Senior DevSecOps / Site Reliability Engineer (GCP)

Lumenalta; Mexico; On-site; MXN 1,525,000 - 2,373,000; Full time

Job summary

Lumenalta seeks a Senior DevSecOps / SRE Engineer for a fully remote LATAM role. You will mature security posture across a high-traffic digital platform on GCP, wiring security into CI/CD, tightening IAM, and hardening edge security with Fastly.

Expect ownership from day one and cross-functional collaboration with security, SRE, and platform teams. You’ll deploy on Cloud Run, enhance observability with New Relic and GCP tooling, and implement just-in-time access via PAM.

Qualifications

• Production GCP experience in live environments.
• Senior DevSecOps or security-focused SRE background with high-traffic platforms.
• Security in CI/CD: vulnerability scanning, policy gates, secret scanning, branch protections.
• Experience with Wiz or similar CNAPP (Prisma Cloud, Aqua, Snyk).
• GCP IAM least privilege: review/remediate service accounts, roles, bindings.
• Terraform for GCP provisioning with least privilege constraints.
• Fastly WAF/edge security: configure rules, rate limiting, edge authentication.
• Cloud Run: deploy/operate containerized workloads.
• Observability/alerting: New Relic and/or GCP tooling for SRE signals.
• Familiarity with IaC security, drift detection, and multi-hat roles.

Responsibilities

• Wire security scanning into CI/CD pipelines before merge.
• Review and harden GCP IAM configurations for least privilege.
• Configure and maintain Fastly WAF rules and edge security.
• Assist with Google Cloud PAM implementation and just-in-time access.
• Own and extend Terraform IaC for GCP provisioning.
• Support Cloud Run workloads across the platform.
• Implement and maintain observability and alerting with New Relic/GCP tooling.
• Contribute broadly across SRE functions and on-call support.
• Execute Jira tickets with strong ownership from day one.

Skills

GCP ownership

DevSecOps/SRE

CI/CD security

CNAPP tooling

IAM least privilege

Terraform

Waf/edge security

Cloud Run

Observability

Cross-functional ownership

Tools

Wiz

Prisma Cloud

Aqua

Snyk

GitHub Actions

GitLab CI

Terraform

New Relic

Job description

At Lumenalta, we partner with forward-thinking organizations to build technology solutions that scale, delight users, and accelerate business growth. Our global teams bring curiosity, commitment, and technical excellence to every project. We value transparency, autonomy, and impact- empowering every team member to do their best work.

We’re seeking a Senior DevSecOps / SRE Engineer to support a high-traffic, mission-driven digital platform running on GCP. This is a senior, hands-on DevSecOps role focused on maturing the client’s security posture while contributing broadly across the platform and SRE function. You’ll ship from day one - wiring security into the CI/CD pipeline, hardening cloud access and identity, and helping keep a high-traffic platform reliable and secure.

Actively Hiring

We are hiring for a current opening on an active client project. This is a specific, presently open role. We review applications on a rolling basis and aim to move qualified candidates through our process promptly.

What You’ll Be Doing

• Wire security scanning into CI/CD pipelines before merge - standing up automated vulnerability management, policy-enforcement gates, secret scanning, and branch protections (with Wiz, the platform's CNAPP) so issues are caught before they reach production.
• Review and harden GCP IAM configurations for least privilege - identifying over-permissioned users, service accounts, roles, and bindings across the platform, and remediating them through Terraform.
• Configure and maintain Fastly WAF rules targeting scraping, abuse, and edge-level threats - including rate limiting, edge authentication, and traffic shaping to protect platform integrity.
• Assist with Google Cloud PAM (Privileged Access Management) implementation - establishing just-in-time access workflows and reducing standing privileges across the environment.
• Own and extend IaC (Terraform) for GCP provisioning - ensuring changes are version-controlled, reviewed, and applied with security and least privilege as first-order constraints.
• Support Cloud Run workloads across the platform - contributing to the deployment, observability, and reliability of containerized services without deep Kubernetes overhead.
• Implement and maintain observability and alerting using New Relic and GCP-native tooling - keeping incident detection, SLO tracking, and reliability signals in place and actionable.
• Contribute broadly across SRE functions - incident response, on-call support, reliability improvements, and platform hardening - wearing multiple hats as needed within a collaborative, high-ownership team.
• Execute independently on Jira tickets from day one, operating with strong ownership and minimal ramp time in a fast-moving engineering environment.

What We’re Looking For

• Production GCP experience - hard requirement. Hands-on ownership in live GCP environments. AWS-only backgrounds do not qualify; lab or certification exposure does not substitute for production ownership.
• Senior DevSecOps or security-focused SRE background, with a track record of maturing security posture on live, high-traffic platforms.
• Security in CI/CD. Proven experience implementing vulnerability scanning, security and policy gates, secret scanning, and branch protection within CI/CD pipelines (GitHub Actions, GitLab CI, or equivalent). Experience with Wiz - or a comparable CNAPP such as Prisma Cloud, Aqua, or Snyk for vulnerability and cloud-posture management.
• GCP IAM least privilege. Deep experience reviewing and remediating IAM configurations (service accounts, roles, bindings) for least privilege.
• Production Terraform for GCP. Provisioning and IAM management in Terraform, applied with least privilege as a first-order constraint.
• Fastly WAF and edge security. Hands-on experience configuring WAF rules for scraping, abuse, and edge-level threats, plus rate limiting and edge authentication. Strong experience with a comparable CDN/WAF platform is acceptable if Fastly is not direct.
• Cloud Run. Experience deploying and operating containerized workloads on Cloud Run.
• Observability and alerting. Configuring monitoring, alerting, and SLO tracking (New Relic and/or GCP-native tooling) for reliability and incident detection.
• Familiarity with GCP Privileged Access Management for just-in-time access and standing privilege reduction.
• Broad infrastructure-as-code practice beyond Terraform-policy-as-code, drift detection, IaC security scanning.
• Understanding of CDN topology, DNS routing, and edge authentication patterns.
• Comfort in a fast-moving, high-ownership environment where engineers wear multiple hats across security, SRE, and platform.

Why Lumenalta is an amazing place to work at

At Lumenalta, you can expect that you will:

• Be 100% dedicated to one project at a time so that you can innovate and grow.
• Be a part of a team of talented and friendly senior-level developers.
• Work on projects that allow you to use leading tech.

Location:

This is a fully remote position open to candidates based in Latin America (LATAM). While location is flexible, candidates must be willing to maintain at least a 6-hour overlap with core business hours, which are primarily aligned with the Pacific, Central, or Eastern U.S. time zones to ensure effective collaboration with project teams.

Application Deadline

Applications will be accepted until September 6, 2026. Candidates can expect feedback by September 14, 2026.