Senior Security Engineer, Network & Zero Trust

Overview

Senior Security Engineer, Network & Zero Trust to own the network pillar of Sezzle's zero-trust program across Kubernetes clusters, AWS accounts, and the paths between them, as a hands-on engineering role.

What you'll do

• Own east-west segmentation across Kubernetes clusters: design the segmentation model, derive network policies from observed traffic, and keep every workload reachable only through explicitly allowed, identity-bound paths.
• Deliver identity-aware transport by designing and rolling out mutually authenticated, encrypted service-to-service connections (mTLS).
• Keep a live map of the network, including VPC peerings, tunnels, cross-account links, and every public entry point, built from cloud APIs and reconciled continuously.
• Own segmentation of production and the cardholder-data environment: implement and enforce the CDE and high-trust-tier boundaries, review every peering and public exposure against them, and run segmentation testing with the security team.
• Partner with IT on private access: evaluate and help deliver per-application access (ZTNA) for engineers and operators reaching production systems.
• Own network telemetry: flow logs east-west and north-south, with identity on both ends, and feed them to the SIEM for the detection team.
• Own cluster admission control and hold the line on drift: workload admission policy (pod security, image provenance, network policy), security groups and firewall rules declared in git, applied only through the IaC pipeline, with drift detected and reverted automatically.
• Build the levers that let the team isolate a workload or segment quickly when detection flags lateral movement, and take part in incident response when the network is in play.
• Participate in threat modeling and design reviews for anything that changes how traffic flows, and in the on-call rotation for the controls you own.

What you'll need

• 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments.
• Deep, practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress, and experience rolling segmentation out on live clusters without outages.
• Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, flow logs.
• Hands-on experience with mTLS and service-to-service authentication (service mesh, proxies, or CNI-level encryption).
• Infrastructure as code as your default way of working: Terraform and Helm or equivalents, through merge requests and CI, across repositories you don't own.
• Ability to write real code (Go, Python, or Bash) for tooling and automation, not only configuration.
• Ability to investigate directly with packet captures, flow logs, and system-level data.
• Working knowledge of PCI DSS network requirements: segmentation, scoping of the cardholder-data environment, segmentation testing.
• Demonstrated AI-forward engineering: actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today and have opinions grounded in practice about where it helps and where it doesn't.

Nice to have

• Cilium / eBPF in production, including Hubble or equivalent flow observability.
• mTLS at fleet scale, including certificate lifecycle; service mesh (e.g., Istio, Linkerd, Cilium service mesh) and workload identity standards such as SPIFFE/SPIRE.
• Built AI-assisted workflows that others adopted: flow analysis, policy generation, drift review.
• Experience evaluating or deploying ZTNA / identity-aware proxy products.
• Policy-as-code and admission control (OPA/Gatekeeper, Kyverno, conftest).
• Experience with network detection (IDS/IPS, anomalous-flow and lateral-movement detection) and with containment during incidents.
• Familiarity with SOC 2 and with FFIEC-style examination expectations for network security.
• Experience in fintech, payments, BNPL, or other regulated environments.

Details

• Work mode: Remote, based in India.
• Employment type: Full-time.
• Compensation: $5,000 - $9,500 USD per month, gross, based on experience level.
• Reports to the Director of Information Security.