{"id":1119696,"url":"https://alion.io/job/peek-mid-dev-sec-ops-engineer","title":"Dev Sec Ops Engineer","company":{"id":171889,"name":"Peek","domain":"peek.com","url":"https://alion.io/company/peek-2","size_band":"11-50","is_staffing_agency":false,"is_intermediary":false,"ats_vendor":"Ashby","truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["MX"],"hiring_countries_total":1,"salary":{"min":75000,"max":85000,"currency":"MXN","period":"month","gross":null,"usd_annual":58668},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"AWS WAF","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Cloudflare","optional":false},{"name":"GCP","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Google GKE","optional":false},{"name":"IAM","optional":false},{"name":"Jenkins","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"OWASP","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"Trivy","optional":false},{"name":"AI Agents","optional":true},{"name":"AWS Lambda","optional":true},{"name":"Google Cloud Run","optional":true},{"name":"ScoutSuite","optional":true}],"status":"live","first_seen_at":"2026-09-22T16:46:41Z","employer_posted_date":"2026-09-22","last_verified_at":"2026-09-24T08:37:01Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Peek is the operating system powering the experiences industry - from museums and attractions to tours and activities. With over $7B in bookings, Peek’s AI-powered platform has helped thousands of merchants to increase revenues, save time, and deliver seamless guest experiences. Customers include MoMA, Whitney Museum, Seattle Aquarium, Bryant Park & Looping Group. The company has raised over $150 million from institutional investors Westcap, Goldman Sachs, and SpringCoast Partners. Learn more at www.peek.com.\nAs a remote-first company recognized by Forbes as one of America's Best Startup Employers and by Built In as a 2025 and 2026 Best Place to Work, we are a global team of \"Peeksters\" who \"Obsess Over Our Customers,\" \"Accomplish Big Things,\" \"Collaborate With Purpose,\" and \"Get Better Every Day.\nWe're looking for a hands-on DevSecOps Engineer to embed security into our infrastructure, CI/CD pipelines, and cloud environment. You'll own the technical controls and evidence that keep us PCI DSS 4.0 and SOC 2 Type II compliant, drive vulnerability remediation across our container and VM fleet, and build out the disaster recovery testing program. This is a role for someone who's comfortable moving between hands-on technical remediation, audit-facing documentation, and cross-functional work with engineering, IT, and procurement.\nOur team is 100% remote, however, we prefer candidates in the same time zones as the greater United States (UTC-10 to UTC-4).\nWe will occasionally require you to work outside of normal business hours on infrastructure upgrades and maintenance. We are committed to working with you to keep a healthy and balanced schedule.\nAbout the Team\nWe’re a small DevOps team supporting the whole Engineering organization, building applications on top of GCP and AWS. We own all aspects of the SDLC but strive to automate self-service wherever possible. Being a small team, we also practice SRE, continuously improving our observability and building with Infrastructure-as-Code. Security and compliance best practices are integral to our workflows, ensuring systems are secure by design and meet regulatory and organizational standards. Our team is remote but highly organized to meet the demand of a fast-paced environment. Our primary business language is English, and we emphasize strong communication skills.\nAbout You\nYou're a security-minded engineer who's as comfortable in a Kubernetes cluster or CI/CD pipeline as you are explaining a control to an auditor. You own remediation end to end, like automating away repetitive security work, and are energized by helping a growing company scale security without slowing the business down.\nWhat You'll Do\nOwn technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.\n\nDrive vulnerability remediation end to end: triage, prioritize, and automate fixes, partnering with the rest of the DevOps team on production rollout.\n\nBuild automated scanning and remediation into our pipelines.\n\nTune WAF policies and the OWASP Core Rule Set to protect public-facing applications without blocking legitimate traffic.\n\nRun PCI DSS vulnerability scanning, including quarterly external ASV scans, and drive remediation of findings.\n\nContribute to incident response planning and exercises, and ensure backups and recovery processes meet security requirements for encryption, access, and integrity.\n\nProduce and automate evidence for technical controls, and keep our cloud environments connected to our compliance platform (Drata).\n\nServe as technical expert for audits, customer security reviews, and vendor assessments involving sensitive data.\n\nRequirements\n3+ years in DevSecOps, security engineering, cloud security, or a closely related role\n\nHands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS)\n\nContainer and vulnerability management, including building automated remediation (tools such as Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP)\n\nWAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar)\n\nLeast-privilege access management across cloud services (IAM, RBAC)\n\nWorking Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images\n\nScripting in Python, Bash, or similar\n\nCI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar)\n\nExperience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls\n\nClear written communication with both technical and non-technical audiences\n\nNice to Haves\nLow-downtime patching approaches (rolling updates, blue/green, live patching such as kpatch or Livepatch)\n\nPCI ASV scanning with Tenable or a comparable platform\n\nDrata or a similar compliance automation platform\n\nServerless platforms (Cloud Run, Cloud Functions, AWS Lambda)\n\nCloud security posture tools such as ScoutSuite or Mondoo\n\nContributing to third-party risk reviews involving PII\n\nAgentic or AI-assisted penetration testing\n\nCertifications such as OSCP, CISSP, CISM, or AWS/GCP Security Specialty\n\nPeek Travel Inc. is an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, veteran status, disability, or other legally protected status.\nIf you are unable to apply due to incompatible assistive technology or a disability, please contact us at . We will make every effort to respond to your request for disability assistance as soon as possible.","description_format":"text","description_chars":5644,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Mexico","iso":"MX","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Travel & Tourism","Travel Technology"],"lifecycle":[{"event":"open","at":"2026-09-22T18:18:45Z"}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":7,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-09-24T05:45:00Z"},"pay":{"stated_usd_annual":58668,"is_top_pay":false},"html_url":"https://alion.io/job/peek-mid-dev-sec-ops-engineer","json_url":"https://alion.io/job/peek-mid-dev-sec-ops-engineer.json","meta":{"generated_at":"2026-09-24T08:39:24Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers"}}