Senior Security Engineer, Network & Zero Trust

This is a fully remote position, open to applicants in Serbia.

📋 Description

• Take ownership of east-west segmentation across Kubernetes clusters implementing default-deny network policies alongside explicitly permitted, identity-bound pathways.

• Design and implement encrypted, mutually authenticated service-to-service connections utilizing mTLS.

• Maintain an up-to-date, reconciled overview of VPC peerings, tunnels, cross-account links, and public entry points.

• Manage the segmentation of production environments and cardholder-data environments, including boundary enforcement and segmentation testing.

• Collaborate with IT to assess and provide per-application private access/ZTNA solutions.

• Oversee both east-west and north-south network telemetry, ensuring flow data is fed to the SIEM.

• Manage cluster admission controls, security groups, firewall regulations, infrastructure-as-code enforcement, and drift detection and remediation processes.

• Develop containment strategies for isolating workloads or segments during lateral-movement incidents.

• Engage in threat modeling, traffic-flow design assessments, incident response activities, and participate in on-call rotations.

• Author policies, develop tooling, and automate rollouts while ensuring uninterrupted delivery across other teams’ services.

• Report directly to the Director of Information Security and collaborate with security platform, detection and response, platform, IAM, and IT teams.

• Utilize and create AI-assisted agentic workflows for flow analysis, policy generation, and drift evaluation.

⛳️ Requirements

• A minimum of 6 years of experience in security, network, platform, or infrastructure engineering, with hands-on responsibility for network controls in cloud production settings.

• Extensive practical knowledge of Kubernetes networking, encompassing CNI, NetworkPolicy semantics, DNS, ingress, and egress.

• Proven experience in implementing segmentation on live clusters without causing outages.

• Strong expertise in AWS networking, including VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.

• Hands-on experience with mTLS and service-to-service authentication methodologies.

• Experience with infrastructure-as-code using Terraform and Helm or similar tools, incorporating merge requests and CI processes.

• Proficient in writing production-level code in Go, Python, or Bash for tooling and automation purposes.

• Ability to conduct investigations using packet captures, flow logs, and system-level data analysis.

• Familiarity with PCI DSS network requirements, specifically relating to segmentation, cardholder-data environment scoping, and segmentation testing.

• Demonstrated current use of AI tools such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred experience with Cilium/eBPF, Hubble or similar technologies, fleet-scale mTLS, certificate lifecycle management, Istio, Linkerd, Cilium service mesh, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, IDS/IPS, lateral-movement detection, SOC 2, FFIEC-style expectations, and experience in fintech/payments/BNPL.

🏝️ Benefits

• Competitive gross salary ranging from $5,000 to $9,500 USD per month, depending on experience.

• Access to AI-assisted engineering workflows and tools.

• An open-source-focused technology environment.

• A diverse and purpose-driven company culture.

• Full-time employment.