Cryptographic Agility Surveillance Analyst

About the role

State Street is seeking a motivated and intellectually curious Cryptographic Agility Surveillance Analyst to support the development and operation of the firm's Cryptographic Agility Surveillance Program.

Responsibilities

• Monitor industry, regulatory, vendor, and academic sources for emerging cryptographic threats, vulnerabilities, standards changes, and technology developments.
• Track developments related to encryption algorithms, cryptographic protocols, post-quantum cryptography (PQC), key management, digital certificates, and cryptographic libraries.
• Research and summarize cryptographic intelligence from multiple sources and communicate findings to technical and non-technical stakeholders.
• Aid in the identification and assessment of cryptographic risks that may impact applications, infrastructure, or security controls.
• Support the creation of intelligence reports, risk summaries, dashboards, metrics, and presentations for security and technology teams.
• Maintain inventories, datasets, and documentation used to support cryptographic risk monitoring and analysis activities.
• Participate in periodic reviews of external advisories, standards publications, and vendor security announcements.
• Support investigations into newly identified cryptographic weaknesses and help document potential business impacts.
• Collaborate with engineering and architecture teams to understand cryptographic implementations and support remediation planning efforts.
• Contribute to evidence gathering and reporting activities that support internal governance, audit, and regulatory requirements.
• Assist in maintaining processes, playbooks, and operating procedures that support the Cryptographic Agility Surveillance Program.
• Collaborate with other Cyber Threat Intelligence teams to establish consistent and mature threat intelligence processes and tooling.
• Ability to apply the Admiralty System to establish and manage source reliability and information credibility to enhance automated processing of expansive, continuously collected intelligence.
• Continuously build knowledge of cryptographic concepts, cybersecurity trends, and emerging technologies.

Qualifications

• A strong interest in cybersecurity, cryptography, threat intelligence, or technology risk management.
• An analytical thinking and the ability to evaluate technical information from multiple sources.
• A curiosity and a desire to understand how emerging technologies and industry developments impact security risk.
• Strong written and verbal communication skills, with the ability to summarize technical topics clearly and concisely.
• An attention to detail and a disciplined approach to research, documentation, and data analysis.
• A collaborative mindset and willingness to work across multiple teams and stakeholder groups.
• An eagerness to learn and develop skills in cryptography, encryption technologies, and cybersecurity operations.
• The ability to manage multiple work items while maintaining high-quality deliverables.
• A professionalism, integrity, and a commitment to protecting confidential information.
• A continuous improvement mindset with a willingness to identify opportunities to enhance processes and operational effectiveness.

Education & Preferred Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Security, Engineering, Mathematics, or a related field, or equivalent practical experience.
• One to three years of experience in cybersecurity, technology risk, security operations, IT audit, threat intelligence, vulnerability management, or a related field.
• A foundational understanding of cybersecurity principles, encryption, authentication, and data protection concepts.
• A basic knowledge of common cryptographic technologies, including TLS, PKI, certificates, hashing, and encryption.
• Experience conducting research, data analysis, or technical investigations through academic, internship, or professional experience.
• A knowledge of emerging topics such as post-quantum cryptography, cryptographic asset management, software supply chain security, or cryptographic inventory management.