Senior Security Engineer, Network & Zero Trust

Compensation:

The salary range for this role is $5,000 - $9,500 per month (Gross in USD). For this senior-level role with 6+ years of experience, the compensation range is $5,000 - $9,500 USD per month, based on experience level and gross amount. This range acknowledges the extensive expertise, leadership capabilities, and significant contributions expected at this level.

About Sezzle:

With a mission to financially empower the next generation, Sezzle is revolutionizing the shopping experience beyond payments, blending cutting-edge tech with seamless, interest-free installment plans that make shopping smarter and more accessible. Sezzle is building an innovative, dynamic team focused on fintech and retail, and on driving real impact on merchant sales through increased conversions and higher order values.

About the Role:

We are seeking a hands-on Senior Security Engineer, Network & Zero Trust, to own the network pillar of Sezzle's zero-trust program: every connection explicitly allowed, authenticated by service identity, and attributable after the fact, across our Kubernetes clusters, AWS accounts, and the paths between them.

You will take ownership of our network-policy program, including default-deny micro-segmentation across our Kubernetes clusters, and carry the rest of the pillar forward with identity-aware service-to-service transport, per-application private access, flow-level visibility, and network configuration managed as reviewed code.

This is an engineering role: you will write the policies, the tooling, and the rollout automation yourself, and carry changes through other teams' services without breaking delivery. You will report to the Director of Information Security and work with the security platform, detection and response, platform, and IAM teams.

AI-assisted engineering is a standard part of how Sezzle works. You will use and build agentic workflows for flow analysis, policy generation from observed traffic, and drift review.

What You'll Do:

• Own east-west segmentation across Kubernetes clusters: design the segmentation model, derive network policies from observed traffic, and keep every workload reachable only through explicitly allowed, identity-bound paths.
• Deliver identity-aware transport by designing and rolling out mutually authenticated, encrypted service-to-service connections (mTLS).
• Keep a live map of the network, including VPC peerings, tunnels, cross-account links, and every public entry point, reconciled continuously from cloud APIs.
• Own segmentation of production and the cardholder-data environment, implementing CDE and high-trust-tier boundaries and running segmentation testing with the security team.
• Partner with IT on per-application private access (ZTNA) for engineers and operators reaching production systems.
• Own network telemetry, including east-west and north-south flow logs with identity on both ends, and feed them to the SIEM for the detection team.
• Own cluster admission control and drift: workload admission policy, security groups, and firewall rules declared in git and applied only through the IaC pipeline.
• Build containment levers to isolate workloads or segments quickly when detection flags lateral movement, and take part in incident response.
• Participate in threat modeling and design reviews, and in the on-call rotation for the controls you own.

What We Look For:

• 6+ years of experience in security, network, platform, or infrastructure engineering, with hands-on ownership of network controls in cloud production environments.
• Deep, practical Kubernetes networking knowledge (CNI, NetworkPolicy semantics, DNS, ingress/egress) and experience rolling out segmentation on live clusters without outages.
• Strong AWS networking: VPCs, subnets, security groups, peering and Transit Gateway, PrivateLink, load balancers, flow logs.
• Hands-on experience with mTLS and service-to-service authentication (service mesh, proxies, or CNI-level encryption).
• Infrastructure as code as your default way of working, using Terraform and Helm or equivalents through merge requests and CI.
• Ability to write real code (Go, Python, or Bash) for tooling and automation.
• Ability to investigate directly with packet captures, flow logs, and system-level data.
• Working knowledge of PCI DSS network requirements, including segmentation, CDE scoping, and segmentation testing.
• Demonstrated AI-forward engineering, actively using AI tooling in your work today.

Preferred Knowledge and Skills:

• Cilium / eBPF in production, including Hubble or equivalent flow observability.
• mTLS at fleet scale, including certificate lifecycle, service mesh (e.g., Istio, Linkerd, Cilium service mesh), and workload identity standards such as SPIFFE/SPIRE.
• Experience building AI-assisted workflows for flow analysis, policy generation, and drift review.
• Experience evaluating or deploying ZTNA or identity-aware proxy products.
• Policy-as-code and admission control (OPA/Gatekeeper, Kyverno, conftest).
• Experience with network detection (IDS/IPS, anomalous-flow and lateral-movement detection) and containment during incidents.
• Familiarity with SOC 2 and FFIEC-style examination expectations for network security.
• Experience in fintech, payments, BNPL, or other regulated environments.

About You:

• You'd rather close a path than document it.
• You change other teams' systems without breaking them, rolling out in observe mode first, measuring, and earning the right to enforce.
• You have relentlessly high standards and make sure defects do not get sent down the line.
• You are not bound by convention and enjoy developing new ways to do things.
• You need action and value calculated risk-taking.
• You earn trust by listening attentively, speaking candidly, and treating others respectfully.
• You have backbone: you disagree, then commit.
• You deliver results and rise to the occasion despite setbacks.

Sezzle's Technology Stack:

• Languages: Golang, Typescript, Python
• Frontend: Typescript, React and React Native
• Backend: Golang
• Database: MySQL, Postgres, Elasticsearch
• DevOps & Cloud: AWS, Kubernetes
• Version Control: Git
• CI/CD: GitLab
• Testing: Developer and AI-driven, focused on automated end-to-end, integration, and unit tests
• Open Source: Sezzle is focused on using open source and builds what it can before buying.

What Makes Working at Sezzle Awesome?

Sezzle believes in surrounding itself with the best and most unique, purpose-driven people. Its culture is defined by the visible example of every employee rather than a set of perks.