Backend Java Developer

About the role

We have partnered with our client in their search for a TLS Security SME for a contract opportunity in Plano, TX. Seeking a hands-on TLS Security Contractor to support engineering and security teams in understanding, assessing, and modernizing TLS across mainframe environments. The contractor will be able to clearly explain the TLS negotiation protocol, evaluate cipher suite composition and strength (key exchange, authentication, encryption modes/"blocking schemes", AEAD vs CBC, PFS), and partner with multiple groups to drive a structured journey to TLS 1.3-only where feasible.

Responsibilities

• Explain and document TLS negotiation (mainframe context)
• Describe TLS handshake mechanics across versions (TLS 1.2 vs TLS 1.3), including version/cipher negotiation, extensions (as applicable), certificate exchange/validation, key agreement, and session resumption.
• Translate handshake outcomes into actionable guidance for mainframe-aligned teams (application, middleware, network, and platform/security).
• Cipher suite and crypto assessment: break down cipher suite "make-up" (key exchange/authentication, symmetric encryption mode, integrity mechanism) and explain security properties (PFS, AEAD vs CBC+HMAC, downgrade protections).
• Assess existing TLS 1.2 posture for weak/legacy algorithms and parameters (e.g., RSA key exchange vs (EC)DHE, CBC risks, SHA-1 concerns), and recommend hardened baselines aligned to modern crypto standards and platform constraints.
• Drive a TLS 1.3-only migration journey across mainframes: partner with mainframe platform teams and dependent distributed teams to inventory TLS endpoints and flows (client/server and mTLS where used), map dependencies, and identify blockers.
• Create phased migration plans: enablement, dual-stack (1.2+1.3), telemetry, client readiness validation, deprecation, and final enforcement to TLS 1.3-only.
• Coordinate testing and cutover approaches suitable for mainframe-integrated services (compatibility, performance, handshake success rates, certificate rotation impacts).
• Support remediation for applications/clients unable to negotiate TLS 1.3 (upgrade paths, configuration changes, controlled exceptions with time-bound plans).
• Operational support and governance: establish/maintain TLS standards and runbooks for mainframe environments (baseline configs, exception process, rollback approach).
• Define monitoring and reporting (handshake failures, negotiated versions/ciphers, certificate hygiene/expiry posture).
• Provide advisory support during deployments and incident triage related to TLS.

Skills

• Strong working knowledge of TLS 1.2 and TLS 1.3, including handshake differences, downgrade prevention, and session resumption mechanisms.
• Proven ability to assess and explain cipher suite composition and security implications (CBC vs AEAD; RSA key exchange vs (EC)DHE; curve choices; signature algorithms).
• Experience executing or supporting TLS hardening / modernization programs spanning multiple teams and technology domains.
• Practical troubleshooting capability using Wireshark (packet capture analysis, TLS handshake tracing, identifying negotiation/cipher/version issues, diagnosing handshake failures).
• Ability to communicate clearly with both security stakeholders and mainframe/distributed engineering teams; strong documentation skills.

Qualifications

• Bachelor's Degree or equivalent
• 4+ years of experience
• Title: Mainframe Infrastructure Engineer
• Location: Plano, TX
• Client Industry: FinTech

Pay

$50-75/hr