Dev Sec Ops Engineer - Peek

About Peek

Peek is the operating system powering the experiences industry - from museums and attractions to tours and activities. With over $7B in bookings, Peek’s AI-powered platform has helped thousands of merchants to increase revenues, save time, and deliver seamless guest experiences. Customers include MoMA, Whitney Museum, Seattle Aquarium, Bryant Park & Looping Group. The company has raised over $150 million from institutional investors Westcap, Goldman Sachs, and SpringCoast Partners.

As a remote-first company recognized by Forbes as one of America's Best Startup Employers and by Built In as a 2025 and 2026 Best Place to Work, we are a global team of "Peeksters" who obsess over customers, accomplish big things, collaborate with purpose, and get better every day.

We're looking for a hands-on DevSecOps Engineer to embed security into our infrastructure, CI/CD pipelines, and cloud environment. You'll own technical controls and evidence for PCI DSS 4.0 and SOC 2 Type II compliance, drive vulnerability remediation across container and VM fleets, and build out our disaster recovery testing program.

Note: We will occasionally require you to work outside of normal business hours on infrastructure upgrades and maintenance, while maintaining a healthy schedule.

About the Team

We’re a small DevOps team supporting the entire Engineering organization, building applications on top of GCP and AWS. We own all aspects of the SDLC and automate self-service wherever possible. Being a small team, we also practice SRE, continuously improving observability and building with Infrastructure-as-Code. Our primary business language is English, and we emphasize strong communication skills.

What You'll Do

• Own technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.
• Drive vulnerability remediation end to end: triage, prioritize, and automate fixes, partnering with the DevOps team on production rollouts.
• Build automated scanning and remediation into CI/CD pipelines.
• Tune WAF policies and the OWASP Core Rule Set to protect public-facing applications without impacting legitimate traffic.
• Run PCI DSS vulnerability scanning, including quarterly external ASV scans, and drive remediation of findings.
• Contribute to incident response planning and exercises, ensuring backups and recovery meet security requirements for encryption, access, and integrity.
• Produce and automate evidence for technical controls, maintaining connections between cloud environments and our compliance platform (Drata).
• Serve as the technical expert for audits, customer security reviews, and vendor assessments involving sensitive data.

Requirements

• 3+ years of experience in DevSecOps, security engineering, cloud security, or a closely related role.
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS).
• Experience with container and vulnerability management, including building automated remediation (e.g., Trivy, AWS Inspector, Amazon ECR scanning, GCP Artifact Analysis, ZAP).
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar).
• Least-privilege access management across cloud services (IAM, RBAC).
• Working Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images.
• Scripting proficiency in Python, Bash, or similar languages.
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar).
• Experience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls.
• Clear written communication skills with both technical and non-technical audiences.

Nice to Haves

• Low-downtime patching approaches (rolling updates, blue/green, live patching such as kpatch or Livepatch).
• PCI ASV scanning with Tenable or a comparable platform.
• Experience with Drata or similar compliance automation platforms.
• Serverless platforms (Cloud Run, Cloud Functions, AWS Lambda).
• Cloud security posture tools such as ScoutSuite or Mondoo.
• Experience contributing to third-party risk reviews involving PII.
• Familiarity with agentic or AI-assisted penetration testing.
• Industry certifications such as OSCP, CISSP, CISM, or AWS/GCP Security Specialty.