Senior Security Engineer, Network – Zero Trust

This is a fully remote position, open to applicants in Latin America.

📋 Description

• Take ownership of east-west segmentation across Kubernetes clusters utilizing a default-deny micro-segmentation approach and identity-bound paths.

• Design and implement securely authenticated, encrypted service-to-service connections using mTLS.

• Maintain an up-to-date and reconciled map of VPC peerings, tunnels, cross-account links, and public entry points.

• Enforce production boundaries and cardholder-data-environment safeguards while conducting segmentation testing.

• Collaborate with IT to assess and provide private access on a per-application basis through ZTNA.

• Manage network telemetry, including east-west and north-south flow logs, and integrate it into the SIEM.

• Oversee cluster admission control, infrastructure-as-code enforcement, and automate drift detection and remediation processes.

• Develop containment strategies for isolating workloads or segments during incidents of lateral movement.

• Engage in threat modeling, traffic-flow design reviews, incident response, and participate in on-call rotations.

• Draft policies, create tooling, and automate rollouts while coordinating changes across other teams' services.

• Utilize and enhance AI-assisted engineering workflows for flow analysis, policy generation, and drift reviews.

• Report directly to the Director of Information Security and work in collaboration with security platform, detection and response, platform, and IAM teams.

⛳️ Requirements

• A minimum of 6 years of experience in security, networking, platform, or infrastructure engineering, with direct ownership of network controls in cloud production settings.

• Extensive practical knowledge of Kubernetes networking, including CNI, NetworkPolicy semantics, DNS, ingress/egress, and the experience of implementing segmentation on live clusters without causing outages.

• Strong understanding of AWS networking components such as VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.

• Proven hands-on experience with mTLS and service-to-service authentication mechanisms.

• Proficient in infrastructure as code utilizing Terraform and Helm or similar tools, through merge requests and CI pipelines.

• Capable of writing code in Go, Python, or Bash for tooling and automation purposes.

• Skilled in investigating issues with packet captures, flow logs, and system-level data analysis.

• Familiarity with PCI DSS network requirements, including segmentation, scoping of cardholder-data environments, and conducting segmentation testing.

• Demonstrated current use of AI tools such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred qualifications include knowledge of Cilium/eBPF, Hubble or equivalent tools, fleet-scale mTLS, certificate lifecycle management, service mesh technologies, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection systems, IDS/IPS, SOC 2 compliance, FFIEC-style expectations, and experience in regulated industries.

🏝️ Benefits

• Competitive gross salary ranging from $5,000 to $9,500 USD per month, depending on experience.

• A vibrant culture that includes skilled musicians, yogis, cyclists, chefs, golfers, dog enthusiasts, and rock climbers.

• An engineering environment focused on open-source principles.

• Access to AI-assisted engineering workflows and tools.