Sr. DevSecOps Engineer (Kubernetes Security) at Axos Financial in Manila

Job description

Axos Business Center, Corp About This Job As a Senior Kubernetes Security Engineer & AI Automation Engineer, you will be responsible in building an AI-native security organization that moves at the speed of the business. Our containerized infrastructure runs on Kubernetes across cloud and on-premises environments, and it carries the workloads that power digital banking. We are looking for a Senior Kubernetes Security Engineer & AI Automation Engineer who will own pod-level network microsegmentation and the ongoing security posture of our clusters, while pioneering AI agents that automate routine container security tasks at machine speed. This is not a scan-and-ticket role. You will design and enforce least-privilege communication between workloads, build AI-powered agents that eliminate analyst toil, and deliver segmentation and runtime protection that holds up under real lateral-movement pressure and regulatory scrutiny. Responsibilities Microsegmentation & Network Security Architecture Own the design, implementation, and maintenance of pod-level network microsegmentation that enforces least-privilege communication between workloads across all Kubernetes environments. Define and enforce Kubernetes NetworkPolicies and service mesh or CNI-level policies (Cilium, Isovalent, Calico, Istio, Cisco Secure Workload), including default-deny baselines, namespace and tenant isolation, and egress controls. Map and model workload communication flows to build segmentation policy from observed behavior, then validate it in audit mode before enforcement to avoid production impact. Continuously monitor and optimize segmentation policies to balance security, performance, and developer productivity, and manage policy drift and exceptions with clear ownership. Define and maintain label and metadata taxonomies that align workloads with business unit ownership, data sensitivity, regulatory scope (banking regulatory, PCI-DSS), and accountability structures. Design mTLS and workload identity patterns, and align cluster segmentation with the broader zero-trust and network segmentation strategy for on-premises and cloud (AWS EKS, Azure AKS, GCP GKE) environments. Serve as the Kubernetes microsegmentation subject-matter expert for the security organization, troubleshooting complex network and policy issues, managing vendor escalations, and evaluating new tooling and features. Kubernetes & Container Security, Monitoring, and Response Harden Kubernetes clusters end to end: RBAC and least-privilege service accounts, admission controllers and policy engines (Kyverno, OPA Gatekeeper), Pod Security Standards, secrets management, and CIS Kubernetes Benchmark alignment. Implement container image scanning, signing, and provenance verification, and runtime protections across registries, build pipelines, and clusters. Collaborate with platform and DevOps teams to secure infrastructure as code (Terraform, Helm, Kustomize) and to make secure configuration the default path. Deploy and tune runtime detection tools (Falco, Cilium Tetragon, Sysdig, Prisma Cloud, Aqua) to monitor suspicious network and process activity. Work with SOC and IR teams to build detection rules, playbooks, and investigation workflows for Kubernetes network attacks, container escape, and lateral movement. Instrument cluster audit logs, network flow data, and runtime events into Splunk for correlation with broader security telemetry. AI Agent Development & Security Automation (DevSecOps) Design, build, and operationalize AI agents that automate routine Kubernetes security workflows: network policy generation and review, flow-log analysis, runtime alert triage, misconfiguration triage, exception request processing, and audit evidence assembly. Develop prompt-engineered investigation workflows that correlate runtime alerts, flow data, workload metadata, and threat intelligence to produce prioritized, analyst-ready findings. Build agents that propose least-privilege NetworkPolicy changes from obser