Senior Security Engineer, Network & Zero Trust

Sezzle

8d•Remote

About The Position

Sezzle is seeking a hands-on Senior Security Engineer to own the network pillar of its zero-trust program across Kubernetes clusters, AWS accounts, and the connections between them. The role focuses on making every connection explicitly allowed, authenticated through service identity, and attributable after the fact. The engineer will lead default-deny micro-segmentation, identity-aware service-to-service transport, per-application private access, flow-level visibility, and network configuration managed as reviewed code. This is an engineering position requiring direct implementation of policies, tools, and rollout automation, with changes coordinated across teams while maintaining service delivery. The role reports to the Director of Information Security and works with security platform, detection and response, platform, and IAM teams. It includes building and using AI-assisted and agentic workflows for tasks such as flow analysis, policy generation from observed traffic, and drift review. The position participates in threat modeling, design reviews, and an on-call rotation for the controls it owns.

Requirements

At least 6 years of experience in security, network, platform, or infrastructure engineering, including hands-on ownership of network controls in cloud production environments.
Practical Kubernetes networking knowledge, including CNI, NetworkPolicy semantics, DNS, ingress, and egress, and experience rolling out segmentation on live clusters without outages.
Strong AWS networking knowledge, including VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.
Hands-on experience with mTLS and service-to-service authentication using a service mesh, proxies, or CNI-level encryption.
Infrastructure as code as a standard way of working, using Terraform and Helm or equivalents through merge requests and CI across repositories.
Ability to write production tooling and automation in Go, Python, or Bash, beyond configuration alone.
Ability to investigate using packet captures, flow logs, and system-level data.
Working knowledge of PCI DSS network requirements, including segmentation, cardholder-data environment scoping, and segmentation testing.
Active use of AI tooling in engineering work, such as Claude Code, Codex, Cursor, or custom LLM integrations, with practical views on its strengths and limitations.
Ability to roll out changes to other teams’ systems safely, including using observe mode and measurement before enforcement.

Nice To Haves

Production experience with Cilium or eBPF, including Hubble or equivalent flow observability.
Fleet-scale mTLS experience, including certificate lifecycle, service mesh technologies such as Istio, Linkerd, or Cilium service mesh, and workload identity standards such as SPIFFE/SPIRE.
Experience building AI-assisted workflows adopted by others, such as flow analysis, policy generation, or drift review.
Experience evaluating or deploying ZTNA or identity-aware proxy products.
Experience with policy-as-code and admission control, such as OPA/Gatekeeper, Kyverno, or conftest.
Experience with network detection, including IDS/IPS, anomalous-flow and lateral-movement detection, and incident containment.
Familiarity with SOC 2 and FFIEC-style examination expectations for network security.
Experience in fintech, payments, BNPL, or other regulated environments.

Responsibilities

Own east-west segmentation across Kubernetes clusters, including designing the model, deriving network policies from observed traffic, and maintaining explicitly allowed, identity-bound workload paths.
Design and roll out mutually authenticated, encrypted service-to-service connections using mTLS.
Maintain a continuously reconciled map of network paths, including VPC peerings, tunnels, cross-account links, and public entry points.
Implement and enforce segmentation boundaries for production and the cardholder-data environment; review peerings and public exposure and conduct segmentation testing with the security team.
Partner with IT to evaluate and help deliver per-application ZTNA for engineers and operators accessing production systems.
Own east-west and north-south network telemetry, ensuring traffic can be attributed to identities and feeding telemetry to the SIEM.
Own cluster admission control, including workload admission policies for pod security, image provenance, and network policy.
Manage security groups and firewall rules as code through the IaC pipeline, with admission controls and automated drift detection and remediation.
Build mechanisms to quickly isolate workloads or segments when detection identifies lateral movement, and participate in incident response involving the network.
Participate in threat modeling and design reviews for changes affecting traffic flows, and join the on-call rotation for owned controls.
Use and build AI-assisted workflows for flow analysis, policy generation, and drift review.