System Security Engineer

Overview

The role requires managing coordination among IT security architects, implementation partners, and various teams focusing on cryptography and Post-Quantum Cryptography (PQC) transition support.

Key Duties

• Collaborate intensively with IT Security Architects specializing in Cryptography and PKI, implementation partners such as CLM and EKMS, certificate authority operators, and application stakeholders to deploy and manage certificate and key management solutions using advanced technologies and methodologies.
• Facilitate requirement workshops with application and platform teams to assess certificate and key management needs comprehensively across both on-premises and AWS cloud environments.
• Influence and review design plans of CLM and EKMS solutions ensuring alignment with security standards and operational requirements, demonstrating expert knowledge in PKI, certificate lifecycle management, and key administration.
• Establish, optimize, and refine operational workflows related to certificate and key management including issuance, renewal, revocation, discovery, rotation, and escrow to reduce outage risks from expiration.
• Integrate cryptographic and key management best practices such as FIPS, NIST guidelines, X.509 standards, and PKCS into processes and configuration management.
• Oversee day-to-day operational issues concerning certificates, cryptographic keys, and hardware security modules (HSMs), providing guidance to application teams on resolving such incidents.
• Maintain productive vendor partnerships with companies like CyberArk, AgileSec, and Entrust nShield to guarantee ongoing support and knowledge transfer related to cryptographic tools and infrastructure.
• Coordinate projects involving internal teams and external vendors focusing on CLM and EKMS deployment and operational activities.
• Support cryptographic asset discovery and inventory activities foundational to the PQC migration initiative and prepare for a cryptography engineer role during hybrid-PQC adoption.

Candidate Profile and Requirements

• A bachelor’s degree in Computer Science, Information Technology, or relevant disciplines is mandatory.
• Minimum five years of professional experience including at least two years directly handling Public Key Infrastructure (PKI), certificate lifecycle, or enterprise key management, preferably within the financial services or banking sector.
• Solid foundational knowledge of cryptography principles, associated controls, and operational processes encompassing X.509 certificates, TLS/mTLS protocols, PKCS standards, certificate authorities, key hierarchies, and HSM-based key protection.
• Proven hands-on experience implementing or managing Certificate Lifecycle Management solutions such as CyberArk Venafi, Keyfactor, or Entrust, including capabilities like discovery, policy enforcement, automated enrollment and renewal, and certificate authority integration.
• Hands-on familiarity with enterprise key management solutions and HSM devices like Entrust nShield, Thales CipherTrust, or AWS KMS/CloudHSM, including knowledge of Security World frameworks and key ceremony procedures.
• Experienced in integrating security platforms with enterprise systems via REST APIs, covering IT Service Management tools like ServiceNow, IAM/SSO solutions such as PingOne, security monitoring tools including Splunk and Datadog, and vulnerability assessment scanners like Nessus.
• Proficiency in scripting or programming for automation purposes using languages such as Python, PowerShell, or Bash.
• Attention to detail, strong analytical capacity, and enjoyment in resolving complex operational challenges.
• Experience working within Software Development Life Cycle (SDLC) or Agile frameworks like Scrum or Kanban.
• Excellent communication, interpersonal skills, and the ability to work collaboratively with diverse teams and external vendors.