Senior Security Engineer, Network & Zero Trust

NEPSE Trading; Argentina; Remote; ARS 84,512,000 - 160,573,000; Full time

Job summary

Sezzle Argentina is seeking a hands-on Senior Security Engineer, Network & Zero Trust, to own the network pillar of Sezzle's zero-trust program across Kubernetes, AWS, and interconnections. You will write policies, tooling, and rollout automation, collaborating with security, platform, and IAM teams.

This role emphasizes network segmentation, mTLS, and identity-bound service communication, with a focus on production security, PCI-DSS awareness, and scalable, auditable configurations.

Responsibilities

• Own east-west segmentation across Kubernetes clusters and derive network policies from observed traffic.
• Deliver identity-aware transport with mutual TLS between services.
• Maintain a live map of network topology including VPCs, peering, and public endpoints.
• Own segmentation of production and PCI-DSS scope boundaries, and run segmentation tests.
• Collaborate with IT on private per-application access (ZTNA) for production systems.
• Develop and maintain network telemetry, flow logs, and feed SIEM.
• Manage cluster admission control and drift detection with IaC pipelines.
• Contribute to threat modeling and incident response for network controls.

Job description

# Senior Security Engineer, Network & Zero TrustSezzleArgentinaFull timeRemoteUSD 5,000 – 9,500Apply by Dec 14, 2026## About the roleThe salary range for this role is $5,000 - $9,500 per month (Gross in USD) About Sezzle : With a mission to financially empower the next generation, Sezzle is revolutionizing the shopping experience beyond payments, blending cutting-edge tech with seamless, interest-free installment plans that make shopping smarter and more accessible. We’re not just transforming payments; we’re redefining how people discover, interact with, and purchase the things they love while driving real impact on merchant sales through increased conversions and higher order values. As we continue to shape the future of fintech and retail, we’re building an innovative, dynamic team passionate about creating more than just a transaction but a truly unique shopping journey.If you’re excited about pushing boundaries in tech and delivering a game-changing experience for consumers and merchants alike, come join us at Sezzle and help create the future of shopping! Compensation : For this principal development role, with 6+ years of experience, the compensation range is $5,000 - $9,500 USD per month, based on experience level and gross amount. This range acknowledges the extensive expertise, leadership capabilities, and significant contributions expected at this level, offering a competitive salary to reflect the value of advanced skills and experience About the Role: We are seeking a hands-on Senior Security Engineer, Network & Zero Trust , to own the network pillar of Sezzle 's zero-trust program: every connection explicitly allowed, authenticated by service identity, and attributable after the fact — across our Kubernetes clusters, AWS accounts, and the paths between them.You will take ownership of our network-policy program — default-deny micro-segmentation across our Kubernetes clusters — and carry the rest of the pillar forward with it: identity-aware service-to-service transport, per-application private access, flow-level visibility, and network configuration managed as reviewed code. This is an engineering role: you will write the policies, the tooling, and the rollout automation yourself, and you will carry changes through other teams' services without breaking delivery. You will report to the Director of Information Security and work alongside the engineers who own the security platform and detection and response, and with the platform and IAM teams on service identity — your network controls are what their work relies on, and your telemetry is what their detections run on.At Sezzle , AI-assisted engineering is a standard part of how we work. In this role you will use and build agentic workflows — flow analysis, policy generation from observed traffic, drift review — that let the team segment a large estate. What You’ll Do: Own east-west segmentation across our Kubernetes clusters: design the segmentation model, derive network policies from observed traffic, and keep every workload reachable only through explicitly allowed, identity-bound paths — a default that holds as the estate grows, not a one-time project.Deliver identity-aware transport — design and roll out mutually authenticated, encrypted service-to-service connections (mTLS), so that authorization decisions rest on verified service identity. Keep a live map of the network: VPC peerings, tunnels, cross-account links, and every public entry point — built from cloud APIs and reconciled continuously, so every path into production is known and justified. Own segmentation of production and the cardholder-data environment: implement and enforce the CDE and high-trust-tier boundaries, review every peering and public exposure against them, and run segmentation testing with the security team.Partner with IT on private access: evaluate and help deliver per-application access (ZTNA) for engineers and operators reaching production systems. Own network telemetry: flow logs east-west and north-south, with enough identity on both ends that \"who talked to what, when\" is answerable in minutes — and feed it to our SIEM for the detection team. Own cluster admission control and hold the line on drift: workload admission policy (pod security, image provenance, network policy), security groups and firewall rules declared in git, applied only through the IaC pipeline, with admission control at the gate and drift detected and reverted automatically.Contain: build the levers that let us isolate a workload or segment quickly when detection flags lateral movement, and take part in incident response when the network is in play. Participate in threat modeling and design reviews for anything that changes how traffic flows, and in the on-call rotation for the controls you own. What We Look For: 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments.Deep, practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress — and experience rolling segmentation out on live clusters without outages. Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, flow logs. Hands-on experience with mTLS and service-to-service authentication (service mesh, proxies, or CNI-level encryption).Infrastructure as code as your default way of working — Terraform and Helm or equivalents, through merge requests and CI, across repositories you don't own. Ability to write real code (Go, Python, or Bash) for tooling and automation, not only configuration. Ability to investigate directly with packet captures, flow logs, and system-level data.Working knowledge of PCI DSS network### requirements* — segmentation, scoping of the cardholder-data environment, segmentation testing* Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today and have opinions grounded in practice about where it helps and where it doesn't