System Security Engineer

· Work closely with IT Security Architects (Cryptography and PKI), implementation partners (CLM, EKMS), CA/PKI operators, and application owners to implement and operationalize certificate and key management solutions using best-of-breed technology and methodology. · Conduct requirement workshops with application teams and platform owners, analyze certificate and key management requirements holistically across on premises and Cloud (AWS) estates. · Contribute to, influence, and review the design of CLM and EKMS solutions to ensure they meet both security and operational needs; demonstrate technical depth in PKI, certificate lifecycle, and key management. · Setup, improve, and streamline certificate and key management operational processes (issuance, renewal, revocation, discovery, rotation, escrow) for continuous improvement and to eliminate outage risk from expiry. · Incorporate cryptographic and key management best practices (FIPS, NIST, X.509, PKCS) into operational workflows and platform configuration. · Monitor, analyze, investigate, and resolve day-to-day operational incidents relating to certificates, keys, and HSMs; provide advisory to application teams. · Manage and maintain strong vendor relationships (CyberArk, Agile Sec, Entrust shield)to ensure continuous support and knowledge transfer for current and future cryptographic needs. · Play an active role in project coordination between internal resources and third parties/vendors for CLM and EKMS execution. · Support the cryptographic asset discovery and inventory (CBOM) that underpins the PQC transition and prepare to take on the cryptography engineer role for hybrid-PQC piloting and migration. Skillset Requirements: At least 5 years of working experience, of which at least 2 years hands-on in PKI, certificate lifecycle management, or enterprise key management and preferably within the financial services/banking industry. Good understanding of the principles, key controls, and processes relating to cryptography, PKI, and key management X.509, TLS/m TLS, PKCS standards, certificate authorities, key hierarchies, HSM-backed key protection). Hands-on experience in implementing or operating a Certificate Lifecycle Management platform (e.g. CyberArk Venafi, Key factor, Entrust) - discovery, policy, automated enrolment/renewal, CA integration. Hands-on experience with enterprise key management and/or HSMs (e.g. Entrust nShield, Thales Cipher Trust, AWS KMS/Cloud HSM), including Security World / key ceremony concepts. Experience in integrating security platforms with enterprise systems via REST APIs — e.g. ITSM (ServiceNow), IAM/SSO (PingOne), SIEM/observability (Splunk, Datadog), vulnerability scanning (Nessus). Experience and proficient in scripting/programming languages for automation — e.g. Python, PowerShell and/or Bash. Good at working with detail and meticulous in operations; strong analytical skills and enjoys complex problem solving. Experience with SDLC and/or Agile methodologies (e.g. Scrum, Kanban). A good team player with excellent written and verbal communication skills, and strong interpersonal skills to coordinate across diverse stakeholders and vendors.