7+ years in information security focusing on PKI and cryptographic systems.
Proven ownership of a production PKI, including CA hierarchy and HSM operations.
Hands-on experience with cryptographic tools like Venafi, Cyberark, and DigiCert.
Knowledge of HSMs and compliance with CA/Browser Forum requirements.
Automation skills in Python, Go, or similar languages, with experience in CI/CD systems.
Familiarity with post-quantum cryptography and NIST standards.
Strong understanding of cryptographic protocols and key management best practices.
Experience operating cryptographic services in major cloud environments.
Responsibilities
Design and operate key management services across cloud and on-premises platforms.
Plan and execute key generation and signing ceremonies with dual control.
Maintain enterprise cryptographic infrastructure, including ADCS and certificate management platforms.
Own the enterprise PKI end-to-end, including documentation and operational runbooks.
Lead automation efforts for certificate lifecycle management.
Ensure compliance with CA/Browser Forum requirements and industry standards.
Support the transition to post-quantum cryptography and develop migration roadmaps.
Develop cryptographic policies and standards for data protection.
Build and maintain a cryptographic bill of materials (CBOM).
Collaborate with Security, Infrastructure, and Compliance teams for audits and incident response.
Mentor junior engineers and contribute to the technical roadmap.
Benefits
Opportunity to work with cutting-edge cryptographic technologies.
Collaborative environment with cross-functional teams.
Mentorship opportunities for professional growth.
Focus on continuous improvement and innovation in data protection.
Engagement in compliance with industry standards and regulations.
Full Job Description
Position Overview:
North Carolina State Employees Credit Union is seeking a Lead Cryptographic Engineer to join its Data Protection team. This role owns the design, operation, and continuous improvement of the credit union's cryptographic infrastructure, ensuring the confidentiality, integrity, and availability of cryptographic services that protect member and enterprise data. The Lead Cryptographic Engineer will serve as a subject matter expert on certificate lifecycle management, key management, and emerging cryptographic standards, partnering closely with Security, Infrastructure, and Compliance teams.
Essential Responsibilities:
Design and operate key management services across cloud KMS platforms and on-premises HSMs, including key hierarchies, rotation schedules, separation of duties, and BYOK/HYOK arrangements where customer commitments require them.
Plan and execute key generation and signing ceremonies under split knowledge and dual control, with auditable evidence and witnessed procedures.
Design, operate, and maintain enterprise Cryptographic infrastructure, including Microsoft Active Directory Certificate Services (ADCS) and integrated certificate lifecycle management platforms such as Venafi and DigiCert.
Own the enterprise PKI end to end: offline root, issuing CA hierarchy, HSM-backed key material, CP/CPS documentation, and the operational runbooks that support them.
Lead certificate lifecycle automation efforts, reducing manual issuance, renewal, and revocation processes across the enterprise.
Ensure PKI operations and certificate issuance practices remain compliant with CA/Browser Forum baseline requirements and applicable industry standards.
Evaluate, plan, and support the organization's transition to post-quantum cryptography (PQC), including algorithm agility and migration roadmaps.
Develop and maintain cryptographic policies, standards, certificate practice statements, and operational runbooks. Set standards for envelope encryption, tokenization, field-level encryption, and data-at-rest and in-transit protection.
Build and maintain a cryptographic bill of materials (CBOM) covering algorithms, libraries, and dependencies across the estate.
Partner with Security Engineering, Infrastructure, and Compliance teams to support audits, risk assessments, and incident response involving cryptographic assets.
Mentor junior engineers and contribute to the Data Protection team's technical roadmap.
