Senior Kubernetes Security Engineer & AI Automation Engineer

About the role

This position supports a confidential U.S.-based digital financial institution, which is building an AI-native security organization. The containerized infrastructure runs on Kubernetes across cloud and on-premises environments and powers digital banking. The successful candidate will be assigned full-time to the client's cybersecurity organization, owning pod-level network microsegmentation, the ongoing security posture of the clusters, and AI agents that automate routine container security tasks.

Key responsibilities

• Own the design, implementation and maintenance of pod-level network microsegmentation enforcing least-privilege communication across all Kubernetes environments.
• Define and enforce Kubernetes NetworkPolicies and service mesh or CNI-level policies (Cilium, Isovalent, Calico, Istio, Cisco Secure Workload), including default-deny baselines, namespace isolation and egress controls.
• Map workload communication flows, validate segmentation policies in audit mode, and monitor policy drift and exceptions.
• Maintain label and metadata taxonomies aligned with business units, data sensitivity and regulatory scope (PCI-DSS), and design mTLS and workload identity patterns.
• Harden clusters end to end: RBAC, admission controllers and policy engines (Kyverno, OPA Gatekeeper), Pod Security Standards, secrets management and CIS Kubernetes Benchmark alignment.
• Implement container image scanning, signing and provenance verification, and deploy runtime detection tools (Falco, Cilium Tetragon, Sysdig, Prisma Cloud, Aqua).
• Work with SOC and IR teams on detection rules, playbooks and investigation workflows, and instrument audit logs and flow data into Splunk.
• Design and operate AI agents that automate network policy generation and review, flow-log analysis, alert triage, misconfiguration triage, exception handling and audit evidence assembly.
• Integrate security enforcement into CI/CD pipelines and use GitOps workflows to deploy baseline and workload-specific policies.
• Advise platform, application and infrastructure teams on secure workload design, mentor teams on zero-trust networking, and develop segmentation coverage KPIs and dashboards.
• Manage the policy exception and risk acceptance process, maintain runbooks and architecture diagrams, and track the cloud-native threat landscape (Kubernetes CVEs, CISA KEV, vendor advisories).