Senior Security Engineer, Network & Zero Trust

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Engineer, Network & Zero Trust based in India.** This is an exciting opportunity for an experienced security engineer to shape and strengthen a modern Zero Trust security architecture across cloud infrastructure and Kubernetes environments. You will take ownership of network segmentation, service identity, secure connectivity, and network visibility to ensure that every connection is explicitly authorized and continuously monitored. Working closely with security, platform, and identity teams, you will design and implement controls that protect production systems and sensitive data without disrupting engineering delivery. The role combines hands-on development, infrastructure automation, incident response, and security architecture in a cloud-native environment. You will also leverage AI-assisted engineering to accelerate policy generation, network analysis, and security automation. This position is ideal for a technically driven professional who values secure-by-design systems, operational excellence, and measurable security improvements. ### Accountabilities - Lead the design, implementation, and continuous improvement of network segmentation across Kubernetes clusters, establishing default-deny policies and explicitly authorized communication paths between workloads. - Develop and deploy identity-aware, mutually authenticated, encrypted service-to-service communication using mutual TLS (mTLS) and appropriate service identity mechanisms. - Maintain a continuously updated inventory and map of network connectivity, including AWS VPCs, peerings, tunnels, cross-account connections, and public-facing endpoints. - Implement and enforce network security boundaries for production infrastructure and cardholder data environments, ensuring appropriate segmentation, exposure reviews, and regular security testing. - Collaborate with IT teams to evaluate and implement Zero Trust Network Access (ZTNA) solutions and identity-aware access controls for engineers and operators accessing production systems. - Build and maintain network telemetry pipelines that capture east-west and north-south traffic, provide actionable visibility into communicating workloads, and integrate relevant data with SIEM platforms. - Establish security controls for Kubernetes workload admission, including pod security, image provenance, and network policies, while managing firewall rules and cloud security configurations through infrastructure as code. - Develop automated mechanisms to detect configuration drift, enforce approved changes through CI/CD pipelines, and remediate unauthorized modifications. - Create rapid containment capabilities to isolate workloads or network segments when suspicious activity or lateral movement is detected, and contribute to incident investigation and response. - Participate in threat modeling, architecture reviews, and security design discussions for changes affecting network traffic, connectivity, or access controls. - Contribute to the on-call rotation for network security controls and continuously improve the reliability, effectiveness, and maintainability of the systems under your ownership. - Develop and improve AI-assisted engineering workflows for network flow analysis, policy generation, configuration reviews, and security automation. ### Requirements: - At least 6 years of experience in security, network, platform, or infrastructure engineering, including hands-on ownership of network controls in cloud-based production environments. - Strong practical knowledge of Kubernetes networking, including Container Network Interfaces (CNIs), NetworkPolicy semantics, DNS, ingress and egress traffic, and the ability to roll out segmentation safely without service interruptions. - Extensive experience with AWS networking services and concepts, including VPCs, subnets, security groups, VPC peering, Transit Gateway, PrivateLink, load balancers, and VPC Flow Logs. - Hands-on experience implementing mTLS and service-to-service authentication through service meshes, proxies, or CNI-level encryption. - Proficiency in infrastructure as code, particularly Terraform and Helm or equivalent tools, with experience managing changes through Git, merge requests, and CI/CD pipelines across multiple repositories. - Strong programming and scripting skills in Go, Python, or Bash, with the ability to build practical security tools and automation rather than relying solely on configuration. - Experience investigating network and security issues using packet captures, flow logs, and system-level telemetry. - Working knowledge of PCI DSS network security requirements, including segmentation, cardholder data environment scoping, and segmentation testing. - Demonstrated experience using AI-assisted engineering tools, such as Claude Code, Codex, Cursor, or custom LLM integrations, with a practical understanding of their strengths and limitations. - Strong analytical and troubleshooting skills, combined with a proactive approach to identifying risks, resolving vulnerabilities, and preventing recurring issues. - Excellent collaboration and communication skills, with the ability to work across engineering teams, influence technical decisions, and introduce security controls without unnecessarily disrupting delivery. - A strong sense of ownership, high engineering standards, adaptability, and the ability to balance speed, security, and operational reliability. **Preferred qualifications and experience:** - Production experience with Cilium and eBPF, including Hubble or equivalent network flow observability tools. - Experience operating mTLS at scale, managing certificate lifecycles, and implementing service mesh technologies such as Istio, Linkerd, or Cilium Service Mesh. - Familiarity with workload identity standards and frameworks such as SPIFFE and SPIRE. - Experience developing AI-assisted workflows for network traffic analysis, policy generation, and configuration drift reviews. - Knowledge of ZTNA platforms, identity-aware proxies, policy-as-code, and admission control technologies such as OPA/Gatekeeper, Kyverno, or Conftest. - Experience with network threat detection, intrusion detection and prevention systems, anomalous traffic analysis, lateral movement detection, and incident containment. - Familiarity with SOC 2, FFIEC-style examination expectations, and other security and compliance frameworks. - Previous experience in fintech, payments, buy now, pay later (BNPL), or other regulated industries. - A bachelor's degree in Computer Science, Computer Engineering, or a related technical field. ### Benefits: - **Competitive compensation:** The advertised salary range is USD 5,000–9,500 gross per month, depending on experience and expertise. The original listing specifies this range for the role. - **Remote working:** A remote, full-time opportunity within a distributed engineering environment. The original listing identifies Serbia as the location; eligibility to work from India should be confirmed with the hiring team. - **Technical ownership:** The opportunity to lead meaningful Zero Trust and network security initiatives across cloud infrastructure and Kubernetes environments. - **Modern technology stack:** Hands-on exposure to AWS, Kubernetes, Go, Python, Terraform, GitLab CI/CD, and open-source security technologies. - **AI-driven engineering:** Opportunities to apply and develop AI-assisted workflows for security analysis, automation, and infrastructure management. - **Cross-functional collaboration:** Work alongside security, platform, identity, and detection-and-response specialists on high-impact technical initiatives. - **Professional growth:** Expand expertise in cloud security, network architecture, workload identity, infrastructure automation, and incident response. - **Engineering-focused culture:** An environment that values initiative, accountability, technical excellence, thoughtful experimentation, and continuous improvement.