Senior Security Engineer, Network & Zero Trust

About the role

Sezzle is looking for a hands‑on Senior Security Engineer to own the network pillar of its Zero‑Trust program. You will design, implement, and automate network segmentation, identity‑aware transport, and telemetry across Kubernetes clusters and AWS environments.

Key responsibilities

• Design and maintain default‑deny micro‑segmentation across Kubernetes clusters using NetworkPolicy and observed traffic patterns.
• Implement mutually authenticated, encrypted service‑to‑service connections (mTLS) at fleet scale.
• Maintain a live, continuously reconciled map of VPC peerings, tunnels, cross‑account links, and public entry points.
• Enforce segmentation of the production and cardholder‑data environment, including CDE boundaries and testing.
• Partner with IT to deliver per‑application private access (ZTNA) for engineers and operators.
• Provide network telemetry (flow logs) with identity data for SIEM integration and detection.
• Manage cluster admission control, workload policies, and drift detection via IaC pipelines.
• Build containment levers for rapid isolation during incidents and participate in on‑call rotation.

Required profile

• 6+ years in security, network, platform, or infrastructure engineering with hands‑on ownership of cloud network controls.
• Deep practical knowledge of Kubernetes networking (CNI, NetworkPolicy, DNS, ingress/egress) and AWS networking (VPC, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, flow logs).
• Experience with mTLS, service meshes, and service‑to‑service authentication.
• Proficiency in infrastructure‑as‑code (Terraform, Helm) and ability to write production code in Go, Python, or Bash.
• Familiarity with PCI DSS network requirements and segmentation testing.
• Demonstrated use of AI‑assisted engineering tools.

Required skills

• Kubernetes, CNI, NetworkPolicy, DNS, ingress/egress
• AWS VPC, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, flow logs
• mTLS, service mesh (Istio, Linkerd, Cilium), SPIFFE/SPIRE
• Cilium/eBPF, Hubble
• Terraform, Helm
• Go, Python, Bash
• OPA/Gatekeeper, Kyverno, conftest
• PCI DSS, CDE segmentation
• AI tooling (Claude Code, Codex, Cursor)