HSM Engineer

Senior Cryptography & Data Security Platform Engineer JD

Location – Chicago, IL;
Denver, CO;
Charlotte, NC.

This specific role is required to be fulfilled onsite 5 days a week

Role Summary

The Senior Cryptography & Data Security Platform Engineer is responsible for the security design, implementation, maintenance, and operational support of vendor security applications and enterprise platforms primarily related to cryptographic services, key management, payment security, general-purpose HSMs, cloud KMS, and data protection controls.

This role is part of the highly visible Global Information Security organization and requires close partnership with application teams, architects, database teams, operations, technical support teams, cloud teams, and other security stakeholders. The engineer will use business and application requirements to assess technical and operational feasibility and recommend secure, supportable cryptographic solutions.

The role also administers and manages cryptographic keys, including full key lifecycle management, centralized key governance, granular access controls, policy enforcement, and evidence needed to demonstrate compliance with Bank and industry key security standards.

Key Responsibilities

• Design, implement, maintain, and support enterprise cryptographic services and key management platforms, including Thales Cipher Trust Manager, Luna Network HSM, pay Shield 10K/10K+, Cloud HSM, and Cloud KMS solutions.
• Maintain and enhance hosted crypto solutions such as key management platforms, payment HSMs, and general-purpose HSMs integrated with end-user applications and enterprise platforms.
• Translate business partner and application requirements into technical designs, feasibility assessments, implementation approaches, and operational support models for cryptographic services.
• Administer cryptographic keys across the full lifecycle, including generation, activation, custody, use, rotation, backup, recovery, archival, retirement, access control, and compliance validation.
• Establish and maintain enterprise-wide data protection controls, including data classification alignment, encryption policies, key governance, secrets management, tokenization, and compliance monitoring.
• Develop prototypes, proof-of-concepts, and implementation patterns in partnership with database, operations, technical support, cloud, security, and application teams.
• Perform lifecycle management, configuration management, firmware upgrades, vulnerability remediation, patch management, security hardening, and operational readiness validation for cryptographic infrastructure.
• Implement enterprise observability and operational monitoring using Splunk Enterprise, Dynatrace, SNMPv3, and other approved monitoring patterns where applicable.
• Support Zero Trust security principles, machine identity management, certificate automation, crypto-agility, and Post-Quantum Cryptography readiness programs.
• Maintain implementation documentation, runbooks, diagrams, control evidence, change records, and operational procedures suitable for audit, risk review, and production support.

Primary Technical Focus Areas

• Cryptographic Platforms: Thales Cipher Trust Manager, Luna Network HSM, pay Shield 10K/10K+, Cloud HSM, and Cloud KMS design, deployment, administration, and support.
• Key Lifecycle Management: Centralized key management, key governance, policy enforcement, access controls, separation of duties, backup, recovery, rotation, archival, retirement, and evidence collection.
• Data Protection Engineering: Encryption policy enablement, data classification alignment, secrets management, tokenization, cryptographic control monitoring, and compliance readiness.
• Application and API Integration: REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, .NET cryptographic providers, cloud-native SDKs, and API Gateway integration patterns.
• Cloud and Container Platforms: Kubernetes, Open Shift, Podman, Docker, Helm, CI/CD pipelines, cloud KMS, cloud HSM, and workload identity patterns for cloud-native applications.
• Operations and Monitoring: Splunk Enterprise, Dynatrace, SNMPv3, operational alerting, log review, health checks, vulnerability remediation, configuration validation, and lifecycle management.
• Standards and Compliance: OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, Global Platform, ANSI standards, and internal cryptographic standards.

Required Experience

• Hands-on experience designing, implementing, and supporting enterprise cryptographic services and key management platforms, including Thales Cipher Trust Manager, Luna Network HSM, pay Shield 10K/10K+, Cloud HSM, and Cloud KMS solutions.
• Strong understanding of cryptographic architectures and control requirements aligned with OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, Global Platform, and ANSI standards.
• Experience establishing and maintaining enterprise data protection controls, including encryption…