Head of Cryptography, MD

Who we are looking for

The Managing Director, Head of Cryptography is a senior leadership role responsible for defining, governing, and advancing the firm's enterprise cryptography, key management, secrets management, and cryptographic modernization strategy.

This leader will be accountable for ensuring the confidentiality, integrity, authenticity, and resilience of the firm's critical systems, applications, data, and digital transactions through industry-leading cryptographic controls and services.

Why this role is important to us

The role requires a forward-thinking technical executive capable of driving enterprise-scale transformation across cloud, hybrid, and emerging technology environments. The successful candidate will lead the evolution of cryptographic capabilities to support modern architectures, AI-enabled platforms, cloud-native services, machine identities, and future threats, including quantum computing risks.

This executive will partner closely with Infrastructure, Cloud Engineering, Application Development, Data, Security Architecture, IAM, and Enterprise Architecture teams to ensure cryptography is embedded by design across the organization’s technology ecosystem.

What you will be responsible for

Enterprise Cryptography Strategy

Define and execute the firm’s comprehensive cryptography strategy, roadmap, and governance framework.

Establish enterprise standards and policies covering:

• Encryption at rest
• Encryption in transit
• Key management
• Secrets management
• Certificate management
• Digital signatures
• Tokenization
• Hardware Security Modules (HSMs)
• Cryptographic agility

Ensure cryptographic capabilities support business growth, regulatory expectations, cloud transformation, and emerging technology adoption.

Develop executive-level metrics and reporting that provide visibility into cryptographic maturity, risk exposure, and modernization progress.

Cryptographic Modernization

Lead enterprise initiatives to modernize the firm’s cryptographic infrastructure and services.

Drive programs focused on:

• Cryptographic inventory and visibility
• Legacy algorithm remediation
• Deprecation of weak cryptographic standards
• Secure migration strategies
• Cryptographic agility
• Automated cryptographic lifecycle management

Develop a roadmap that reduces operational complexity while improving security resilience across all environments.

Partner with engineering teams to ensure cryptographic controls remain scalable, performant, and developer-friendly.

Key Management & Secrets Management

Establish and operate enterprise-class key management services supporting the firm’s most critical systems and data.

Lead strategy and execution across:

• Enterprise Key Management Systems (KMS)
• Hardware Security Modules (HSM)
• Secrets vaults
• Machine identity management
• Certificate lifecycle management
• Service-to-service authentication

Drive adoption of automated key lifecycle capabilities, including:

• Automated provisioning
• Automated rotation
• Revocation
• Expiration management
• Recovery procedures

Reduce operational risk through consistent, centralized, and automated cryptographic controls.

Cloud & Platform Security Enablement

Partner with Cloud Engineering, Infrastructure, and Application teams to embed cryptographic controls into enterprise platforms.

Establish secure-by-default cryptographic services that support:

• Multi-cloud environments
• SaaS platforms
• Containerized workloads
• Kubernetes environments
• Modern application architectures
• Data platforms
• AI and machine learning environments

Enable engineering teams through reusable services, APIs, automation, and paved-road security patterns.

Machine Identity & Certificate Security

Develop and modernize the firm’s machine identity strategy.

Lead efforts to secure and manage:

• Certificates
• APIs
• Service accounts
• Workload identities
• Non-human identities
• Infrastructure identities

Improve visibility and governance across machine identity ecosystems while reducing risks associated with expired, misconfigured, or unmanaged credentials.

Drive automation to eliminate manual certificate and identity management processes wherever possible.

Post-Quantum Cryptography Readiness

Lead the firm’s post-quantum cryptography strategy.

Develop capabilities to:

• Inventory…