{"id":3464961,"url":"https://alion.io/job/axos-bank-sr-kubernetes-security-engineer","title":"Sr. Kubernetes Security Engineer","company":{"id":1988551,"name":"Axos Bank","domain":"axosbank.com","url":"https://alion.io/company/axosbank","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":33,"ghost_share":0,"stale_share":0.636,"repost_share":0,"time_to_fill_p50_days":53,"computed_at":"2026-11-01T06:10:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Manila, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":14500,"max_usd":33000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure AKS","optional":false},{"name":"Calico","optional":false},{"name":"CI/CD","optional":false},{"name":"Cilium","optional":false},{"name":"Cilium Tetragon","optional":false},{"name":"Falco","optional":false},{"name":"GCP","optional":false},{"name":"GitOps","optional":false},{"name":"Go","optional":false},{"name":"Google GKE","optional":false},{"name":"Helm","optional":false},{"name":"Istio","optional":false},{"name":"KEV","optional":false},{"name":"Kubernetes","optional":false},{"name":"Kustomize","optional":false},{"name":"Kyverno","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"OPA Gatekeeper","optional":false},{"name":"PCI DSS","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"Prompt Engineering","optional":false},{"name":"Python","optional":false},{"name":"Service Mesh","optional":false},{"name":"Splunk","optional":false},{"name":"Sysdig Secure","optional":false},{"name":"Terraform","optional":false},{"name":"Trivy","optional":false},{"name":"Zero Trust","optional":false},{"name":"Open Policy Agent","optional":true}],"status":"live","first_seen_at":"2026-10-28T00:00:00Z","employer_posted_date":"2026-10-28","last_verified_at":"2026-11-01T05:30:40Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Axos Business Center, CorpAbout This Job\nAs a Senior Kubernetes Security Engineer & AI Automation Engineer, you will be responsible in building an AI-native security organization that moves at the speed of the business. Our containerized infrastructure runs on Kubernetes across cloud and on-premises environments, and it carries the workloads that power digital banking. We are looking for a Senior Kubernetes Security Engineer & AI Automation Engineer who will own pod-level network microsegmentation and the ongoing security posture of our clusters, while pioneering AI agents that automate routine container security tasks at machine speed.This is not a scan-and-ticket role. You will design and enforce least-privilege communication between workloads, build AI-powered agents that eliminate analyst toil, and deliver segmentation and runtime protection that holds up under real lateral-movement pressure and regulatory scrutiny.\nResponsibilities\nMicrosegmentation & Network Security Architecture\nOwn the design, implementation, and maintenance of pod-level network microsegmentation that enforces least-privilege communication between workloads across all Kubernetes environments.\nDefine and enforce Kubernetes NetworkPolicies and service mesh or CNI-level policies (Cilium, Isovalent, Calico, Istio, Cisco Secure Workload), including default-deny baselines, namespace and tenant isolation, and egress controls.\nMap and model workload communication flows to build segmentation policy from observed behavior, then validate it in audit mode before enforcement to avoid production impact.\nContinuously monitor and optimize segmentation policies to balance security, performance, and developer productivity, and manage policy drift and exceptions with clear ownership.\nDefine and maintain label and metadata taxonomies that align workloads with business unit ownership, data sensitivity, regulatory scope (banking regulatory, PCI-DSS), and accountability structures.\nDesign mTLS and workload identity patterns, and align cluster segmentation with the broader zero-trust and network segmentation strategy for on-premises and cloud (AWS EKS, Azure AKS, GCP GKE) environments.\nServe as the Kubernetes microsegmentation subject-matter expert for the security organization, troubleshooting complex network and policy issues, managing vendor escalations, and evaluating new tooling and features.\nKubernetes & Container Security, Monitoring, and Response\nHarden Kubernetes clusters end to end: RBAC and least-privilege service accounts, admission controllers and policy engines (Kyverno, OPA Gatekeeper), Pod Security Standards, secrets management, and CIS Kubernetes Benchmark alignment.\nImplement container image scanning, signing, and provenance verification, and runtime protections across registries, build pipelines, and clusters.\nCollaborate with platform and DevOps teams to secure infrastructure as code (Terraform, Helm, Kustomize) and to make secure configuration the default path.\nDeploy and tune runtime detection tools (Falco, Cilium Tetragon, Sysdig, Prisma Cloud, Aqua) to monitor suspicious network and process activity.\nWork with SOC and IR teams to build detection rules, playbooks, and investigation workflows for Kubernetes network attacks, container escape, and lateral movement.\nInstrument cluster audit logs, network flow data, and runtime events into Splunk for correlation with broader security telemetry.\n AI Agent Development & Security Automation (DevSecOps)\nDesign, build, and operationalize AI agents that automate routine Kubernetes security workflows: network policy generation and review, flow-log analysis, runtime alert triage, misconfiguration triage, exception request processing, and audit evidence assembly.\nDevelop prompt-engineered investigation workflows that correlate runtime alerts, flow data, workload metadata, and threat intelligence to produce prioritized, analyst-ready findings.\nBuild agents that propose least-privilege NetworkPolicy changes from observed traffic, open pull requests against policy repositories, and track them through review and enforcement.\nCreate AI-driven monitoring agents that detect segmentation drift, unprotected namespaces, and policy bypass, and escalate or generate exception documentation when remediation deadlines are at risk.\nIntegrate security policy enforcement into CI/CD pipelines, and automate deployment of baseline and workload-specific network policies through GitOps workflows.\nContinuously tune agent logic based on false-positive analysis, enforcement outcome data, and feedback from platform and development teams to improve accuracy and reduce noise.\nEvaluate and integrate Kubernetes, CNI, and security platform APIs into AI orchestration pipelines for programmatic policy management, data extraction, and automated evidence collection.\nAdvisory, Program Operations & Leadership\nAct as the subject-matter expert for microsegmentation and container security, advising platform, application, and infrastructure teams on secure workload design.\nPartner with application developers to define safe and secure communication patterns, and mentor teams on zero-trust networking and Kubernetes security best practices.\nDevelop and maintain segmentation coverage KPIs, dashboards, and trend analyses that give leadership actionable risk visibility.\nManage the policy exception and risk acceptance process, ensuring documentation meets regulatory and audit requirements.\nMaintain runbooks, architecture diagrams, and operational documentation that enable the broader security team to support Kubernetes security operations.\nTrack the cloud-native threat landscape (Kubernetes CVEs, CISA KEV, vendor advisories) and translate emerging risks into actionable control and detection priorities.\nLead projects independently and mentor junior engineers.\nQualifications\nRequired\n3+ years focused on Kubernetes security in a production enterprise environment.\nStrong hands-on experience with Kubernetes NetworkPolicies and with tools such as Calico, Cilium, Istio, Isovalent, or Cisco Secure Workload.\nProven track record designing and maintaining microsegmentation strategies at scale in Kubernetes.\nProficiency with cloud-native platforms (AWS EKS, Azure AKS, GCP GKE).\nExperience with container security platforms and tools (Aqua, Prisma Cloud, Sysdig, Trivy, Falco).\nScripting and automation skills in Python (strongly preferred), Go, or Bash for building integrations and automation.\nFamiliarity with infrastructure-as-code tools (Terraform, Helm, Kustomize).\nStrong analytical and troubleshooting skills for complex network and security issues.\nExcellent communication skills to collaborate across Security, Platform, and Development teams.\nPreferred\nExperience building or integrating AI/LLM-driven workflows for security operations (alert triage, policy generation, automated remediation orchestration).\nFamiliarity with prompt engineering, AI orchestration frameworks, and API-driven automation patterns for security use cases.\nCertified Kubernetes Security Specialist (CKS) certification.\nPrior experience deploying zero-trust network architectures in Kubernetes.\nKnowledge of service mesh security models (mTLS, policy enforcement).\nFamiliarity with compliance frameworks and their impact on Kubernetes networking (CIS Kubernetes Benchmark, PCI-DSS) in regulated financial services environments.\nWhy This Role\nYou will build, not just govern. This team ships security tooling and automation, not slide decks.\nAI-first security organization: our autonomous SOC pipeline is live and you will extend AI-driven automation into Kubernetes and container security.\nDirect impact at a regulated U.S. financial institution where segmentation and workload isolation decisions are consequential and visible to leadership.\nWork alongside senior practitioners who value intellectual honesty, hands-on craft, and enforceable security over compliance theater.\nAbout Axos\nBorn digital-first, Axos delivers financial tools and services that allow individuals, small businesses, and companies to access and manage their money how, when, and where they want. We’re a diverse team of dynamic, insightful, and independent innovators who are excited to provide technology-driven solutions that offer unbeatable value to our customers.\nAxos Financial is our holding company and is publicly traded on the New York Stock Exchange under the symbol \"AX\" (NYSE: AX).\nLearn More about working at Axos Business Center\nPre-Employment Background Check, Medical, and Drug Test:\nAll offers are contingent upon the candidate successfully passing a credit check, criminal background check, and pre-employment medical and drug screening.\nEqual Employment Opportunity:\nAxos is an Equal Opportunity employer. We are committed to providing equal employment opportunities to all employees and applicants without regard to race, religious creed, color, sex (including pregnancy, breast feeding and related medical conditions), gender, gender identity, gender expression, sexual orientation, national origin, ancestry, citizenship status, military and veteran status, marital status, age, protected medical condition, genetic information, physical disability, mental disability, or any other protected status in accordance with all applicable federal, state, and local laws.\nJob Functions and Work Environment:\nWhile performing the duties of this position, the employee is required to sit for extended periods of time. Manual dexterity and coordination are required while operating standard office equipment such as computer keyboard and mouse, calculator, telephone, copiers, etc.\nThe work environment characteristics described here are representative of those an employee may encounter while performing the essential functions of this position. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of this position.","description_format":"text","description_chars":9919,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Digital Banks & Neobanks","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-10-29T15:08:11Z"}],"visa":[],"liveness":{"score":70,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.695,"p_room":1,"age_days":4,"expected_fill_days":53,"reasons":["conf:0","stale_co","urgency","velocity","win:early","comp:brand"],"computed_at":"2026-11-01T06:10:25Z"},"pay":null,"html_url":"https://alion.io/job/axos-bank-sr-kubernetes-security-engineer","json_url":"https://alion.io/job/axos-bank-sr-kubernetes-security-engineer.json","meta":{"generated_at":"2026-11-01T11:43:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18216,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1988551},"rest":"https://alion.io/mcp/rest/get_company?id=1988551"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faxos-bank-sr-kubernetes-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faxos-bank-sr-kubernetes-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faxos-bank-sr-kubernetes-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/axos-bank-sr-kubernetes-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faxos-bank-sr-kubernetes-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3464961}},{"tool":"search_jobs","arguments":{"company":"axosbank.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3464961},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}