System Security Engineer

Work closely with IT Security Architects (Cryptography and PKI), implementation partners (CLM, EKMS), CA/PKI operators, and application owners to implement and operationalize certificate and key management solutions using best-of-breed technology and methodology.

Conduct requirement workshops with application teams and platform owners, analyze certificate and key management requirements holistically across on-premises and Cloud (AWS) estates.

Contribute to, influence, and review the design of CLM and EKMS solutions to ensure they meet both security and operational needs; demonstrate technical depth in PKI, certificate lifecycle, and key management.

Set up, improve, and streamline certificate and key management operational processes (issuance, renewal, revocation, discovery, rotation, escrow) for continuous improvement and to eliminate outage risk from expiry.

Incorporate cryptographic and key management best practices (FIPS, NIST, X.509, PKCS) into operational workflows and platform configuration.

Monitor, analyze, investigate, and resolve day-to-day operational incidents relating to certificates, keys, and HSMs; provide advisory to application teams.

Manage and maintain strong vendor relationships (CyberArk, AgileSec, Entrust nShield) to ensure continuous support and knowledge transfer for current and future cryptographic needs.

Play an active role in project coordination between internal resources and third parties/vendors for CLM and EKMS execution.

Support the cryptographic asset discovery and inventory (CBOM) that underpins the PQC transition, and prepare to take on the cryptography engineer role for hybrid-PQC piloting and migration.

Possess a degree in Computer Science/Information Technology or related fields.

At least 5 years of working experience, of which at least 2 years hands-on in PKI, certificate lifecycle management, or enterprise key management and preferably within the financial services/banking industry.

Good understanding of the principles, key controls, and processes relating to cryptography, PKI, and key management (X.509, TLS/mTLS, PKCS standards, certificate authorities, key hierarchies, HSM-backed key protection).

Hands-on experience in implementing or operating a Certificate Lifecycle Management platform (e.g. CyberArk Venafi, Keyfactor, Entrust) - discovery, policy, automated enrolment/renewal, CA integration.

Hands-on experience with enterprise key management and/or HSMs (e.g. Entrust nShield, Thales CipherTrust, AWS KMS/CloudHSM), including Security World / key ceremony concepts.

Experience in integrating security platforms with enterprise systems via REST APIs - e.g. ITSM (ServiceNow), IAM/SSO (PingOne), SIEM/observability (Splunk, Datadog), vulnerability scanning (Nessus).

Experience and proficient in scripting/programming languages for automation , e.g- Python, PowerShell, and/or Bash.

Good at working with detail and meticulous in operations; strong analytical skills and enjoys complex problem solving.

Experience with SDLC and/or Agile methodologies (e.g. Scrum, Kanban).

A good team player with excellent written and verbal communication skills, and strong interpersonal skills to coordinate across diverse stakeholders and vendors.