[Hiring] Mid Dev Sec Ops Engineer @Peek

Role Description

We're looking for a hands-on DevSecOps Engineer to embed security into our infrastructure, CI/CD pipelines, and cloud environment. You'll own the technical controls and evidence that keep us PCI DSS 4.0 and SOC 2 Type II compliant, drive vulnerability remediation across our container and VM fleet, and build out the disaster recovery testing program. This is a role for someone who's comfortable moving between hands-on technical remediation, audit-facing documentation, and cross-functional work with engineering, IT, and procurement.

Our team is 100% remote, however, we prefer candidates in the same time zones as the greater United States (UTC-10 to UTC-4). We will occasionally require you to work outside of normal business hours on infrastructure upgrades and maintenance. We are committed to working with you to keep a healthy and balanced schedule.

What You'll Do

• Own technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.
• Drive vulnerability remediation end to end: triage, prioritize, and automate fixes, partnering with the rest of the DevOps team on production rollout.
• Build automated scanning and remediation into our pipelines.
• Tune WAF policies and the OWASP Core Rule Set to protect public-facing applications without blocking legitimate traffic.
• Run PCI DSS vulnerability scanning, including quarterly external ASV scans, and drive remediation of findings.
• Contribute to incident response planning and exercises, and ensure backups and recovery processes meet security requirements for encryption, access, and integrity.
• Produce and automate evidence for technical controls, and keep our cloud environments connected to our compliance platform (Drata).
• Serve as technical expert for audits, customer security reviews, and vendor assessments involving sensitive data.

Qualifications

• 3+ years in DevSecOps, security engineering, cloud security, or a closely related role.
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS).
• Container and vulnerability management, including building automated remediation (tools such as Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP).
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar).
• Least-privilege access management across cloud services (IAM, RBAC).
• Working Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images.
• Scripting in Python, Bash, or similar.
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar).
• Experience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls.
• Clear written communication with both technical and non-technical audiences.

Nice to Haves

• Low-downtime patching approaches (rolling updates, blue/green, live patching such as kpatch or Livepatch).
• PCI ASV scanning with Tenable or a comparable platform.
• Drata or a similar compliance automation platform.
• Serverless platforms (Cloud Run, Cloud Functions, AWS Lambda).
• Cloud security posture tools such as ScoutSuite or Mondoo.
• Contributing to third-party risk reviews involving PII.
• Agentic or AI-assisted penetration testing.
• Certifications such as OSCP, CISSP, CISM, or AWS/GCP Security Specialty.

Company Description

Peek is the operating system powering the experiences industry - from museums and attractions to tours and activities. With over $7B in bookings, Peek’s AI-powered platform has helped thousands of merchants to increase revenues, save time, and deliver seamless guest experiences. Customers include MoMA, Whitney Museum, Seattle Aquarium, Bryant Park & Looping Group. The company has raised over $150 million from institutional investors Westcap, Goldman Sachs, and SpringCoast Partners.

As a remote-first company recognized by Forbes as one of America's Best Startup Employers and by Built In as a 2025 and 2026 Best Place to Work, we are a global team of "Peeksters" who "Obsess Over Our Customers," "Accomplish Big Things," "Collaborate With Purpose," and "Get Better Every Day."