Cryptographic Security Engineer

Cryptographic Engineer

Role Summary

The Cryptographic Engineer is a hands-on technical role responsible for supporting, implementing, and improving the organization's cryptographic platforms with a strong emphasis on operational stability, automation, and risk reduction.

This role operates at the intersection of Cryptography, PKI, Certificate Lifecycle Management, Cloud Key Management, and Security Automation. The engineer will help maintain and enhance cryptographic services while contributing to strategic initiatives such as certificate lifecycle automation, cloud encryption adoption, and post-quantum cryptography readiness.

Responsibilities

Cryptographic Engineering & Operations

• Support and enhance enterprise cryptographic platforms including:
  • Public Key Infrastructure (PKI)
  • TLS and certificate lifecycle management
  • Cloud key management services (AWS KMS, Azure Key Vault)
  • Hardware Security Modules (HSMs)
• Apply cryptographic best practices related to:
  • Cryptographic algorithms and protocols
  • Key management and protection
  • Certificate trust models and lifecycle controls
• Perform and support day-to-day cryptographic operations including:
  • Certificate issuance, renewal, revocation, and validation
  • Key rotation and lifecycle management activities
  • Monitoring and responding to certificate and encryption-related incidents
  • Troubleshooting cryptographic service disruptions and operational issues
• Hands-on experience with one or more of the following:
  • Venafi (TLS Protect / Trust Protection Platform) or equivalent certificate management solutions
  • Thales CipherTrust, Luna HSM, or similar key management technologies
  • ServiceNow workflows, CMDB, or operational processes
• Experience with scripting or automation using:
  • Python
  • PowerShell
  • Bash or similar languages
• Familiarity with REST APIs and system integrations.
• Strong troubleshooting, analytical, and problem-solving skills.
• Assist with API-based integrations to improve certificate and key management processes.

Post-Quantum Cryptography & Emerging Technologies

• Participate in the organization's post-quantum cryptography (PQC) readiness initiatives by:
  • Assisting with cryptographic inventory efforts
  • Identifying quantum-vulnerable algorithms and systems
  • Supporting crypto-agility assessments
  • Evaluating emerging cryptographic technologies and standards
• Stay current with industry developments including NIST guidance, PQC standards, and evolving cryptographic best practices.

Required Qualifications

• 3+ years of experience in Information Security, PKI, Cryptography, Infrastructure Security, or Security Engineering.
• Experience implementing, supporting, or administering enterprise certificate management solutions.
• Working knowledge of:
  • TLS and X.509 certificates
  • PKI concepts and certificate lifecycle management
  • Cryptographic key management
  • Hardware Security Modules (HSMs)

Hours & Work Schedule

• Hours per Week: 40
• Work Schedule: Monday through Friday, 8:30am - 5:00pm with on call rotation flexibility

Pay Transparency

The salary range for this position is $80,000 - 110,000 per year, plus an opportunity to earn additional incentive earnings (if applicable). Actual pay is based on various factors including, but not limited to, the budget, work location, and relevant skills and experience. We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more. Note, Citizens’ paid time off policy exceeds the mandatory, paid sick or paid time-away policy of every local and state jurisdiction in the United States. For an overview of our benefits, visit Citizens Benefits