You can exclude your job from sidecar injection by adding the annotation:

annotations:
  sidecar.istio.io/inject: "false"

Or, if you need the job inside mesh - you can add ServiceEntry and DestinationRule which will allow traffic to 10.96.0.1:443