Senior Cryptography & Data Security Platform Engineer JD
Location – Chicago, IL; Denver, CO; Charlotte, NC.
This specific role is required to be fulfilled onsite 5 days a week
Role Summary
The Senior Cryptography & Data Security Platform Engineer is responsible for the security design, implementation, maintenance, and operational support of vendor security applications and enterprise platforms primarily related to cryptographic services, key management, payment security, general-purpose HSMs, cloud KMS, and data protection controls.
This role is part of the highly visible Global Information Security organization and requires close partnership with application teams, architects, database teams, operations, technical support teams, cloud teams, and other security stakeholders. The engineer will use business and application requirements to assess technical and operational feasibility and recommend secure, supportable cryptographic solutions.
The role also administers and manages cryptographic keys, including full key lifecycle management, centralized key governance, granular access controls, policy enforcement, and evidence needed to demonstrate compliance with Bank and industry key security standards.
Key Responsibilities
- Design, implement, maintain, and support enterprise cryptographic services and key management platforms, including Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS solutions.
- Maintain and enhance hosted crypto solutions such as key management platforms, payment HSMs, and general-purpose HSMs integrated with end-user applications and enterprise platforms.
- Translate business partner and application requirements into technical designs, feasibility assessments, implementation approaches, and operational support models for cryptographic services.
- Administer cryptographic keys across the full lifecycle, including generation, activation, custody, use, rotation, backup, recovery, archival, retirement, access control, and compliance validation.
- Establish and maintain enterprise-wide data protection controls, including data classification alignment, encryption policies, key governance, secrets management, tokenization, and compliance monitoring.
- Develop prototypes, proof-of-concepts, and implementation patterns in partnership with database, operations, technical support, cloud, security, and application teams.
- Perform lifecycle management, configuration management, firmware upgrades, vulnerability remediation, patch management, security hardening, and operational readiness validation for cryptographic infrastructure.
- Implement enterprise observability and operational monitoring using Splunk Enterprise, Dynatrace, SNMPv3, and other approved monitoring patterns where applicable.
- Support Zero Trust security principles, machine identity management, certificate automation, crypto-agility, and Post-Quantum Cryptography readiness programs.
- Maintain implementation documentation, runbooks, diagrams, control evidence, change records, and operational procedures suitable for audit, risk review, and production support.
Primary Technical Focus Areas
- Cryptographic Platforms: Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS design, deployment, administration, and support.
- Key Lifecycle Management: Centralized key management, key governance, policy enforcement, access controls, separation of duties, backup, recovery, rotation, archival, retirement, and evidence collection.
- Data Protection Engineering: Encryption policy enablement, data classification alignment, secrets management, tokenization, cryptographic control monitoring, and compliance readiness.
- Application and API Integration: REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, .NET cryptographic providers, cloud-native SDKs, and API Gateway integration patterns.
- Cloud and Container Platforms: Kubernetes, OpenShift, Podman, Docker, Helm, CI/CD pipelines, cloud KMS, cloud HSM, and workload identity patterns for cloud-native applications.
- Operations and Monitoring: Splunk Enterprise, Dynatrace, SNMPv3, operational alerting, log review, health checks, vulnerability remediation, configuration validation, and lifecycle management.
- Standards and Compliance: OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, GlobalPlatform, ANSI standards, and internal cryptographic standards.
Required Experience
- Hands-on experience designing, implementing, and supporting enterprise cryptographic services and key management platforms, including Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS solutions.
- Strong understanding of cryptographic architectures and control requirements aligned with OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, GlobalPlatform, and ANSI standards.
- Experience establishing and maintaining enterprise data protection controls, including encryption policies, key governance, secrets management, tokenization, data classification alignment, and compliance monitoring.
- Hands-on experience administering and automating Linux and Windows environments using PowerShell, Python, and modern GitOps or Infrastructure-as-Code practices. Ansible and Terraform are preferred/nice to have.
- Strong understanding of cryptographic APIs and integration frameworks, including REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, and cloud-native security SDKs.
- Experience designing and operating cloud-native and containerized platforms using Kubernetes, OpenShift, Podman, Docker, Helm, and CI/CD pipelines.
- Experience implementing and testing APIs using Postman, Insomnia, Swagger/OpenAPI, and API Gateway platforms.
- Experience with enterprise observability and monitoring using Splunk Enterprise and Dynatrace; Prometheus, Grafana, Elastic Stack, and SNMPv3 monitoring are preferred/nice to have.
- Working knowledge of Agile, Scrum, Kanban, DevSecOps, Jira, Azure DevOps, and SDLC practices used to support secure platform delivery.
- Experience with lifecycle management, configuration management, firmware upgrades, vulnerability remediation, patch management, and compliance validation for cryptographic infrastructure.
- Ability to partner with application owners, architects, cloud teams, and security stakeholders to define and implement cryptographic controls, key management strategies, and HSM/KMS service requirements.
- Knowledge of database encryption technologies and integrations, including Microsoft SQL Server TDE and EKM, Oracle TDE, PostgreSQL encryption, KMIP, and PKCS#11-based key management integrations.
- Experience with enterprise secrets management and workload identity solutions for Kubernetes and cloud-native applications.
- Familiarity with Post-Quantum Cryptography, crypto-agility initiatives, and quantum-safe migration strategies.
Desired Experience
- Experience with additional cloud key management services, including Azure Key Vault, AWS KMS, Google Cloud KMS, or equivalent enterprise cloud KMS platforms.
- Experience building reusable implementation patterns, automation workflows, operational runbooks, and evidence packages for regulated cryptographic infrastructure.
- Experience supporting high-availability cryptographic services, backup and recovery validation, disaster recovery exercises, incident response, and production troubleshooting.
- Experience with payment cryptography concepts, payment HSM operations, PIN/key block concepts, key ceremonies, EMVCo, ANSI, PCI, and related payment security guidance.
- Experience supporting machine identity management, certificate automation, secure signing, tokenization, data encryption, and key management integrations across on-premises and cloud environments.
Standards and Governance Knowledge
- OASIS KMIP 2.x concepts and key management integration patterns.
- NIST SP 800-57 key management principles and NIST SP 800-131A algorithm/key strength transition guidance.
- FIPS 140-3 expectations for cryptographic modules where applicable.
- PCI DSS and PCI HSM requirements where applicable to payment and cryptographic services.
- EMVCo, GlobalPlatform, ANSI, GDPR, and enterprise cryptographic governance requirements where applicable.
- Internal cryptographic standards, change controls, evidence retention, access review practices, and audit readiness expectations.
Core Competencies
- Strong troubleshooting discipline across application, API, network, certificate, database, cloud, key management, and HSM/