Senior Security Engineer, Network, Zero Trust

• Own east-west segmentation across Kubernetes clusters using default-deny micro-segmentation and identity-bound paths
• Design and roll out mutually authenticated, encrypted service-to-service connections using mTLS
• Maintain a continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points
• Implement and enforce production and cardholder-data environment segmentation boundaries
• Review network peerings and public exposure and run segmentation testing with the security team
• Partner with IT to evaluate and deliver per-application zero-trust network access for production systems
• Own east-west and north-south network telemetry and feed identity-aware flow data to the SIEM
• Manage cluster admission control, security groups, firewall rules, infrastructure as code, drift detection, and automatic remediation
• Build containment capabilities for isolating workloads or segments during lateral-movement incidents
• Participate in threat modeling, traffic-flow design reviews, incident response, and on-call rotation
• Write policies, tooling, and rollout automation and carry changes through other teams’ services
• Report to the Director of Information Security and collaborate with security platform, detection and response, platform, IAM, and IT teams
• Use and build agentic workflows for flow analysis, policy generation, and drift review

• 6+ years of experience in security, network, platform, or infrastructure engineering
• Hands-on ownership of network controls in cloud production environments
• Deep practical Kubernetes networking knowledge, including CNI, NetworkPolicy semantics, DNS, ingress, and egress
• Experience rolling segmentation out on live clusters without outages
• Strong AWS networking knowledge: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs
• Hands-on experience with mTLS and service-to-service authentication
• Infrastructure as code experience with Terraform and Helm or equivalents, using merge requests and CI
• Ability to write code in Go, Python, or Bash for tooling and automation
• Ability to investigate with packet captures, flow logs, and system-level data
• Working knowledge of PCI DSS network requirements, including segmentation, cardholder-data environment scoping, and segmentation testing
• Demonstrated current use of AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations
• Preferred: Cilium/eBPF, Hubble or equivalent, fleet-scale mTLS and certificate lifecycle, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC-style expectations, and regulated-industry experience

• Competitive gross salary of $5,000–$9,500 USD per month, based on experience
• AI-assisted engineering workflows and tools
• On-call participation for owned controls
• Collaborative work with security platform, detection and response, platform, IAM, IT, and security teams