Remote DevSecOps Engineer: Secure Cloud & Compliance

Openkrill; United States; A distancia; USD 120.000 - 180.000; Jornada completa

Descripción de la vacante

Peek Travel Inc. is seeking a hands-on DevSecOps Engineer to embed security into our infrastructure, CI/CD pipelines, and cloud environment. You will ensure PCI DSS 4.0 and SOC 2 Type II compliance, lead vulnerability remediation, and develop a disaster recovery testing program.

This remote-first role may require occasional non-standard hours for upgrades. We operate 100% remotely with a preference for candidates in US time zones.

Formación

• 3+ years in DevSecOps, security engineering, cloud security, or a closely related role.
• Hands-on experience securing GCP and/or AWS, including managed Kubernetes (GKE, EKS).
• Container and vulnerability management, including building automated remediation (Trivy, AWS Inspector, ECR scanning, GCP Artifact Analysis, ZAP).
• WAF configuration and OWASP Core Rule Set tuning (Cloud Armor, AWS WAF, Cloudflare, or similar).
• Least-privilege access management across cloud services (IAM, RBAC).
• Working Linux knowledge sufficient to remediate OS and package vulnerabilities in VMs and container images
• Scripting in Python, Bash, or similar
• CI/CD experience (GitLab CI, GitHub Actions, Jenkins, Codefresh, or similar)
• Experience working in a PCI DSS or SOC 2 environment, including producing evidence for technical controls

Responsabilidades

• Own technical security controls across GCP and AWS: least-privilege IAM and RBAC, WAF, container and image security, and secure CI/CD.
• Drive vulnerability remediation end to end: triage, prioritize, and automate fixes, partnering with the rest of the DevOps team on production rollout.
• Build automated scanning and remediation into our pipelines.
• Tune WAF policies and the OWASP Core Rule Set to protect public-facing applications without blocking legitimate traffic.
• Run PCI DSS vulnerability scanning, including quarterly external ASV scans, and drive remediation of findings.
• Contribute to incident response planning and exercises, and ensure backups and recovery processes meet security requirements for encryption, access, and integrity.
• Produce and automate evidence for technical controls, and keep our cloud environments connected to our compliance platform (Drata).
• Serve as technical expert for audits, customer security reviews, and vendor assessments involving sensitive data.

Conocimientos

DevSecOps

Cloud security

Kubernetes

GCP

AWS

IAM/RBAC

Python/Bash

CI/CD

Audits

WAF

Herramientas

Trivy

AWS Inspector

Amazon ECR scanning

GCP Artifact Analysis

ZAP

Cloud Armor

Tenable

Drata

GitLab CI

GitHub Actions

Jenkins

Codefresh

Descripción del empleo

Peek Travel Inc. is seeking a hands-on DevSecOps Engineer to embed security into our infrastructure, CI/CD pipelines, and cloud environment. You will ensure PCI DSS 4.0 and SOC 2 Type II compliance, lead vulnerability remediation, and develop a disaster recovery testing program.

This remote-first role may require occasional non-standard hours for upgrades. We operate 100% remotely with a preference for candidates in US time zones.