Senior Kubernetes Security Engineer & AI Automation Engineer

Role

Senior Kubernetes Security Engineer & AI Automation Engineer

Responsibilities

Microsegmentation & Network Security Architecture

• Own the design, implementation, and maintenance of pod-level network microsegmentation that enforces least-privilege communication between workloads across all Kubernetes environments.
• Define and enforce Kubernetes NetworkPolicies and service mesh or CNI-level policies (Cilium, Isovalent, Calico, Istio, Cisco Secure Workload), including default-deny baselines, namespace and tenant isolation, and egress controls.
• Map and model workload communication flows to build segmentation policy from observed behavior, then validate it in audit mode before enforcement to avoid production impact.
• Continuously monitor and optimize segmentation policies to balance security, performance, and developer productivity, and manage policy drift and exceptions with clear ownership.
• Define and maintain label and metadata taxonomies that align workloads with business unit ownership, data sensitivity, regulatory scope (banking regulatory, PCI-DSS), and accountability structures.
• Design mTLS and workload identity patterns, and align cluster segmentation with the broader zero-trust and network segmentation strategy for on-premises and cloud (AWS EKS, Azure AKS, GCP GKE) environments.
• Serve as the Kubernetes microsegmentation subject-matter expert for the security organization, troubleshooting complex network and policy issues, managing vendor escalations, and evaluating new tooling and features.

Kubernetes & Container Security, Monitoring, and Response

Harden Kubernetes clusters end to end

RBAC and least-privilege service accounts, admission controllers and policy engines (Kyverno, OPA Gatekeeper), Pod Security Standards, secrets management, and CIS Kubernetes Benchmark alignment.

• Implement container image scanning, signing, and provenance verification, and runtime protections across registries, build pipelines, and clusters.
• Collaborate with platform and DevOps teams to secure infrastructure as code (Terraform, Helm, Kustomize) and to make secure configuration the default path.
• Deploy and tune runtime detection tools (Falco, Cilium Tetragon, Sysdig, Prisma Cloud, Aqua) to monitor suspicious network and process activity.
• Work with SOC and IR teams to build detection rules, playbooks, and investigation workflows for Kubernetes network attacks, container escape, and lateral movement.
• Instrument cluster audit logs, network flow data, and runtime events into Splunk for correlation with broader security telemetry.

AI Agent Development & Security Automation (DevSecOps)

• Design, build, and operationalize AI agents that automate routine

Kubernetes security workflows

network policy generation and review, flow-log analysis, runtime alert triage, misconfiguration triage, exception request processing, and audit evidence assembly.

• Develop prompt-engineered investigation workflows that correlate runtime alerts, flow data, workload metadata, and threat intelligence to produce prioritized, analyst-ready findings.
• Build agents that propose least-privilege NetworkPolicy changes from observed traffic, open pull requests against policy repositories, and track them through review and enforcement.
• Create AI-driven monitoring agents that detect segmentation drift, unprotected namespaces, and policy bypass, and escalate or generate exception documentation when remediation deadlines are at risk.
• Integrate security policy enforcement into CI/CD pipelines, and automate deployment of baseline and workload-specific network policies through GitOps workflows.
• Continuously tune agent logic based on false-positive analysis, enforcement outcome data, and feedback from platform and development teams to improve accuracy and reduce noise.
• Evaluate and integrate Kubernetes, CNI, and security platform APIs into AI orchestration pipelines for programmatic policy management, data extraction, and automated evidence collection.

Advisory, Program Operations & Leadership

• Act as the subject-matter expert for microsegmentation and container security, advising platform, application, and infrastructure teams on secure workload design.
• Partner with application developers to define safe and secure communication patterns, and mentor teams on zero-trust networking and Kubernetes security best practices.
• Develop and maintain segmentation coverage KPIs, dashboards, and trend analyses that give leadership actionable risk visibility.
• Manage the policy exception and risk acceptance process, ensuring documentation meets regulatory and audit requirements.
• Maintain runbooks, architecture diagrams, and operational documentation that enable the broader security team to support Kubernetes security operations.
• Track the cloud-native threat landscape (Kubernetes CVEs, CISA KEV, vendor advisories) and translate emerging risks into actionable control and detection priorities.
• Lead projects independently and mentor junior engineers.

Qualifications

Required

• 3+ years focused on Kubernetes security in a production enterprise environment.
• Strong hands-on experience with Kubernetes NetworkPolicies and with tools such as Calico, Cilium, Istio, Isovalent, or Cisco Secure Workload.
• Proven track record designing and maintaining microsegmentation strategies at scale in Kubernetes.
• Proficiency with cloud-native platforms (AWS EKS, Azure AKS, GCP GKE).
• Experience with container security platforms and tools (Aqua, Prisma Cloud, Sysdig, Trivy, Falco).
• Scripting and automation skills in Python (strongly preferred), Go, or Bash for building integrations and automation.
• Familiarity with infrastructure-as-code tools (Terraform, Helm, Kustomize).
• Strong analytical and troubleshooting skills for complex network and security issues.
• Excellent communication skills to collaborate across Security, Platform, and Development teams.

Preferred

• Experience building or integrating AI/LLM-driven workflows for security operations (alert triage, policy generation, automated remediation orchestration).
• Familiarity with prompt engineering, AI orchestration frameworks, and API-driven automation patterns for security use cases.
• Certified Kubernetes Security Specialist (CKS) certification.
• Prior experience deploying zero-trust network architectures in Kubernetes.
• Knowledge of service mesh security models (mTLS, policy enforcement).
• Familiarity with compliance frameworks and their impact on Kubernetes networking (CIS Kubernetes Benchmark, PCI-DSS) in regulated financial services environments.