Senior Security Engineer, Network & Zero Trust

Compensation:

The salary range for this role is $5,000 - $9,500 per month (Gross in USD). For this senior role, with 6+ years of experience, the compensation range is $5,000 - $9,500 USD per month, based on experience level and gross amount. This range acknowledges the extensive expertise, leadership capabilities, and significant contributions expected at this level.

About Sezzle:

With a mission to financially empower the next generation, Sezzle is revolutionizing the shopping experience beyond payments, blending cutting-edge tech with seamless, interest-free installment plans that make shopping smarter and more accessible. As we continue to shape the future of fintech and retail, we're building an innovative, dynamic team passionate about creating more than just a transaction but a truly unique shopping journey.

About the Role:

We are seeking a hands-on Senior Security Engineer, Network & Zero Trust, to own the network pillar of Sezzle's zero-trust program: every connection explicitly allowed, authenticated by service identity, and attributable after the fact, across our Kubernetes clusters, AWS accounts, and the paths between them.

You will take ownership of our network-policy program, default-deny micro-segmentation across our Kubernetes clusters, and carry the rest of the pillar forward with it: identity-aware service-to-service transport, per-application private access, flow-level visibility, and network configuration managed as reviewed code.

This is an engineering role: you will write the policies, the tooling, and the rollout automation yourself, and you will carry changes through other teams' services without breaking delivery. You will report to the Director of Information Security and work alongside the engineers who own the security platform and detection and response, and with the platform and IAM teams on service identity.

At Sezzle, AI-assisted engineering is a standard part of how we work. In this role you will use and build agentic workflows, including flow analysis, policy generation from observed traffic, and drift review, that let the team segment a large estate.

What You'll Do:

• Own east-west segmentation across our Kubernetes clusters: design the segmentation model, derive network policies from observed traffic, and keep every workload reachable only through explicitly allowed, identity-bound paths.
• Deliver identity-aware transport by designing and rolling out mutually authenticated, encrypted service-to-service connections (mTLS).
• Keep a live map of the network, including VPC peerings, tunnels, cross-account links, and every public entry point, reconciled continuously from cloud APIs.
• Own segmentation of production and the cardholder-data environment, implementing and enforcing CDE and high-trust-tier boundaries and running segmentation testing with the security team.
• Partner with IT on private access, evaluating and helping deliver per-application access (ZTNA) for engineers and operators reaching production systems.
• Own network telemetry, including east-west and north-south flow logs with identity on both ends, and feed it to the SIEM for the detection team.
• Own cluster admission control and drift: workload admission policy, security groups and firewall rules declared in git, applied only through the IaC pipeline, with drift detected and reverted automatically.
• Contain threats by building the levers to isolate a workload or segment quickly when detection flags lateral movement, and take part in incident response when the network is involved.
• Participate in threat modeling and design reviews for changes to traffic flow, and in the on-call rotation for the controls you own.

What We Look For:

• 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments.
• Deep, practical Kubernetes networking knowledge: CNI, NetworkPolicy semantics, DNS, ingress/egress, and experience rolling segmentation out on live clusters without outages.
• Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, flow logs.
• Hands-on experience with mTLS and service-to-service authentication (service mesh, proxies, or CNI-level encryption).
• Infrastructure as code as your default way of working: Terraform and Helm or equivalents, through merge requests and CI, across repositories you don't own.
• Ability to write real code (Go, Python, or Bash) for tooling and automation.
• Ability to investigate directly with packet captures, flow logs, and system-level data.
• Working knowledge of PCI DSS network requirements, including segmentation, CDE scoping, and segmentation testing.
• Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today.

Preferred Knowledge and Skills:

• Cilium / eBPF in production, including Hubble or equivalent flow observability.
• mTLS at fleet scale, including certificate lifecycle, service mesh (e.g., Istio, Linkerd, Cilium service mesh), and workload identity standards such as SPIFFE/SPIRE.
• Experience building AI-assisted workflows for flow analysis, policy generation, and drift review.
• Experience evaluating or deploying ZTNA / identity-aware proxy products.
• Policy-as-code and admission control (OPA/Gatekeeper, Kyverno, conftest).
• Experience with network detection (IDS/IPS, anomalous-flow and lateral-movement detection) and with containment during incidents.
• Familiarity with SOC 2 and with FFIEC-style examination expectations for network security.
• Experience in fintech, payments, BNPL, or other regulated environments.

About You:

• You'd rather close a path than document it. An allow-list that exists in production beats a diagram of how the network should look.
• You change other teams' systems without breaking them. You roll out in observe mode first, measure, and earn the right to enforce.
• You have relentlessly high standards and make sure defects do not get sent down the line and problems stay fixed.
• You're not bound by convention; you develop new ways to do things.
• You need action. You value calculated risk-taking.
• You earn trust by listening attentively, speaking candidly, and treating others respectfully.
• You have backbone: you disagree, then commit. You respectfully challenge decisions and, once a decision is made, commit wholly.
• You deliver results with the right quality and in a timely fashion, and you never settle.

Sezzle's Technology Stack:

• Languages: Golang, Typescript, Python
• Frontend: Typescript, React and React Native
• Backend: Golang
• Database: MySQL, Postgres, Elasticsearch
• DevOps & Cloud: AWS, Kubernetes
• Version Control: Git
• CI/CD: Gitlab
• Testing: Developer and AI-driven, focused on automated end-to-end, integration, and unit tests
• Open Source: Sezzle is focused on using open source, and builds what it can before buying.

What Makes Working at Sezzle Awesome?

At Sezzle, we are more than just brilliant engineers, passionate data enthusiasts, out-of-the-box thinkers, and determined innovators. We believe in surrounding ourselves with the best and the brightest individuals who are unique and purpose-driven in all that they do. Our culture is defined by the visible example living in every employee that we hire.