Senior Cryptographic Security Engineer

Role Summary
The Senior Cryptographic Security Engineer is a hands on technical leader responsible for designing operating and evolving the organization’s cryptographic platforms with a strong emphasis on operational resilience automation and risk reduction.

This role sits at the intersection of cryptography PKI certificate lifecycle management cloud key management services automation and incident prevention. The Cryptographic Engineering team balances run the platform responsibility with build the future engineering ensuring enterprise cryptographic controls are stable today and adaptable to emerging threats such as post quantum cryptography.

Key Responsibilities

Cryptographic Engineering and Architecture • Design and evolve enterprise cryptographic architectures across Public Key Infrastructure TLS and certificate lifecycle management cloud key management platforms including AWS KMS and Azure Key Vault and Hardware Security Modules including Thales
• Serve as a subject matter expert in cryptographic algorithms protocols key management practices certificate chains trust models and lifecycle controls
• Provide senior technical oversight for cryptographic operations including certificate issuance renewal validation and incident response
• Lead key rotation events including customer managed keys via external HSM and KMS platforms
• Act as an escalation point for complex cryptographic incidents where failure could result in production impact

Automation and Platform Engineering • Design and implement automation to reduce manual cryptographic work
• Enable certificate discovery ownership inference and lifecycle automation
• Integrate cryptographic workflows with ServiceNow for routing ownership and change enablement
• Build API driven automation across platforms including Venafi CyberArk Wiz ServiceNow AWS and OpenShift Cert Manager

Post Quantum Cryptography and Crypto Agility • Lead the organization’s post quantum cryptography strategy and preparedness
• Inventory quantum vulnerable cryptographic implementations
• Define crypto agility requirements across platforms and services
• Evaluate hybrid TLS and post quantum cryptography migration approaches
• Translate evolving standards including NIST PQC and CNSA 2.0 into phased engineering plans that protect production stability

Risk Management Assurance and Audit Support • Collaborate with cryptographic assurance and quality teams to validate cryptographic deployments and review high risk changes
• Assess and document exceptions and compensating controls
• Support audits and regulatory reviews by explaining cryptographic controls operating models and risk based decision making

Required Qualifications • Eight plus years of experience in cryptographic systems PKI or security engineering
• Experience designing implementing or supporting large scale enterprise certificate management programs
• Deep practical knowledge of TLS X.509 certificates trust chains and certificate lifecycle management
• Strong expertise in cryptographic key management and HSM platforms
• Experience with at least one major cloud provider encryption ecosystem AWS and or Azure

Tools and Platforms Hands On Experience • Venafi TLS Protect Trust Protection Platform or equivalent
• Thales CipherTrust or comparable HSM platforms
• ServiceNow CMDB workflow or task routing for security operations
• Scripting or automation using Python PowerShell or similar languages
• API based integration and automation

Nice to Have Experience • Post quantum cryptography planning or proof of concept experience
• Exposure to cryptographic bill of materials or cryptographic inventory initiatives
• Financial services or other highly regulated industry experience
• Prior experience balancing platform operations and engineering responsibilities

Education and Certifications • Bachelor’s or Master’s degree in Computer Science Computer Engineering Cryptography Mathematics or a related field
• Preferred certifications include GIAC GCED CISSP CCSP CISM AWS Certified Security or equivalent

Pay Transparency The salary range for this position is $110000 - 140000 per year plus eligibility for an annual discretionary bonus. Actual pay is based on factors including work location skills and experience.

Citizens offers competitive pay comprehensive medical dental and vision coverage retirement benefits paid parental leave flexible work arrangements education reimbursement wellness programs and more. Citizens’ paid time off policy exceeds mandatory paid sick or paid time away requirements in all United States jurisdictions.  For an overview of our benefits visit https://jobs.citizensbank.com/benefits.