Principal Engineer, Information Security (DevSecOps)

Summary
As a Principal DevSecOps Engineer at Allegiant, you’ll play a key role in the delivery of highly reliable, scalable, and maintainable systems. You’ll guide Allegiant’s cloud transformation efforts to ensure our systems and applications remain highly resilient while adding cloud native functionality to achieve long term scalability and stability. You’ll play an integral role in the architecture design, solutioning, development, deployment, and continuing support of Allegiant’s cloud infrastructure. You’re comfortable working independently as well as supporting other team members. You’re pragmatic, tenacious, and comfortable with ambiguity. You’ll be able to balance technical leadership and acumen with strong business judgment to make the right decisions about technology choices. You’ll strive for simplicity, while bringing technical insights into how to refine and improve the system, ultimately ensuring performance, stability, and an exceptional end user experience.

•    Pipeline security engineering: Production experience building and maintaining security scanning stages in CI/CD pipelines. Must demonstrate pipelines they have built that run in production today, not proofs of concept. GitHub Actions is required. 
•    Application security tooling at scale: Hands-on administration of GitHub Advanced Security or equivalent (Snyk, Veracode, Checkmarx) in an organization with 50+ repositories. Must show evidence of driving developer adoption of scan results, not just enabling tools. 
•    Infrastructure-as-code policy: Experience writing and enforcing custom Checkov policies (or Bridgecrew, tfsec, Sentinel) against Terraform codebases. Must be able to describe policies they authored and the compliance or security outcomes those policies enforced. 
•    Cloud infrastructure security: Deep working knowledge of AWS security constructs: Control Tower, IAM (including ABAC patterns), VPC architecture, Transit Gateway, and multi-account strategies. Must have operated these in production, not just designed them. 
•    CNAPP operations: Experience operating a cloud-native application protection platform (Palo Alto Cortex Cloud preferred, Prisma Cloud, Wiz, or Orca acceptable). Must describe onboarding workflows, policy tuning, and integration with engineering teams. 
•    Delivery track record: Candidates must provide specific examples of security tooling they shipped that was adopted by development teams. "Evaluated," "assessed," or "recommended" do not count. We need builders who finish. 
•    AI security and MCP governance: Demonstrated experience securing agentic AI workflows: MCP server trust boundaries, AI gateway configuration, prompt injection mitigation, or tool-use authorization policies. Candidates should be able to point to public work (GitHub repositories, blog posts, conference talks, or open-source contributions) showing hands-on engagement with AI security, not just awareness of the topic. 
•    Communication and mentorship: Able to coach junior and mid-level engineers through hands-on pairing, clear documentation, and direct feedback. Comfortable presenting architecture decisions to security leadership and engineering stakeholders.

Visa Sponsorship Available
No

Minimum Requirements
Combination of Education and Experience will be considered. Must be authorized to work in the US as defined by the Immigration Act of 1986. Must pass a Criminal Background Check.
Education:  Bachelor’s Degree
Certification: Technical certifications or equivalents, CISSP is optional.
Years of Experience:  
• Minimum three (3) years' experience in information security.
• Minimum five (5) years’ supporting / implementing network security platforms & strategies.

•    Own and drive the DevSecOps roadmap across pipeline security, IaC policy enforcement, application security tooling, and cloud security posture management. 
•    Lead the DevSecOps team (two engineers) in daily execution, weekly syncs, and PI planning. Ensure stories are accurate, scoped, and deliverable.
•    Embedding threat modeling into pipelines and workflows to provide real-time analysis of architectural changes in products.
•    Architect and maintain security gates in GitHub Actions CI/CD pipelines. Define when and how scans run, what blocks a merge, and how results route to developers. 
•    Administer GitHub Advanced Security across the organization: CodeQL query suites, secret scanning policies, Dependabot configuration, and developer-facing campaign management. 
•    Author and deploy Checkov custom policies for Terraform IaC scanning. Drive golden policy adoption from current 25% pipeline coverage toward 75%+ with hard-fail enforcement. 
•    Operate and configure Palo Alto Prisma