HSM Engineer

HSM EngineerJob#: 3046466Job Description:Senior Cryptography & Data Security Platform Engineer JDLocation – Chicago, IL; Denver, CO; Charlotte, NC. This specific role is required to be fulfilled onsite 5 days a weekRole SummaryThe Senior Cryptography & Data Security Platform Engineer is responsible for the security design, implementation, maintenance, and operational support of vendor security applications and enterprise platforms primarily related to cryptographic services, key management, payment security, general-purpose HSMs, cloud KMS, and data protection controls.This role is part of the highly visible Global Information Security organization and requires close partnership with application teams, architects, database teams, operations, technical support teams, cloud teams, and other security stakeholders. The engineer will use business and application requirements to assess technical and operational feasibility and recommend secure, supportable cryptographic solutions.The role also administers and manages cryptographic keys, including full key lifecycle management, centralized key governance, granular access controls, policy enforcement, and evidence needed to demonstrate compliance with Bank and industry key security standards.Key ResponsibilitiesDesign, implement, maintain, and support enterprise cryptographic services and key management platforms, including Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS solutions.Maintain and enhance hosted crypto solutions such as key management platforms, payment HSMs, and general-purpose HSMs integrated with end-user applications and enterprise platforms.Translate business partner and application requirements into technical designs, feasibility assessments, implementation approaches, and operational support models for cryptographic services.Administer cryptographic keys across the full lifecycle, including generation, activation, custody, use, rotation, backup, recovery, archival, retirement, access control, and compliance validation.Establish and maintain enterprise-wide data protection controls, including data classification alignment, encryption policies, key governance, secrets management, tokenization, and compliance monitoring.Develop prototypes, proof-of-concepts, and implementation patterns in partnership with database, operations, technical support, cloud, security, and application teams.Perform lifecycle management, configuration management, firmware upgrades, vulnerability remediation, patch management, security hardening, and operational readiness validation for cryptographic infrastructure.Implement enterprise observability and operational monitoring using Splunk Enterprise, Dynatrace, SNMPv3, and other approved monitoring patterns where applicable.Support Zero Trust security principles, machine identity management, certificate automation, crypto-agility, and Post-Quantum Cryptography readiness programs.Maintain implementation documentation, runbooks, diagrams, control evidence, change records, and operational procedures suitable for audit, risk review, and production support.Primary Technical Focus AreasCryptographic Platforms: Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS design, deployment, administration, and support.Key Lifecycle Management: Centralized key management, key governance, policy enforcement, access controls, separation of duties, backup, recovery, rotation, archival, retirement, and evidence collection.Data Protection Engineering: Encryption policy enablement, data classification alignment, secrets management, tokenization, cryptographic control monitoring, and compliance readiness.Application and API Integration: REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, .NET cryptographic providers, cloud-native SDKs, and API Gateway integration patterns.Cloud and Container Platforms: Kubernetes, OpenShift, Podman, Docker, Helm, CI/CD pipelines, cloud KMS, cloud HSM, and workload identity patterns for cloud-native applications.Operations and Monitoring: Splunk Enterprise, Dynatrace, SNMPv3, operational alerting, log review, health checks, vulnerability remediation, configuration validation, and lifecycle management.Standards and Compliance: OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, GlobalPlatform, ANSI standards, and internal cryptographic standards.Required ExperienceHands-on experience designing, implementing, and supporting enterprise cryptographic services and key management platforms, including Thales CipherTrust Manager, Luna Network HSM, payShield 10K/10K+, Cloud HSM, and Cloud KMS solutions.Strong understanding of cryptographic architectures and control requirements aligned with OASIS KMIP 2.x, PCI DSS, PCI HSM, NIST SP 800-57, NIST SP 800-131A, FIPS 140-3, GDPR, EMVCo, GlobalPlatform, and ANSI standards.Experience establishing and maintaining enterprise data protection controls, including encryption policies, key governance, secrets management, tokenization, data classification alignment, and compliance monitoring.Hands-on experience administering and automating Linux and Windows environments using PowerShell, Python, and modern GitOps or Infrastructure-as-Code practices. Ansible and Terraform are preferred/nice to have.Strong understanding of cryptographic APIs and integration frameworks, including REST APIs, PKCS#11, KMIP, JCE/JCA, Microsoft CNG, MSCAPI, OpenSSL, and cloud-native security SDKs.Experience designing and operating cloud-native and containerized platforms using Kubernetes, OpenShift, Podman, Docker, Helm, and CI/CD pipelines.Experience implementing and testing APIs using Postman, Insomnia, Swagger/OpenAPI, and API Gateway platforms.Experience with enterprise observability and monitoring using Splunk Enterprise and Dynatrace; Prometheus, Grafana, Elastic Stack, and SNMPv3 monitoring are preferred/nice to have.Working knowledge of Agile, Scrum, Kanban, DevSecOps, Jira, Azure DevOps, and SDLC practices used to support secure platform delivery.Experience with lifecycle management, configuration management, firmware upgrades, vulnerability remediation, patch management, and compliance validation for cryptographic infrastructure.Ability to partner with application owners, architects, cloud teams, and security stakeholders to define and implement cryptographic controls, key management strategies, and HSM/KMS service requirements.Knowledge of database encryption technologies and integrations, including Microsoft SQL Server TDE and EKM, Oracle TDE, PostgreSQL encryption, KMIP, and PKCS#11-based key management integrations.Experience with enterprise secrets management and workload identity solutions for Kubernetes and cloud-native applications.Familiarity with Post-Quantum Cryptography, crypto-agility initiatives, and quantum-safe migration strategies.Desired ExperienceExperience with additional cloud key management services, including Azure Key Vault, AWS KMS, Google Cloud KMS, or equivalent enterprise cloud KMS platforms.Experience building reusable implementation patterns, automation workflows, operational runbooks, and evidence packages for regulated cryptographic infrastructure.Experience supporting high-availability cryptographic services, backup and recovery validation, disaster recovery exercises, incident response, and production troubleshooting.Experience with payment cryptography concepts, payment HSM operations, PIN/key block concepts, key ceremonies, EMVCo, ANSI, PCI, and related payment security guidance.Experience supporting machine identity management, certificate automation, secure signing, tokenization, data encryption, and key management integrations across on-premises and cloud environments.Standards and Governance KnowledgeOASIS KMIP 2.x concepts and key management integration patterns.NIST SP 800-57 key management principles and NIST SP 800-131A algorithm/key strength transition guidance.FIPS 140-3 expectations for cryptographic modules where applicable.PCI DSS and PCI HSM requirements where applicable to payment and cryptographic services.EMVCo, GlobalPlatform, ANSI, GDPR, and enterprise cryptographic governance requirements where applicable.Internal cryptographic standards, change controls, evidence retention, access review practices, and audit readiness expectations.Core CompetenciesStrong troubleshooting discipline across application, API, network, certificate, database, cloud, key management, and HSM/KMS integration issues.Ability to translate cryptographic requirements into secure, supportable, scalable, and auditable engineering solutions.Operational ownership mindset with emphasis on reliability, resilience, documentation quality, risk reduction, and production readiness.Clear written and verbal communication with application owners, architects, security stakeholders, operations teams, and leadership.Ability to balance security requirements, regulatory expectations, implementation feasibility, and business outcomes in a regulated enterprise environment.Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico.Everforth Apex uses a virtual recruiter as part of the application process. Click here for more details. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Everforth Apex and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Everforth Apex Benefits Overview: Everforth Apex offers a range of supplemental benefits, including medical, dental, vision, life, disability, and other insurance plans that offer an optional layer of financial protection. We offer an ESPP (employee stock purchase program) and a 401K program which allows you to contribute typically within 30 days of starting, with a company match after 12 months of tenure. Everforth Apex also offers a HSA (Health Savings Account on the HDHP plan), a SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions, a corporate discount savings program and other discounts. In terms of professional development, Everforth Apex hosts an on-demand training program, provides access to certification prep and a library of technical and leadership courses/books/seminars once you have 6+ months of tenure, and certification discounts and other perks to associations that include CompTIA and IIBA. Everforth Apex has a dedicated customer service team for our Consultants that can address questions around benefits and other resources, as well as a certified Career Coach. You can access a full list of our benefits, programs, support teams and resources within our ‘Welcome Packet’ as well, which an Everforth Apex team member can provide.Everforth Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Everforth Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.If you require an accommodation under the Americans with Disabilities Act to participate in an interview with a virtual recruiter or to use our website for a search or application, please contact our Benefits Department at [emailprotected] or View phone number on click.appcast.io. Please note that this contact information is strictly to be used for medical ADA accommodations and that no other inquiries will be answered.UnitedHealthcare creates and publishes the Transparency in Coverage Machine-Readable Files on behalf of Everforth Apex Systems.