Sr. DevSecOps Engineer (Kubernetes Security)

Axos Clearing LLC; Manila; On-site; PHP 1,800,000 - 2,400,000; Full time

Job summary

Axos Business Center seeks a Sr. Kubernetes Security Engineer to design and implement secure pod-level network segmentation across on-prem and cloud Kubernetes clusters. You will enforce least-privilege policies, build AI-driven automation, and work with SOC teams on incident response.

The role emphasizes zero-trust, container security tooling, and collaboration with Platform and Development teams to keep security posture strong in a regulated banking environment.

Qualifications

• 3+ years focused on Kubernetes security in a production enterprise environment.
• Hands-on experience with Kubernetes NetworkPolicies and tools like Calico, Cilium, Istio, Isovalent, or Cisco Secure Workload.
• Experience with cloud-native platforms (AWS EKS, Azure AKS, GCP GKE) and container security tools.

Responsibilities

• Design and enforce pod-level network microsegmentation with least-privilege communications.
• Define Kubernetes NetworkPolicies, service mesh/CNI policies, and segmentation baselines.
• Harden clusters end-to-end including RBAC, admission controls, and CIS benchmarks.
• Develop AI-driven security automation to reduce analyst toil and accelerate responses.

Skills

Kubernetes security

NetworkPolicies

Calico

Cilium

Istio

AWS EKS

Azure AKS

GCP GKE

Python

Go

Bash

Terraform

Helm

Kustomize

Falco

Trivy

Sysdig

Prisma Cloud

Aqua

Tools

Aqua

Prisma Cloud

Sysdig

Trivy

Falco

Job description

Sr. Kubernetes Security EngineerYou may choose to display a cookie banner on the external site. You must specify the message in the cookie banner and may add a link to a relevant policy. If you are unfamiliar with these requirements, please seek the advice of legal counsel.# Careers Home## Sr. Kubernetes Security EngineerApply: Onsite: Manila, Philippines: Full time: Posted Yesterday: JR5833Axos Business Center, Corp**About This Job**As a Senior Kubernetes Security Engineer & AI Automation Engineer, you will be responsible in building an AI-native security organization that moves at the speed of the business. Our containerized infrastructure runs on Kubernetes across cloud and on-premises environments, and it carries the workloads that power digital banking. We are looking for a Senior Kubernetes Security Engineer & AI Automation Engineer who will own pod-level network microsegmentation and the ongoing security posture of our clusters, while pioneering AI agents that automate routine container security tasks at machine speed. This is not a scan-and-ticket role. You will design and enforce least-privilege communication between workloads, build AI-powered agents that eliminate analyst toil, and deliver segmentation and runtime protection that holds up under real lateral-movement pressure and regulatory scrutiny.**Responsibilities** **Microsegmentation & Network Security Architecture** * Own the design, implementation, and maintenance of pod-level network microsegmentation that enforces least-privilege communication between workloads across all Kubernetes environments.* Define and enforce Kubernetes NetworkPolicies and service mesh or CNI-level policies (Cilium, Isovalent, Calico, Istio, Cisco Secure Workload), including default-deny baselines, namespace and tenant isolation, and egress controls.* Map and model workload communication flows to build segmentation policy from observed behavior, then validate it in audit mode before enforcement to avoid production impact.* Continuously monitor and optimize segmentation policies to balance security, performance, and developer productivity, and manage policy drift and exceptions with clear ownership.* Define and maintain label and metadata taxonomies that align workloads with business unit ownership, data sensitivity, regulatory scope (banking regulatory, PCI-DSS), and accountability structures.* Design mTLS and workload identity patterns, and align cluster segmentation with the broader zero-trust and network segmentation strategy for on-premises and cloud (AWS EKS, Azure AKS, GCP GKE) environments.* Serve as the Kubernetes microsegmentation subject-matter expert for the security organization, troubleshooting complex network and policy issues, managing vendor escalations, and evaluating new tooling and features. **Kubernetes & Container Security, Monitoring, and Response*** Harden Kubernetes clusters end to end: RBAC and least-privilege service accounts, admission controllers and policy engines (Kyverno, OPA Gatekeeper), Pod Security Standards, secrets management, and CIS Kubernetes Benchmark alignment.* Implement container image scanning, signing, and provenance verification, and runtime protections across registries, build pipelines, and clusters.* Collaborate with platform and DevOps teams to secure infrastructure as code (Terraform, Helm, Kustomize) and to make secure configuration the default path.* Deploy and tune runtime detection tools (Falco, Cilium Tetragon, Sysdig, Prisma Cloud, Aqua) to monitor suspicious network and process activity.* Work with SOC and IR teams to build detection rules, playbooks, and investigation workflows for Kubernetes network attacks, container escape, and lateral movement.* Instrument cluster audit logs, network flow data, and runtime events into Splunk for correlation with broader security telemetry.**AI Agent Development & Security Automation (DevSecOps)*** Design, build, and operationalize AI agents that automate routine Kubernetes security workflows: network policy generation and review, flow-log analysis, runtime alert triage, misconfiguration triage, exception request processing, and audit evidence assembly.* Develop prompt-engineered investigation workflows that correlate runtime alerts, flow data, workload metadata, and threat intelligence to produce prioritized, analyst-ready findings.* Build agents that propose least-privilege NetworkPolicy changes from observed traffic, open pull requests against policy repositories, and track them through review and enforcement.* Create AI-driven monitoring agents that detect segmentation drift, unprotected namespaces, and policy bypass, and escalate or generate exception documentation when remediation deadlines are at risk.* Integrate security policy enforcement into CI/CD pipelines, and automate deployment of baseline and workload-specific network policies through GitOps workflows.* Continuously tune agent logic based on false-positive analysis, enforcement outcome data, and feedback from platform and development teams to improve accuracy and reduce noise.* Evaluate and integrate Kubernetes, CNI, and security platform APIs into AI orchestration pipelines for programmatic policy management, data extraction, and automated evidence collection. **Advisory, Program Operations & Leadership*** Act as the subject-matter expert for microsegmentation and container security, advising platform, application, and infrastructure teams on secure workload design.* Partner with application developers to define safe and secure communication patterns, and mentor teams on zero-trust networking and Kubernetes security best practices.* Develop and maintain segmentation coverage KPIs, dashboards, and trend analyses that give leadership actionable risk visibility.* Manage the policy exception and risk acceptance process, ensuring documentation meets regulatory and audit requirements.* Maintain runbooks, architecture diagrams, and operational documentation that enable the broader security team to support Kubernetes security operations.* Track the cloud-native threat landscape (Kubernetes CVEs, CISA KEV, vendor advisories) and translate emerging risks into actionable control and detection priorities.* Lead projects independently and mentor junior engineers. **Qualifications****Required*** 3+ years focused on Kubernetes security in a production enterprise environment.* Strong hands-on experience with Kubernetes NetworkPolicies and with tools such as Calico, Cilium, Istio, Isovalent, or Cisco Secure Workload.* Proven track record designing and maintaining microsegmentation strategies at scale in Kubernetes.* Proficiency with cloud-native platforms (AWS EKS, Azure AKS, GCP GKE).* Experience with container security platforms and tools (Aqua, Prisma Cloud, Sysdig, Trivy, Falco).* Scripting and automation skills in Python (strongly preferred), Go, or Bash for building integrations and automation.* Familiarity with infrastructure-as-code tools (Terraform, Helm, Kustomize).* Strong analytical and troubleshooting skills for complex network and security issues.* Excellent communication skills to collaborate across Security, Platform, and Development teams. **Preferred*** Experience building or integrating AI/LLM-driven workflows for security operations (alert triage, policy generation, automated remediation orchestration).* Familiarity with prompt engineering, AI orchestration frameworks, and API-driven automation patterns for security use cases.* Certified Kubernetes Security Specialist (CKS) certification.* Prior experience deploying zero-trust network architectures in Kubernetes.* Knowledge of service mesh security models (mTLS, policy enforcement).* Familiarity with compliance frameworks and their impact on Kubernetes networking (CIS Kubernetes Benchmark, PCI-DSS) in regulated financial services environments. **Why This Role*** You will build, not just govern. This team ships security tooling and automation, not slide decks.* AI-first security organization: our autonomous SOC pipeline is live and you will extend AI-driven automation into Kubernetes and container security.* Direct impact at a regulated U.S. financial institution where segmentation and workload isolation decisions are consequential and visible to leadership.* Work alongside senior practitioners who value intellectual honesty, hands-on craft, and enforceable security over compliance theater.**About Axos**Born digital-first, Axos delivers financial tools and services that allow individuals, small businesses, and companies to access and manage their money how, when, and where they want. We’re a diverse team of dynamic, insightful, and independent innovators who are excited to provide technology-driven solutions that offer unbeatable value to our customers.Axos Financial is our holding company and is publicly traded on the New York Stock Exchange under the symbol \"AX\" (NYSE: AX).Learn More about working at Axos Business Center**Pre-Employment Background Check, Medical, and Drug Test:**All offers are contingent upon the candidate successfully passing a credit check, criminal background check, and pre-employment medical and drug screening. **Equal Employment Opportunity:**Axos is an Equal Opportunity employer. We are committed to providing equal employment opportunities to all employees and applicants without regard to race, religious creed, color, sex (including pregnancy, breast feeding and related medical conditions), gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship status, military and veteran status, marital status, age, protected medical condition, genetic information, physical disability, mental disability, or any other protected status in accordance with all applicable federal, state, and local laws.**Job Functions and Work Environment:**While performing the duties of this position, the employee is required to sit for extended periods of time. Manual dexterity and coordination are required while operating standard office equipment such as computer keyboard and mouse, calculator, telephone, copiers, etc.The work environment characteristics described here are representative of those an employee may encounter while performing the essential functions of this position. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of this position.