Senior Lead Security Engineer, PKI, Cryptography

What you'll do

• Own the cryptography and key management strategy, standards, and reference architectures across all platforms and applications.
• Lead the design and development of key management services, hardware security module integrations, and envelope encryption patterns.
• Deliver applied cryptography solutions for data-at-rest, in-transit, and in-use use cases while balancing security and performance.
• Establish and operate cryptographic key lifecycle controls, including generation, rotation, distribution, and audit logging.
• Embed cryptography into engineering workflows via reusable libraries, secure configuration baselines, and migration plans from legacy algorithms.
• Manage certificate and identity-related cryptography, including public key infrastructure and automated certificate rotation.
• Drive algorithm agility and post-quantum readiness by maintaining cryptographic inventories and planning staged migrations.
• Build shift-left security into the software development lifecycle through threat modeling, secure design reviews, and policy-as-code.

What we're looking for

• Formal training or certification on security engineering concepts and 5+ years of applied experience.
• Strong foundation in system design and applied cryptography with experience building secure systems.
• Hands-on experience with key management concepts including envelope encryption, key hierarchies, rotation, and audit logging.
• Advanced, hands-on Java experience with strong testing discipline and secure coding practices.
• Experience designing and operating enterprise-grade services with reliability practices like SLOs, monitoring, and disaster recovery.
• Extensive experience with threat modeling, vulnerability discovery, and coordinating penetration testing results.
• Demonstrated ability to lead cross-functional initiatives and communicate risk tradeoffs to senior stakeholders.
• Ability to review and validate AI-assisted security recommendations for security, resiliency, and auditability.
• Deep experience with hardware security modules and key management service platforms (preferred).
• Experience with public key infrastructure and transport layer security at scale (preferred).
• Experience with secrets management and service-to-service authentication patterns (preferred).
• Familiarity with post-quantum cryptography concepts and practical migration planning (preferred).
• Demonstrated security-first and shift-left mindset through building guardrails and paved roads (preferred).