Senior Security Engineer, Network – Zero Trust

• Own east-west segmentation across Kubernetes clusters using default-deny micro-segmentation and explicitly allowed, identity-bound paths
• Design and roll out mutually authenticated, encrypted service-to-service connections using mTLS
• Maintain a continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points
• Own segmentation of production and the cardholder-data environment, including boundary enforcement, exposure reviews, and segmentation testing
• Partner with IT to evaluate and deliver per-application zero-trust network access for production systems
• Own east-west and north-south network telemetry and feed identity-aware flow data to the SIEM
• Own cluster admission control, security groups, firewall rules, infrastructure-as-code pipelines, and automated drift detection and remediation
• Build containment capabilities for isolating workloads or segments during lateral-movement incidents
• Participate in threat modeling, traffic-flow design reviews, incident response, and the on-call rotation
• Write policies, tooling, rollout automation, and AI-assisted workflows while coordinating changes across other teams’ services
• Report to the Director of Information Security and collaborate with security platform, detection and response, platform, and IAM teams

• 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments
• Deep practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress, and experience rolling segmentation out on live clusters without outages
• Strong AWS networking knowledge: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, and flow logs
• Hands-on experience with mTLS and service-to-service authentication
• Infrastructure as code experience, including Terraform and Helm or equivalents, through merge requests and CI
• Ability to write production code in Go, Python, or Bash for tooling and automation
• Ability to investigate with packet captures, flow logs, and system-level data
• Working knowledge of PCI DSS network requirements, including segmentation, cardholder-data environment scoping, and segmentation testing
• Demonstrated AI-forward engineering experience using AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations
• Preferred: Cilium/eBPF, Hubble or equivalent, fleet-scale mTLS and certificate lifecycle, service mesh, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, incident containment, SOC 2, FFIEC-style expectations, and regulated-industry experience

• Competitive gross salary of $5,000–$9,500 USD per month, based on experience level
• Culture including skilled musicians, yogis, cyclists, chefs, golfers, dog-lovers, and rock-climbers
• AI-assisted engineering as a standard part of how the team works
• Open-source-focused engineering environment
• Full-time remote work