Senior Security Engineer, Network, Zero Trust

This is a fully remote position, open to applicants in Turkey.

📋 Description

• Take charge of east-west segmentation across Kubernetes clusters utilizing default-deny micro-segmentation and identity-bound paths.

• Design and implement mutually authenticated, encrypted service-to-service connections through mTLS.

• Maintain an up-to-date map of VPC peerings, tunnels, cross-account links, and public entry points.

• Establish and uphold segmentation boundaries for production and cardholder-data environments.

• Evaluate network peerings and public exposure while conducting segmentation testing alongside the security team.

• Collaborate with IT to assess and provide per-application zero-trust network access for production systems.

• Manage east-west and north-south network telemetry, supplying identity-aware flow data to the SIEM.

• Oversee cluster admission control, security groups, firewall rules, infrastructure as code, drift detection, and automatic remediation.

• Develop containment capabilities for isolating workloads or segments during lateral-movement incidents.

• Engage in threat modeling, traffic-flow design reviews, incident response, and on-call rotation.

• Create policies, tooling, and rollout automation while coordinating changes with other teams’ services.

• Report directly to the Director of Information Security, working in collaboration with the security platform, detection and response, platform, IAM, and IT teams.

• Utilize and construct agentic workflows for flow analysis, policy generation, and drift review.

⛳️ Requirements

• A minimum of 6 years of experience in security, network, platform, or infrastructure engineering.

• Proven hands-on ownership of network controls in cloud production environments.

• Extensive practical knowledge of Kubernetes networking, including CNI, NetworkPolicy semantics, DNS, ingress, and egress.

• Experience in implementing segmentation on live clusters without causing outages.

• Strong knowledge of AWS networking: VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.

• Hands-on experience with mTLS and service-to-service authentication.

• Proficient in infrastructure as code with Terraform and Helm or similar tools, utilizing merge requests and CI.

• Capability to write code in Go, Python, or Bash for tooling and automation purposes.

• Ability to conduct investigations using packet captures, flow logs, and system-level data.

• Familiarity with PCI DSS network requirements, including segmentation, cardholder-data environment scoping, and segmentation testing.

• Demonstrated current use of AI tools such as Claude Code, Codex, Cursor, or custom LLM integrations.

• Preferred: Experience with Cilium/eBPF, Hubble or equivalent technologies, fleet-scale mTLS and certificate lifecycle management, SPIFFE/SPIRE, AI-assisted workflows, ZTNA, policy-as-code, admission control, network detection, SOC 2, FFIEC-style expectations, and regulated-industry experience.

🏝️ Benefits

• Competitive gross salary ranging from $5,000 to $9,500 USD per month, depending on experience.

• Access to AI-assisted engineering workflows and tools.

• Participation in on-call duties for owned controls.

• Opportunity to work collaboratively with security platform, detection and response, platform, IAM, IT, and security teams.