7 hours ago
Remote, BrazilSenior
Responsibilities
- Own default-deny east-west segmentation and network policies across Kubernetes clusters.
- Design and roll out identity-aware, encrypted service-to-service transport using mTLS.
- Maintain a continuously reconciled map of VPC peerings, tunnels, cross-account links, and public entry points.
- Implement segmentation boundaries for production and the cardholder-data environment and conduct segmentation testing.
- Partner with IT on per-application private access and Zero Trust Network Access.
- Own east-west and north-south flow telemetry and feed relevant data to the SIEM.
- Manage workload admission controls, security groups, firewall rules, infrastructure-as-code changes, and automated drift detection.
- Build rapid network containment capabilities and participate in incident response.
- Participate in threat modeling, design reviews, and the on-call rotation.
- Develop tooling, automation, and AI-assisted workflows for flow analysis, policy generation, and drift review.
Requirements
- 6+ years of experience in security, network, platform, or infrastructure engineering with hands-on ownership of cloud production network controls.
- Deep Kubernetes networking knowledge, including CNI, NetworkPolicy semantics, DNS, ingress, and egress, with experience rolling out segmentation on live clusters.
- Strong AWS networking experience with VPCs, subnets, security groups, peering, Transit Gateway, PrivateLink, load balancers, and flow logs.
- Hands-on experience with mTLS and service-to-service authentication through service meshes, proxies, or CNI-level encryption.
- Experience using Terraform and Helm or equivalents through merge requests and CI across multiple repositories.
- Ability to write production tooling and automation in Go, Python, or Bash.
- Ability to investigate with packet captures, flow logs, and system-level data.
- Working knowledge of PCI DSS network requirements, including segmentation, cardholder-data environment scoping, and segmentation testing.
- Demonstrated practical use of AI tooling such as Claude Code, Codex, Cursor, or custom LLM integrations.
- Preferred experience with Cilium, eBPF, Hubble, Istio, Linkerd, Cilium service mesh, SPIFFE/SPIRE, ZTNA, identity-aware proxies, OPA/Gatekeeper, Kyverno, conftest, IDS/IPS, network detection, incident containment, SOC 2, FFIEC-style examinations, or regulated fintech and payments environments.
Benefits
- Full-time remote role.
- Opportunity to work on a high-impact Zero Trust and network security program in a fintech environment.
- Collaboration with security platform, detection and response, platform, IAM, and IT teams.
- Participation in AI-assisted engineering workflows and open-source-focused development.
- Company culture includes activities and interests such as music, yoga, cycling, cooking, golf, dog ownership, and rock climbing.
Tech Stack
AWSBashElasticsearchGitGoHelmIstioKubernetesMySQLPostgreSQLPythonReactReact NativeTerraformTypeScript
Categories
About Sezzle
Sezzle builds a buy now, pay later platform that lets consumers split purchases into interest-free installments online and in stores, integrated with e-commerce and retail merchants. The company earns revenue from merchant fees and related consumer charges and provides underwriting and payment processing services. Founded in 2016 and headquartered in Minneapolis, Sezzle is a public company dual-listed on Nasdaq and the ASX.