Senior Security Engineer, Network & Zero Trust

This is a fully remote position, open to applicants in Colombia.

📋 Description

• Take ownership of east-west segmentation across Kubernetes clusters by implementing default-deny micro-segmentation along with explicitly permitted, identity-bound pathways.

• Create and implement mutually authenticated, encrypted service-to-service connections utilizing mTLS.

• Maintain an up-to-date map of VPC peerings, tunnels, cross-account links, and public entry points.

• Segment the production environment and the cardholder-data environment, ensuring enforcement of CDE and high-trust-tier boundaries, as well as conducting segmentation testing.

• Collaborate with IT to assess and deliver private access/ZTNA on a per-application basis.

• Manage both east-west and north-south network telemetry, providing identity-aware flow data to the SIEM.

• Oversee cluster admission control, infrastructure-as-code network regulations, and automated drift detection and remediation processes.

• Develop containment strategies for isolating workloads or segments during lateral-movement incidents.

• Engage in threat modeling, traffic-flow design reviews, and participate in the on-call rotation.

• Draft policies, develop tooling, and implement rollout automation while coordinating changes across services from other teams.

• Utilize and develop agentic AI workflows for flow analysis, policy generation, and drift review.

• Report directly to the Director of Information Security and collaborate with the security platform, detection and response, platform, IAM, and IT teams.

⛳️ Requirements

• A minimum of 6 years of experience in security, network, platform, or infrastructure engineering, with hands-on responsibility for network controls within cloud production environments.

• Profound practical knowledge of Kubernetes networking, including CNI, NetworkPolicy semantics, DNS, ingress/egress, and live-cluster segmentation without causing outages.

• Strong understanding of AWS networking concepts: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.

• Direct experience with mTLS and service-to-service authentication.

• Proficiency in infrastructure as code using Terraform and Helm or similar tools through merge requests and CI.

• Capability to write production-level code in Go, Python, or Bash for tooling and automation purposes.

• Ability to conduct investigations using packet captures, flow logs, and system-level data.

• Familiarity with PCI DSS network requirements, including segmentation, CDE scoping, and segmentation testing.

• Evidence of current utilization of AI tools such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred skills include Cilium/eBPF, Hubble or similar technologies, fleet-scale mTLS and certificate lifecycle management, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, incident containment, SOC 2, FFIEC-style expectations, and experience in regulated industries.

🏝️ Benefits

• Competitive gross salary ranging from $5,000 to $9,500 USD per month, depending on experience level.

• Access to AI-assisted engineering workflows and tools.

• Participation in on-call rotation for managed controls.

• Opportunities for collaboration with security platform, detection and response, platform, IAM, and IT teams.

• Work within an open-source-focused technology environment.

• Full-time employment.