Senior Security Engineer – Network & Zero Trust

• Own east-west segmentation across Kubernetes clusters and maintain default-deny, identity-bound network paths
• Design and roll out mutually authenticated, encrypted service-to-service connections using mTLS
• Maintain a continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points
• Own segmentation of production and the cardholder-data environment, including CDE and high-trust-tier boundaries
• Partner with IT to evaluate and deliver per-application private access/ZTNA
• Own network telemetry and feed east-west and north-south flow logs to the SIEM
• Own cluster admission control, infrastructure-as-code network controls, and automated drift detection and remediation
• Build containment capabilities and participate in incident response involving network controls
• Participate in threat modeling, design reviews, and the on-call rotation
• Write policies, tooling, and rollout automation; report to the Director of Information Security and collaborate with security platform, detection and response, platform, IAM, and other engineering teams
• Use and build AI-assisted agentic workflows for flow analysis, policy generation, and drift review

• 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments
• Deep practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress, and experience rolling segmentation out on live clusters without outages
• Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, and flow logs
• Hands-on experience with mTLS and service-to-service authentication
• Infrastructure as code using Terraform and Helm or equivalents, through merge requests and CI
• Ability to write code in Go, Python, or Bash for tooling and automation
• Ability to investigate with packet captures, flow logs, and system-level data
• Working knowledge of PCI DSS network requirements
• Demonstrated AI-forward engineering using AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations
• Preferred: Cilium/eBPF, Hubble or equivalent flow observability, fleet-scale mTLS, certificate lifecycle, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, IDS/IPS, SOC 2, FFIEC-style examination expectations, and regulated-environment experience

• Competitive gross salary of $5,000–$9,500 USD per month, based on experience level
• Culture including musicians, yogis, cyclists, chefs, golfers, dog-lovers, and rock-climbers
• Remote work arrangement