Cryptography & Data Security Engineer(w2) -- TIWDC5877801

About the Role

The Senior Cryptography & Data Security Platform Engineer is responsible for the security design, implementation, maintenance, and operational support of vendor security applications and enterprise platforms primarily related to cryptographic services, key management, payment security, general-purpose HSMs, cloud KMS, and data protection controls.

This role is part of the highly visible Global Information Security organization and requires close partnership with application teams, architects, database teams, operations, technical support teams, cloud teams, and other security stakeholders. The engineer will use business and application requirements to assess technical and operational feasibility and recommend secure, supportable cryptographic solutions.

The role also administers and manages cryptographic keys, including full key lifecycle management, centralized key governance, granular access controls, policy enforcement, and evidence needed to demonstrate compliance with Bank and industry key security standards.

Responsibilities

• Design, implement, and support enterprise cryptographic services and key management platforms, including Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS solutions.
• Establish and maintain enterprise data protection controls, including encryption policies, key governance, secrets management, tokenization, data classification alignment, and compliance monitoring.
• Administer and automate Linux and Windows environments using PowerShell, Python, and modern GitOps or Infrastructure-as-Code practices (Ansible and Terraform preferred).
• Design and operate cloud-native and containerized platforms using Kubernetes, OpenShift, Podman, Docker, Helm, and CI/CD pipelines.
• Implement and test APIs using Postman, Insomnia, Swagger/OpenAPI, and API Gateway platforms.
• Implement enterprise observability and monitoring using Splunk Enterprise and Dynatrace; Prometheus, Grafana, Elastic Stack, and SNMPv3 monitoring are preferred.
• Manage lifecycle, configuration, firmware upgrades, vulnerability remediation, patch management, and compliance validation for cryptographic infrastructure.
• Partner with application owners, architects, cloud teams, and security stakeholders to define and implement cryptographic controls, key management strategies, and HSM/KMS service requirements.
• Work with database encryption technologies and integrations, including Microsoft SQL Server TDE and EKM, Oracle TDE, PostgreSQL encryption, KMIP, and PKCS#11-based key management integrations.
• Implement enterprise secrets management and workload identity solutions for Kubernetes and cloud-native applications.

Requirements

• Strong PKI HSM Engineer experience.
• PowerShell or similar scripting experience.
• Strong understanding of cryptographic architectures and control requirements aligned with OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, GlobalPlatform, and ANSI standards.
• Strong understanding of cryptographic APIs and integration frameworks, including REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, and cloud-native security SDKs.
• Working knowledge of Agile, Scrum, Kanban, DevSecOps, Jira, Azure DevOps, and SDLC practices used to support secure platform delivery.
• Familiarity with Post-Quantum Cryptography, crypto-agility initiatives, and quantum-safe migration strategies.

Schedule

This role requires onsite work 5 days a week.