Senior Security Engineer – Network, Zero Trust

• Own east-west segmentation across Kubernetes clusters and design default-deny network policies
• Derive network policies from observed traffic and maintain explicitly allowed, identity-bound paths
• Design and roll out mutually authenticated, encrypted service-to-service connections using mTLS
• Maintain a continuously reconciled network map covering VPC peerings, tunnels, cross-account links, and public entry points
• Own segmentation of production and the cardholder-data environment, including CDE and high-trust-tier boundaries
• Review network peerings and public exposure and run segmentation testing with the security team
• Partner with IT to evaluate and deliver per-application private access/ZTNA
• Own east-west and north-south network telemetry and feed it to the SIEM
• Own cluster admission control, infrastructure-as-code enforcement, and automated drift detection and remediation
• Build containment capabilities for isolating workloads or segments during lateral-movement incidents
• Participate in threat modeling, traffic-flow design reviews, incident response, and on-call
• Report to the Director of Information Security and collaborate with security platform, detection and response, platform, IAM, and other service teams
• Build and use agentic workflows for flow analysis, policy generation, and drift review

• 6+ years of experience in security, network, platform, or infrastructure engineering
• Hands-on ownership of network controls in cloud production environments
• Deep Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress
• Experience rolling segmentation out on live clusters without outages
• Strong AWS networking: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, flow logs
• Hands-on experience with mTLS and service-to-service authentication
• Infrastructure as code experience with Terraform and Helm or equivalents
• Ability to write code in Go, Python, or Bash for tooling and automation
• Ability to investigate with packet captures, flow logs, and system-level data
• Working knowledge of PCI DSS network requirements
• Demonstrated current use of AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations
• Preferred: Cilium/eBPF, Hubble or equivalent, fleet-scale mTLS and certificate lifecycle, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC-style examination expectations, and regulated-industry experience

• Gross monthly compensation of $5,000–$9,500 USD, based on experience level
• AI-assisted engineering workflows and tools
• Remote work in Mexico
• On-call participation for owned controls
• Open-source-focused engineering environment