System Security Engineer

Responsibilities

• Coordinate the delivery and implementation of Cryptography, PKI, Certificate Lifecycle Management (CLM), and Enterprise Key Management System (EKMS) solutions.
• Work closely with Security Architects, PKI/CA operators, application teams, platform owners, implementation partners, and vendors.
• Conduct requirement workshops and assess certificate and key management requirements across on-premises and AWS cloud environments.
• Support the design, implementation, and operationalization of CLM and EKMS platforms.
• Manage certificate lifecycle activities including discovery, issuance, enrollment, renewal, revocation, rotation, and expiry monitoring.
• Support enterprise key management processes and Hardware Security Module (HSM) operations.
• Apply cryptographic standards and best practices including FIPS, NIST, X.509, TLS/mTLS, and PKCS.
• Monitor, troubleshoot, and resolve incidents related to certificates, cryptographic keys, PKI infrastructure, and HSMs.
• Automate certificate and key management processes using Python, PowerShell, Bash, and REST APIs.
• Integrate cryptographic platforms with enterprise tools such as ITSM, IAM/SSO, SIEM, and monitoring platforms.
• Coordinate with technology vendors and implementation partners for support, delivery, and knowledge transfer.
• Support cryptographic asset discovery, CBOM development, and Post-Quantum Cryptography (PQC) transition initiatives.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Minimum 5 years of IT or cybersecurity experience, including at least 2 years of hands-on experience in PKI, CLM, or Enterprise Key Management.
• Strong understanding of cryptography, PKI, X.509 certificates, TLS/mTLS, PKCS standards, Certificate Authorities, and key management.
• Hands-on experience with CLM platforms such as CyberArk Venafi, Keyfactor, Entrust, or similar technologies.
• Experience with Enterprise Key Management Systems and HSMs such as Entrust nShield, Thales CipherTrust, AWS KMS, or AWS CloudHSM.
• Experience integrating security platforms using REST APIs with tools such as ServiceNow, PingOne, Splunk, Datadog, or Nessus.
• Proficiency in automation and scripting using Python, PowerShell, and/or Bash.
• Knowledge of AWS cloud security and cryptographic services is preferred.
• Familiarity with Agile/SDLC methodologies such as Scrum and Kanban.
• Exposure to Post-Quantum Cryptography (PQC), cryptographic discovery, or CBOM is an advantage.
• Strong analytical, troubleshooting, stakeholder management, and communication skills.
• Experience in banking, financial services, or other regulated environments is preferred.