Senior Security Engineer – Network, Zero Trust

This is a fully remote position, open to applicants in Mexico.

📋 Description

• Take charge of east-west segmentation across Kubernetes clusters and create default-deny network policies.

• Generate network policies based on observed traffic and maintain specifically allowed, identity-bound pathways.

• Design and implement mutually authenticated, encrypted service-to-service connections utilizing mTLS.

• Keep an up-to-date network map that includes VPC peerings, tunnels, cross-account links, and public entry points.

• Oversee segmentation of production and the cardholder-data environment, comprising CDE and high-trust-tier boundaries.

• Assess network peerings and public exposure while conducting segmentation testing in collaboration with the security team.

• Collaborate with IT to assess and provide per-application private access/ZTNA solutions.

• Manage east-west and north-south network telemetry and supply it to the SIEM.

• Supervise cluster admission control, enforce infrastructure-as-code, and automate drift detection and remediation.

• Develop containment strategies for isolating workloads or segments during incidents of lateral movement.

• Engage in threat modeling, traffic-flow design reviews, incident response, and on-call duties.

• Report directly to the Director of Information Security and work alongside security platform, detection and response, platform, IAM, and other service teams.

• Create and utilize agentic workflows for flow analysis, policy generation, and drift review.

⛳️ Requirements

• Over 6 years of experience in security, network, platform, or infrastructure engineering.

• Hands-on experience managing network controls in cloud production settings.

• Extensive knowledge of Kubernetes networking: CNI, NetworkPolicy semantics, DNS, ingress/egress.

• Proven experience in rolling out segmentation on live clusters without causing outages.

• Strong expertise in AWS networking: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, flow logs.

• Practical experience with mTLS and service-to-service authentication.

• Infrastructure as code experience with Terraform and Helm or similar tools.

• Proficiency in coding with Go, Python, or Bash for tooling and automation purposes.

• Capability to conduct investigations using packet captures, flow logs, and system-level data.

• Familiarity with PCI DSS network requirements.

• Demonstrated current use of AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred experience with Cilium/eBPF, Hubble or similar technologies, fleet-scale mTLS and certificate lifecycle management, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC-style examination standards, and experience in regulated industries.

🏝️ Benefits

• Gross monthly compensation ranging from $5,000–$9,500 USD, depending on experience level.

• Access to AI-assisted engineering workflows and tools.

• Opportunity for remote work in Mexico.

• Participation in on-call duties for managed controls.

• Work in an open-source-focused engineering environment.