Senior Security Engineer, Network – Zero Trust

• Own east-west segmentation across Kubernetes clusters using default-deny, identity-bound network policies
• Design and roll out mutually authenticated, encrypted mTLS service-to-service connections
• Maintain a continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points
• Enforce segmentation boundaries for production and the cardholder-data environment
• Evaluate and help deliver per-application zero-trust network access for engineers and operators
• Own east-west and north-south network telemetry and feed it to the SIEM
• Manage cluster admission controls, security groups, firewall rules, IaC pipelines, and drift detection
• Build workload and segment containment capabilities for lateral-movement incidents
• Participate in threat modeling, traffic-flow design reviews, incident response, and on-call rotation
• Write policies, tooling, and rollout automation while coordinating changes across other teams' services
• Report to the Director of Information Security and collaborate with security platform, detection and response, platform, IAM, and IT teams
• Use and build AI-assisted workflows for flow analysis, policy generation, and drift review

• 6+ years of experience in security, network, platform, or infrastructure engineering
• Hands-on ownership of network controls in cloud production environments
• Deep practical Kubernetes networking knowledge, including CNI, NetworkPolicy, DNS, ingress, and egress
• Experience rolling segmentation out on live clusters without outages
• Strong AWS networking knowledge: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs
• Hands-on experience with mTLS and service-to-service authentication
• Infrastructure as code experience with Terraform and Helm or equivalents
• Experience using merge requests and CI across repositories
• Ability to write Go, Python, or Bash for tooling and automation
• Ability to investigate with packet captures, flow logs, and system-level data
• Working knowledge of PCI DSS network requirements
• Demonstrated current use of AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations
• Preferred: Cilium/eBPF, Hubble, mTLS at fleet scale, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC expectations, and regulated-industry experience

• Gross monthly salary of $5,000–$9,500 USD
• Remote work in Brazil / Latin America
• AI-assisted engineering workflows and tools
• Open-source-focused engineering environment
• Participation in a supportive, purpose-driven culture