance, AI gateway configuration, and trust boundaries for tool-using AI systems. The role requires someone who has shipped security tooling that development teams actually adopted, not just evaluated or recommended.\nThe principal engineer leads a team of two mid-level engineers, unblocks technical problems, reviews architecture decisions, and drives delivery against committed program objectives. This person reports to the Senior Manager of Information Security Engineering and works closely with DevOps, Full Stack Engineering, and Security Governance. Allegiant is modernizing its web applications, expanding into new customer channels, and integrating a recent acquisition. Each of these increases the volume of code and infrastructure flowing through pipelines.\nThis role ensures security keeps pace with that velocity. This role prepares the principal engineer for future promotion tracks including Architect I and Manager I.\nSummary\nDevSecOps Principal Engineer Key Duties:\nProven and demonstrable ability to lead at least two other team members in an official capacity towards specific DevSecOps outcomes.\nLead the DevSecOps team (two engineers) in daily execution, weekly syncs, and PI planning. Ensure stories are accurate, scoped, and deliverable.\nOwn and drive the DevSecOps roadmap across pipeline security, IaC policy enforcement, application security tooling, and cloud security posture management.\nEmbedding threat modeling into pipelines and workflows to provide real-time analysis of architectural changes in products.\nArchitect and maintain security gates in GitHub Actions CI/CD pipelines. Define when and how scans run, what blocks a merge, and how results route to developers.\nAdminister GitHub Advanced Security across the organization: CodeQL query suites, secret scanning policies, Dependabot configuration, and developer-facing campaign management.\nAuthor and deploy Checkov custom policies for Terraform IaC scanning. Drive golden policy adoption from current 25% pipeline coverage toward 75%+ with hard-fail enforcement.\nOperate and configure Palo Alto Prisma or Cortex (CNAPP) for cloud security posture, image scanning, and AppSec integration.\nManage Terraform-based infrastructure security across multi-account AWS environments using Control Tower, IAM, VPC, and Transit Gateway.\nIntegrate security tooling outputs into SIEM and SOAR for alerting, triage, and response workflows.\nMentor two mid-level engineers. Identify skills gaps, provide hands-on training, and review their work.\nCollaborate with Security Governance to produce compliance evidence for PCI-DSS, NIST, and CIS controls derived from DevSecOps tooling.\nSupport acquisition security assessments by evaluating incoming technology stacks against Allegiant's IaC and pipeline security standards.\nDefine and enforce security governance for agentic AI tooling, including MCP server registries, gateway configurations, and trust policies for AI-to-tool interactions.\nDocument architecture decisions, policy rationale, and runbooks. Maintain documentation quality standards across the DevSecOps team.\nParticipate in SAFe Agile planning. Maintain strong Jira hygiene. Assist security leadership in backlog prioritization and capacity negotiation with product owners.\nPipeline security engineering: Production experience building and maintaining security scanning stages in CI/CD pipelines. Must demonstrate pipelines they have built that run in production today, not proofs of concept. GitHub Actions is required.\nApplication security tooling at scale: Hands-on administration of GitHub Advanced Security or equivalent (Snyk, Veracode, Checkmarx) in an organization with 50+ repositories. Must show evidence of driving developer adoption of scan results, not just enabling tools.\nInfrastructure-as-code policy: Experience writing and enforcing custom Checkov policies (or Bridgecrew, tfsec, Sentinel) against Terraform codebases. Must be able to describe policies they authored and the compliance or security outcomes those policies enforced.\nCloud infrastructure security: Deep working knowledge of AWS security constructs: Control Tower, IAM (including ABAC patterns), VPC architecture, Transit Gateway, and multi-account strategies. Must have operated these in production, not just designed them.\nCNAPP operations: Experience operating a cloud-native application protection platform (Palo Alto Cortex Cloud preferred, Prisma Cloud, Wiz, or Orca acceptable). Must describe onboarding workflows, policy tuning, and integration with engineering teams.\nDelivery track record: Candidates must provide specific examples of security tooling they shipped that was adopted by development teams. \"Evaluated,\" \"assessed,\" or \"recommended\" do not count. We need builders who finish.\nAI security and MCP governance: Demonstrated experience securing agentic AI workflows: MCP server trust boundaries, AI gateway configuration, prompt injection mitigation, or tool-use authorization policies. Candidates should be able to point to public work (GitHub repositories, blog posts, conference talks, or open-source contributions) showing hands-on engagement with AI security, not just awareness of the topic.\nCommunication and mentorship: Able to coach junior and mid-level engineers through hands-on pairing, clear documentation, and direct feedback. Comfortable presenting architecture decisions to security leadership and engineering stakeholders.\nVisa Sponsorship Available\nNo\nMinimum Requirements\nCombination of Education and Experience will be considered. Must be authorized to work in the US as defined by the Immigration Act of 1986. Must pass a Criminal Background Check.\nEducation: Bachelor’s Degree or equivalent experience.\nCertification: Technical certifications or equivalents, CISSP is optional.\nYears of Experience:\nMinimum eight (8) years experience in information security.\nMinimum eight (8) years supporting / implementing network security platforms & strategies.\nPreferred Requirements\nHas production experience across all four domains: application security, pipeline engineering, cloud infrastructure security, and IaC governance. Can demonstrate work in each, not just one or two.\nHas administered GitHub Advanced Security (CodeQL, secret scanning, Dependabot) for an organization with active developer adoption metrics.\nHas authored custom Checkov or equivalent IaC policies that enforced specific compliance or security outcomes in production pipelines.\nHas operated a CNAPP platform (Palo Alto Cortex Cloud, Prisma Cloud, Wiz, or Orca) including onboarding, policy configuration, and integration with engineering workflows.\nHas integrated security scan outputs into a SIEM and SOAR (Cortex XSOAR preferred) platform.\nHas experience with Cloud Custodian or similar cloud governance automation.\nHas gathered compliance evidence from automated tooling for PCI-DSS, NIST, or CIS audits.\nHas led or mentored a small engineering team (2-5 engineers).\nHas hands-on experience securing agentic AI systems: MCP server configuration, AI gateway trust policies, tool-use authorization, or prompt injection controls. Can point to public artifacts (GitHub repos, blog posts, talks, open-source work) demonstrating this experience.\nCan provide references or artifacts demonstrating security tooling adopted by development teams in production.\nJob Duties\nProvide technical leadership to the DevSecOps team daily and during PI planning.\nLead the DevSecOps team in weekly syncs to track program progress, remove blockers, and adjust priorities.\nAdvises the IT organization towards adoption of standards and influences security security culture-setting the tone and expectations for secure SDLC.\nOwn GitHub Advanced Security administration: manage CodeQL query suites, configure secret scanning policies, tune Dependabot alerts, and run developer adoption campaigns.\nBuild, maintain, and enforce security scanning stages in GitHub Actions pipelines across the organization.\nAuthor custom Checkov policies for Terraform IaC. Drive golden policy deployment across all pipelines toward hard-fail enforcement.\nOperate and configure Cortex Cloud (CNAPP) for cloud workload protection, image scanning, and application security posture.\nManage Terraform-based security infrastructure across multi-account AWS environments (Control Tower, IAM, VPC, Transit Gateway).\nIntegrate DevSecOps tooling outputs into SIEM and Cortex XSOAR (SOAR) for detection, alerting, and automated response.\nCollaborate with Security Governance to generate and validate compliance evidence from automated tooling for PCI-DSS, NIST, and CIS.\nEvaluate incoming technology stacks from acquisitions against Allegiant's pipeline and IaC security standards.\nDocument architecture decisions, security policies, and operational runbooks. Maintain team documentation standards.\nIdentify skills gaps on the DevSecOps team. Provide training, pair on complex work, and review output from junior and mid-level engineers.\nWork with DevOps and Full Stack Engineering to ensure security gates are adopted, not circumvented. Measure and report on developer adoption.\nMaintain SAFe Agile practices. Keep Jira hygiene current. Assist security leadership with story sizing, capacity planning, and backlog negotiation.\nPromote awareness of DevSecOps program objectives during PI planning and cross-team syncs.\nRecommend and implement efficiencies for security alerting, triage workflows, and operational intake.\nDefine and maintain security controls for agentic AI tooling: MCP trusted server registries, gateway configurations, tool-use authorization policies, and usage standards.\nTroubleshoot and resolve escalated security tooling issues across pipelines, cloud infrastructure, and application scanning.\nSupport the security manager in long-range planning, roadmap development, and team growth strategy.\nOther duties as assigned.\nPhysical Requirements\nThe Physical Demands and Work Environment described here are a representative of those that must be met by a Team Member to successfully perform the essential functions of the role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the role.\nOffice/IT - While performing the duties of this job, the Team Member is regularly required to stand, sit, talk, hear, see, reach, stoop, kneel, and use hands and fingers to operate a computer, key board, printer, and phone. May be required to lift, push, pull, or carry up to 50 lbs. May be required to work various shifts/days in a 24 hour situation. Regular attendance is a requirement of the role. Exposure to moderate noise (i.e. business office with computers, phones, printers, and foot traffic), temperature and light fluctuations. Ability to work in a confined area as well as the ability to sit at a computer terminal for an extended period of time. Some travel may be a requirement of the role.\nEssential Services Provider\nAllegiant as a national air carrier is deemed an essential service provider during declared national and state emergencies. Team Members will be required to report to their assigned trip or work location during national and state emergencies unless prohibited by local, state or federal order.\nEEO Statement\nWe welcome all individuals from varied backgrounds and experiences to apply. Our company values the unique perspe...","description_format":"text","description_chars":12154,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Hotels & Resorts","Air Transport","Commercial Aviation"],"lifecycle":[{"event":"open","at":"2026-05-26T14:54:43Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":207500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.3,"p_room":0.28,"age_days":142,"expected_fill_days":33,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-10-16T05:45:00Z"},"pay":{"stated_usd_annual":194600,"is_top_pay":true},"html_url":"https://alion.io/job/allegiant-principal-engineer-devsecops","json_url":"https://alion.io/job/allegiant-principal-engineer-devsecops.json","meta":{"generated_at":"2026-10-17T01:02:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1450,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4864},"rest":"https://alion.io/mcp/rest/get_company?id=4864"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fallegiant-principal-engineer-devsecops"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fallegiant-principal-engineer-devsecops"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fallegiant-principal-engineer-devsecops"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/allegiant-principal-engineer-devsecops\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fallegiant-principal-engineer-devsecops"}]}