Senior Associate Cryptography Researcher

Responsibilities:

• Understand system architecture and data flows, and identify where encryption, signing, authentication, and key management are needed.
• Design and implement cryptographic solutions: encryption, digital signatures, hashing, key derivation, secure key storage, and secure transport.
• Build and maintain Java SDKs and libraries with clean APIs, versioning, documentation, and backward compatibility.
• Implement and troubleshoot PKI components: X.509 certificates, chain validation, CSRs, CRL/OCSP, and TLS/mTLS configuration.
• Integrate with HSMs and key management systems (PKCS#11), and design key lifecycle processes: generation, rotation, backup, and destruction.
• Take part in threat modelling and design reviews, and recommend algorithms, key sizes, and parameters with clear reasoning.
• Remediate findings from code reviews, static and dynamic analysis, penetration tests, and audits.
• Write unit, integration, and negative tests, including known-answer tests with standard test vectors.
• Support teams that integrate the SDK, and produce technical documentation and compliance evidence.
• Follow developments in post-quantum cryptography (ML-KEM, ML-DSA, hybrid key exchange or Newer PQC algorithm) and help assess their impact on our systems.

Required Skills Cryptography (must be able to explain the reasoning, not only the usage)

• Symmetric encryption (AES; GCM, CBC, CTR modes) and the consequences of nonce/IV misuse.
• Asymmetric cryptography: RSA (OAEP, PSS), ECC (ECDSA, ECDH, Ed25519, X25519).
• Hashing, HMAC, key derivation (HKDF, PBKDF2), and secure random generation.
• Authenticated encryption and key management principles. PKI and protocols
• X.509, certificate lifecycle, trust chain validation.
• TLS 1.2/1.3 and mTLS: handshake, cipher suites, session resumption.
• JWT/JWS/JWE, OAuth2, and signature formats such as CMS/PKCS#7. Development
• Strong Java (Java 8 or later): collections, concurrency, exception handling, JVM basics.
• Hands-on experience with JCA/JCE and Bouncy Castle. Use of vetted libraries only, no custom algorithms.
• Experience building reusable libraries or SDKs with Maven or Gradle.
• Git, CI/CD, JUnit, and Mockito. Security engineering
• Secure coding practices (OWASP Top 10): constant-time comparison, safe error handling, no secrets in logs.
• Understanding of threat modelling and trust boundaries.

Education: B.E./B.Tech/MCA or equivalent in Computer Science, IT, Electronics, or a related field. Good to Have

• Android development: Android Keystore, secure storage, AAR packaging.
• HSM experience (PKCS#11) and key management systems.
• Experience in payments, banking, or fintech security (PCI DSS, RBI guidelines, ISO 27001).
• Knowledge of TLS stacks and gateways (OpenSSL, Tomcat, Bouncy Castle JSSE).
• Familiarity with SAST/DAST tools, Kotlin, Spring Boot, or Docker.

• Security certifications or open-source contributions.