Senior Security Engineer, Network – Zero Trust

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Take ownership of east-west segmentation across Kubernetes clusters by utilizing default-deny and identity-bound network policies.

• Design and implement mutually authenticated, encrypted mTLS connections for service-to-service communication.

• Maintain an up-to-date map of VPC peerings, tunnels, cross-account links, and public entry points.

• Enforce segmentation boundaries for both production environments and cardholder-data environments.

• Assess and assist in delivering per-application zero-trust network access for engineers and operators.

• Oversee east-west and north-south network telemetry and integrate it with the SIEM.

• Manage cluster admission controls, security groups, firewall rules, IaC pipelines, and drift detection mechanisms.

• Develop capabilities for workload and segment containment in response to lateral-movement incidents.

• Engage in threat modeling, traffic-flow design reviews, incident response, and on-call rotations.

• Create policies, tooling, and rollout automation while coordinating changes across services of other teams.

• Report to the Director of Information Security and collaborate with teams focused on security platforms, detection and response, IAM, and IT.

• Utilize and develop AI-assisted workflows for analyzing flows, generating policies, and reviewing drift.

⛳️ Requirements

• A minimum of 6 years of experience in security, network, platform, or infrastructure engineering.

• Hands-on experience managing network controls in cloud production environments.

• Profound practical knowledge of Kubernetes networking, including CNI, NetworkPolicy, DNS, ingress, and egress.

• Experience in deploying segmentation on live clusters without causing outages.

• Strong understanding of AWS networking, including VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.

• Practical experience with mTLS and service-to-service authentication.

• Familiarity with infrastructure as code using Terraform and Helm or similar tools.

• Experience utilizing merge requests and continuous integration across repositories.

• Proficiency in writing Go, Python, or Bash for tooling and automation purposes.

• Capability to investigate using packet captures, flow logs, and system-level data.

• Basic knowledge of PCI DSS network requirements.

• Proven current use of AI tools, such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred: Experience with Cilium/eBPF, Hubble, mTLS at fleet scale, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC expectations, and in regulated industries.

🏝️ Benefits

• Gross monthly salary ranging from $5,000 to $9,500 USD.

• Opportunity for remote work in Brazil or Latin America.

• AI-assisted engineering workflows and tools.

• Engineering environment focused on open-source initiatives.

• Engagement in a supportive, purpose-driven culture.