Encryption Key Management

Encryption Key Management Engineer Jobs

3 jobs found

2d ago

Senior/Staff Security Engineer

Sandbar New York, NY

New York, NY

2d ago

$190k - $260k/yr Full time Senior Application Security Audit Logging

Apply Now

Job Description

Sandbar is hiring a Senior/Staff Security Engineer to own backend security systems that make user privacy real for Stream, working from inside a small backend team on a live production service.

Responsibilities

Design and ship end-to-end encryption for user data, including key management, while keeping search and background processing working on encrypted data
Build confidential-computing infrastructure to isolate and verify sensitive processing, including attestation and reproducible builds
Own identity and secrets across the stack, including short-lived workload credentials, least-privilege service identities, environment isolation, and auditable privileged access
Own supply chain and CI/CD security
Build the detection and response loop with audit logging, alerting, runbooks, and post-incident reviews that drive engineering changes
Drive security for vendors and data handling, including AI provider data agreements, third-party integration and OAuth scope review, plus data retention and deletion
Lead compliance work (for example, SOC 2) from the engineering side, with controls enforced by systems and evidence generated automatically
Contribute a share of the core backend, building product features on the real-time Python services you secure and reviewing team changes with a security focus
Set direction for secure engineering practice through design reviews, threat models, and clear, minimal guidance engineers follow

Requirements

7+ years building and operating backend systems, including meaningful time as the engineer accountable for security on a production service
Strong Python skills and comfort owning a live, real-time service end to end
Hands-on applied cryptography, including envelope encryption, authenticated encryption, key hierarchies, and understanding practical failure modes
Deep cloud security experience on AWS and/or GCP, including IAM, workload identity federation, KMS, secrets management, and audit logging
Experience leading incident response on a production service, from containment through follow-up hardening
Experience with confidential computing or attestation (e.g. Nitro Enclaves, SEV-SNP, TDX, App Attest) strongly preferred
Comfortable with document stores and their access-control models
Ability to make tradeoffs explicitly and ship, understanding differences between controls that gate launch versus controls that can be followed
Precise communication with engineers, founders, auditors, and vendors

Technologies

Python
AWS, GCP
IAM, workload identity federation
KMS, secrets management, audit logging
Nitro Enclaves, SEV-SNP, TDX, App Attest
OAuth

Benefits

Health, vision, and dental benefits
Company-sponsored 401(k)
Unlimited PTO and sick time
Early stage equity

Nice to Have

iOS security primitives (Secure Enclave, Keychain)
Bluetooth LE device security, firmware signing, or secure pairing
Experience with retrieval systems or LLM infrastructure and their data-flow controls
SOC 2 or ISO 27001 audit experience from the engineering side

Location: New York, NY (onsite)
Salary: USD 190,000 - 260,000 per year
Experience: 7+ years

View full job page →

7d ago

Systems Security Engineer

Nightwing Intelligence Solutions, LLC Huntsville, AL

Huntsville, AL

7d ago

Full time Anti Tamper Attack Tree Cyber Survivability

Apply Now

Job Description

Nightwing Intelligence Solutions, LLC is building secure capabilities for forward-deployed DoD tactical systems and supporting authorization efforts with security artifacts that hold up in real environments. In a hybrid role based in Huntsville, AL, the Systems Security Engineer (SSE) will translate DoD security requirements into implementable technical solutions, working hands-on with actual platforms in test labs and operational environments.

What you’ll do

Integrate products into security architectures for tactical systems.
Develop security solutions that fit forward-deployed constraints such as SWaP limitations and real-time requirements.
Create security artifacts for operational systems, including Attack Trees, Key Management Plans, and System Security Plans for fielded platforms.
Map security requirements across frameworks including 800-53, Anti-Tamper, Cyber Survivability, and Zero Trust, then translate them into technical implementations.
Coordinate with platform security personnel and accreditation authorities to support authorization processes.

What you bring

Active Secret or TS clearance strongly preferred.
Experience with tactical and embedded DoD systems.
Security architecture design experience for resource-constrained and real-time systems.
Understanding of hardware security constraints in tactical environments.
Experience integrating commercial security products into government platforms or weapon systems.
Knowledge of operational security considerations for forward-deployed systems.
Deep knowledge of DoD cybersecurity requirements, frameworks, and processes including RMF, Anti-Tamper, Cyber Survivability, and Zero Trust.
Experience developing security artifacts beyond checkbox compliance.
Understanding of cryptographic implementations and key management in operational contexts.
Ability to map security requirements across different frameworks.
Experience interfacing with platform security engineering and accreditation authorities.
Strong technical writing and documentation skills.
Ability to communicate effectively with both technical teams and government stakeholders.
Experience working on-platform or in test labs with actual hardware and software.
U.S. Citizenship is required.
Must meet requirements to obtain and maintain a Secret government security clearance.

Relevant technical experience

Hands-on security or software integration experience with tactical platforms, such as radar systems, missile defense systems, avionics/flight control, C4ISR equipment, electronic warfare systems, tactical communication systems, and other forward-deployed mission systems.
Familiarity with TPM and Secure Boot technologies implementation.
OS internals familiarity in embedded or tactical contexts (Linux and/or Windows).
Real-time operating system (RTOS) security considerations.
Security testing and assessment experience for embedded systems, including penetration testing and vulnerability assessment.
Knowledge of security assessment tools such as static/dynamic analysis and fuzzing applicable to tactical systems.
Experience with security requirements for embedded systems or kernel/driver software.
Ability to navigate complex DoD security requirements while delivering practical, implementable solutions.
Experience translating between operational/engineering needs and compliance/accreditation requirements.

Security frameworks & technologies

RMF, 800-53, Anti-Tamper, Cyber Survivability, Zero Trust, TPM, Secure Boot, Linux, Windows, RTOS

Security clearance note

Qualified applicants may be subject to a security investigation and must meet minimum qualifications for access to classified information. U.S. Citizenship is required, and applicants must meet requirements to obtain and maintain a Secret government security clearance. Active Secret or TS clearance is strongly preferred.

View full job page →

1mo ago

Security Engineer - Vice President - IAM

Goldman Sachs Jersey City, NJ

Jersey City, NJ

1mo ago Closed

$130k - $250k/yr Full time Certificate Management Cloud Platforms Cybersecurity

This position is no longer accepting applications (closed Oct 18, 2026).

Job Description

Lead PKI and cryptography trust services in a global, hybrid organization at Goldman Sachs. This Vice President role in the Identity Security (IAM) team blends enterprise strategy with hands-on engineering to deliver compliant, highly available digital certificate lifecycle management across multi-cloud, on-premises, and IoT environments.

Work with modern PKI tooling, security standards, and cloud-native architectures while guiding a team responsible for enterprise trust services. You will help steer roadmap execution, automate certificate lifecycle processes to reduce operational risk, and represent the organization in industry consortiums as cryptography evolves.

Responsibilities

Own global strategy, engineering, deployment, and operations for the enterprise Public Key Infrastructure (PKI), cryptography, and digital certificate lifecycle management.
Deliver trust services that are robust, compliant, and highly available, aligned with industry guidance such as the NIST Computer Security Resource Center and the CA/Browser Forum.
Define and execute the global enterprise roadmap for PKI, certificate management, and cryptographic services, ensuring alignment with cybersecurity and business objectives.
Oversee design, implementation, and ongoing maintenance of internal and external Certificate Authorities (CAs), Registration Authorities (RAs), Hardware Security Modules (HSMs), and Key Management Systems (KMS).
Drive adoption of automated certificate lifecycle management (CLM) tools and protocols such as ACME, EST, and SCEP to reduce manual effort and prevent outages tied to expired certificates.
Ensure strict adherence to cryptographic standards, regulations, and audit requirements including WebTrust, SOC2, and ISO 27001. Establish and maintain the enterprise Certificate Policy (CP) and Certification Practice Statement (CPS).
Architect scalable PKI solutions for modern environments, including Kubernetes, service meshes, and hybrid-cloud deployments on AWS, Azure, and GCP.
Act as the escalation point for cryptographic vulnerabilities, certificate-related outages, and emergency key rotations.
Manage relationships with external Certificate Authorities and security vendors.
Represent the organization in industry consortiums to stay ahead of emerging cryptographic trends, including Post-Quantum Cryptography (PQC).

Requirements

Ability to thrive in a global, fast-paced, hybrid workplace.
Team-focused mindset with enthusiasm for working in a global organization.
Experience working in an Agile environment.
Strong emphasis on personal initiative and ownership.
Customer focus and attention to good developer experience.
Passion for learning new technologies.
8+ years of experience.
Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Cryptography, or a related field.

Core Skills and Experience

Define and execute the global enterprise roadmap for PKI, certificate management, and cryptographic services.
Oversee the design, implementation, and maintenance of CAs, RAs, HSMs, and KMS.
Drive automated CLM adoption using ACME, EST, and SCEP to reduce manual processes and prevent expired-certificate outages.
Ensure audit and compliance alignment with WebTrust, SOC2, and ISO 27001, including ownership of CP/CPS.
Architect scalable PKI for Kubernetes, service meshes, and hybrid-cloud environments on AWS, Azure, and GCP.
Escalate and lead responses for cryptographic vulnerabilities, certificate-related outages, and emergency key rotations.
Manage relationships with external Certificate Authorities and security vendors.
Stay current with cryptographic direction by participating in industry consortiums, including PQC awareness.

Technologies

ACME, EST, SCEP
NIST Computer Security Resource Center, CA/Browser Forum
Kubernetes, service meshes
AWS, Azure, GCP
Post-Quantum Cryptography (PQC)
WebTrust, SOC2, ISO 27001
CP/CPS, TLS/SSL, SSH

Benefits

Healthcare & Medical Insurance
Holiday & Vacation Policies
Financial Wellness & Retirement
Health Services
Fitness
Child Care & Family Care

Preferred Qualifications

10+ years of experience in cybersecurity and information technology, with at least 8+ years in dedicated leadership experience in PKI, cryptography, and data protection.
Deep understanding of asymmetric/symmetric cryptography, TLS/SSL protocols, SSH key management, code signing, and HSM management.
Preferred certifications include CISSP, CISM, or specialized cryptographic credentials.

Location: Jersey City, NJ (hybrid). Compensation: USD 130,000 - 250,000 per year.

View full job page →

Encryption Key Management Engineer Jobs

Senior/Staff Security Engineer

Systems Security Engineer

Security Engineer - Vice President - IAM

Get Encryption Key Management Engineer Jobs alerts