Principal Engineer, DevSecOps

The Principal Engineer, Information Security (DevSecOps) is the technical lead for Allegiant's DevSecOps program. This person owns the security tooling, policies, and automation that protect code, infrastructure, and cloud workloads as they move through CI/CD pipelines into production. The principal engineer leads a team of two mid-level engineers, unblocks technical problems, reviews architecture decisions, and drives delivery against committed program objectives. This person reports to the Senior Manager of Information Security Engineering and works closely with DevOps, Full Stack Engineering, and Security Governance.

Responsibilities

Lead the DevSecOps team (two engineers) in daily execution, weekly syncs, and PI planning; Own and drive the DevSecOps roadmap across pipeline security, IaC policy enforcement, application security tooling, and cloud security posture management; Embed threat modeling into pipelines and workflows; Architect and maintain security gates in GitHub Actions CI/CD pipelines; Administer GitHub Advanced Security across the organization (CodeQL, secret scanning, Dependabot, developer campaigns); Author and deploy Checkov custom policies for Terraform IaC scanning and drive golden policy adoption toward hard-fail enforcement; Operate and configure Cortex Cloud (CNAPP) for cloud workload protection, image scanning, and AppSec posture; Manage Terraform-based security infrastructure across multi-account AWS environments; Integrate DevSecOps tooling outputs into SIEM and Cortex XSOAR; Collaborate with Security Governance on compliance evidence for PCI-DSS, NIST, and CIS; Evaluate acquisition technology stacks against IaC and pipeline security standards; Define and enforce security governance for agentic AI tooling (MCP server registries, gateway configurations, tool-use authorization policies); Mentor and review work of mid-level and junior engineers; Document architecture decisions, security policies, and runbooks; Maintain SAFe Agile practices and Jira hygiene; Troubleshoot and resolve escalated security tooling issues; Support security manager in long-range planning and team growth strategy

Requirements

Production experience building and maintaining security scanning stages in CI/CD pipelines; GitHub Actions required; Hands-on administration of GitHub Advanced Security or equivalent (Snyk, Veracode, Checkmarx) in an organization with 50+ repositories; Experience writing and enforcing custom Checkov policies (or Bridgecrew, tfsec, Sentinel) against Terraform codebases; Deep working knowledge of AWS security constructs (Control Tower, IAM including ABAC patterns, VPC architecture, Transit Gateway, multi-account strategies) operated in production; Experience operating a CNAPP (Palo Alto Cortex Cloud preferred, Prisma Cloud, Wiz, or Orca acceptable); Shipped security tooling adopted by development teams; Demonstrated experience securing agentic AI workflows (MCP server trust boundaries, AI gateway configuration, prompt injection mitigation, or tool-use authorization policies); Ability to coach junior and mid-level engineers; Comfortable presenting architecture decisions to security leadership and engineering stakeholders; Bachelor's Degree or equivalent experience; Technical certifications or equivalents (CISSP optional); Minimum eight (8) years experience in information security; Minimum eight (8) years supporting/implementing network security platforms and strategies; Must be authorized to work in the US as defined by the Immigration Act of 1986; Must pass a Criminal Background Check; Visa sponsorship not available

Nice to have

Production experience across all four domains: application security, pipeline engineering, cloud infrastructure security, and IaC governance; Administered GitHub Advanced Security (CodeQL, secret scanning, Dependabot) for an organization with active developer adoption metrics; Authored custom Checkov or equivalent IaC policies that enforced specific compliance or security outcomes in production pipelines; Operated a CNAPP platform (Palo Alto Cortex Cloud, Prisma Cloud, Wiz, or Orca) including onboarding, policy configuration, and integration with engineering workflows; Integrated security scan outputs into a SIEM and SOAR (Cortex XSOAR preferred); Experience with Cloud Custodian or similar cloud governance automation; Gathered compliance evidence from automated tooling for PCI-DSS, NIST, or CIS audits; Led or mentored a small engineering team (2-5 engineers); Hands-on experience securing agentic AI systems with public artifacts (GitHub repos, blog posts, talks, open-source work); References or artifacts demonstrating security tooling adopted by development teams in production