Sezzle - Senior Security Engineer, Network & Zero Trust
Requirements
• Cilium / eBPF in production, including Hubble or equivalent flow observability. • mTLS at fleet scale, including certificate lifecycle — service mesh (e.g., Istio, Linkerd, Cilium service mesh) and workload identity standards such as SPIFFE/SPIRE. • You have built AI-assisted workflows that others adopted — flow analysis, policy generation, drift review. • Experience evaluating or deploying ZTNA / identity-aware proxy products. ● Policy-as-code and admission control (OPA/Gatekeeper, Kyverno, conftest). • Experience with network detection — IDS/IPS, anomalous-flow and lateral-movement detection — and with containment during incidents. • Familiarity with SOC 2 and with FFIEC-style examination expectations for network security. ● Experience in fintech, payments, BNPL, or other regulated environments. • You'd rather close a path than document it - an allow-list that exists in production beats a diagram of how the network should look. • You change other teams' systems without breaking them - you roll out in observe mode first, measure, and earn the right to enforce. • You have relentlessly high standards - many people may think your standards are unreasonably high. You are continually raising the bar and driving those around you to deliver great results. You make sure that defects do not get sent down the line and that problems are fixed so they stay fixed. • You’re not bound by convention - your success—and much of the fun—lies in developing new ways to do things • You’re not bound by convention • You need action - speed matters in business. Many decisions and actions are reversible and do not need extensive study. We value calculated risk-taking. • You need action • You earn trust - you listen attentively, speak candidly, and treat others respectfully. • You earn trust • You have backbone; disagree, then commit - you can respectfully challenge decisions when you disagree, even when doing so is uncomfortable or exhausting. You have conviction and are tenacious. You do not compromise for the sake of social cohesion. Once a decision is determined, you commit wholly. • You have backbone; disagree, then commit • You deliver results - you focus on the key inputs and deliver them with the right quality and in a timely fashion. Despite setbacks, you rise to the occasion and never settle. • You deliver results • Sezzle’s Technology Stack: • Languages: Golang, Typescript, Python • Languages: • Frontend: Typescript - React and React Native • Frontend: • Backend: Golang • Backend: • Database: MySQL, Postgres, Elasticsearch • Database: • DevOps & Cloud: AWS, Kubernetes • DevOps & Cloud: • Version Control: Git • Version Control: • CI/CD: • Testing: Developer and AI-driven, focus on automated end-to-end, integration, and unit tests • Testing: • Open Source: Sezzle is focused on using open source, and we build what we can before buying! • Open Source: • What Makes Working at Sezzle Awesome? • At Sezzle, we are more than just brilliant engineers, passionate data enthusiasts, out-of-the-box thinkers, and determined innovators; we are skilled musicians, yogis, cyclists, chefs, golfers, dog-lovers, and rock-climbers. We believe in surrounding ourselves with not only the best and the brightest individuals, but those that are unique and purpose-driven in all that they do. Our culture is not defined by a certain set of perks designed to give the illusion of the traditional startup culture, but rather, it is the visible example living in every employee that we hire. • #Li-remote #Full-time
Responsibilities
• Own east-west segmentation across our Kubernetes clusters: design the segmentation model, derive network policies from observed traffic, and keep every workload reachable only through explicitly allowed, identity-bound paths — a default that holds as the estate grows, not a one-time project. • Deliver identity-aware transport — design and roll out mutually authenticated, encrypted service-to-service connections (mTLS), so that authorization decisions rest on verified service identity. • Keep a live map of the network: VPC peerings, tunnels, cross-account links, and every public entry point — built from cloud APIs and reconciled continuously, so every path into production is known and justified. • Own segmentation of production and the cardholder-data environment: implement and enforce the CDE and high-trust-tier boundaries, review every peering and public exposure against them, and run segmentation testing with the security team. • Partner with IT on private access: evaluate and help deliver per-application access (ZTNA) for engineers and operators reaching production systems. • Own network telemetry: flow logs east-west and north-south, with enough identity on both ends that "who talked to what, when" is answerable in minutes — and feed it to our SIEM for the detection team. • Own cluster admission control and hold the line on drift: workload admission policy (pod security, image provenance, network policy), security groups and firewall rules declared in git, applied only through the IaC pipeline, with admission control at the gate and drift detected and reverted automatically. • Contain: build the levers that let us isolate a workload or segment quickly when detection flags lateral movement, and take part in incident response when the network is in play. • Participate in threat modeling and design reviews for anything that changes how traffic flows, and in the on-call rotation for the controls you own. • What We Look For: • What We Look For: • 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments. • Deep, practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress — and experience rolling segmentation out on live clusters without outages. • Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, flow logs. • Hands-on experience with mTLS and service-to-service authentication (service mesh, proxies, or CNI-level encryption). • Infrastructure as code as your default way of working — Terraform and Helm or equivalents, through merge requests and CI, across repositories you don't own. • Ability to write real code (Go, Python, or Bash) for tooling and automation, not only configuration. • Ability to investigate directly with packet captures, flow logs, and system-level data. • Working knowledge of PCI DSS network requirements — segmentation, scoping of the cardholder-data environment, segmentation testing. • Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today and have opinions grounded in practice about where it helps and where it doesn't.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT