Senior Security Engineer, Network – Zero Trust

This is a fully remote position, open to applicants in India.

📋 Description

• Take ownership of east-west segmentation across Kubernetes clusters utilizing default-deny micro-segmentation along with explicitly allowed, identity-bound pathways.

• Develop and implement mutually authenticated, encrypted service-to-service connections using mTLS.

• Maintain an up-to-date and continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points.

• Manage segmentation of production and the cardholder-data environment, encompassing boundary enforcement, exposure assessments, and segmentation testing.

• Collaborate with IT to assess and provide per-application zero-trust network access for production systems.

• Oversee east-west and north-south network telemetry, supplying identity-aware flow data to the SIEM.

• Manage cluster admission control, security groups, firewall configurations, infrastructure-as-code pipelines, and automated drift detection and remediation.

• Develop containment strategies for isolating workloads or segments during lateral-movement incidents.

• Engage in threat modeling, traffic-flow design reviews, incident response, and participate in the on-call rotation.

• Draft policies, tooling, rollout automation, and AI-assisted workflows while coordinating changes across services provided by other teams.

• Report directly to the Director of Information Security and work in conjunction with security platform, detection and response, platform, and IAM teams.

⛳️ Requirements

• Minimum of 6 years of experience in security, network, platform, or infrastructure engineering, with direct responsibility for network controls in cloud production environments.

• Extensive practical knowledge of Kubernetes networking, including CNI, NetworkPolicy semantics, DNS, ingress/egress, and experience implementing segmentation on live clusters without downtime.

• Strong understanding of AWS networking concepts: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, and flow logs.

• Hands-on experience with mTLS and service-to-service authentication methodologies.

• Experience with infrastructure as code, specifically using Terraform and Helm or similar tools, through merge requests and CI.

• Proficiency in writing production code in Go, Python, or Bash for tooling and automation purposes.

• Capability to conduct investigations using packet captures, flow logs, and system-level data.

• Familiarity with PCI DSS network requirements, including segmentation, scoping of cardholder-data environments, and segmentation testing.

• Proven experience in AI-forward engineering utilizing AI tools such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred qualifications include experience with Cilium/eBPF, Hubble or similar technologies, fleet-scale mTLS and certificate lifecycle management, service mesh, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, incident containment, SOC 2, FFIEC-style expectations, and experience in regulated industries.

🏝️ Benefits

• Competitive gross salary ranging from $5,000 to $9,500 USD per month, depending on experience level.

• A vibrant culture that includes skilled musicians, yogis, cyclists, chefs, golfers, dog-lovers, and rock-climbers.

• AI-assisted engineering integrated as a standard aspect of team operations.

• An open-source-focused engineering environment.

• Full-time remote work opportunity.