Senior Security Engineer – Network & Zero Trust

About the role

Sezzle is looking for a hands‑on Senior Security Engineer to own the network pillar of its Zero‑Trust program. You will design, implement, and automate micro‑segmentation, identity‑aware service‑to‑service transport, and continuous network telemetry across Kubernetes clusters and AWS environments.

Key responsibilities

• Design and enforce default‑deny network policies for Kubernetes clusters, deriving rules from observed traffic.
• Implement mutually authenticated, encrypted service‑to‑service connections (mTLS) at scale.
• Maintain a live, continuously reconciled map of VPC peerings, tunnels, cross‑account links, and public entry points.
• Segment production and cardholder‑data environments, conduct segmentation testing, and enforce CDE boundaries.
• Provide per‑application private access (ZTNA) for engineers and operators.
• Collect and feed east‑west and north‑south flow logs with identity data into the SIEM.
• Manage cluster admission control, drift detection, and automated remediation via IaC pipelines.
• Build containment levers for rapid isolation of workloads during incidents and participate in on‑call rotation.

Required profile

• 6+ years of experience in security, network, platform, or infrastructure engineering.
• Deep, practical knowledge of Kubernetes networking (CNI, NetworkPolicy, DNS, ingress/egress) and AWS networking (VPC, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, flow logs).
• Hands‑on experience with mTLS, service meshes, and service‑to‑service authentication.
• Proficiency with infrastructure‑as‑code tools (Terraform, Helm) and ability to write production code in Go, Python, or Bash.
• Working knowledge of PCI DSS network requirements and experience with AI‑assisted engineering tools.

Required skills

• Kubernetes networking (CNI, NetworkPolicy)
• AWS networking (VPC, security groups, Transit Gateway)
• mTLS and service mesh technologies (Istio, Linkerd, Cilium)
• Infrastructure as Code (Terraform, Helm)
• Programming/scripting (Go, Python, Bash)
• Network telemetry and flow log analysis
• PCI DSS segmentation requirements
• AI tooling for code generation and policy automation