Cryptography Engineer

Stott and May; Brussel; Hybride; EUR 111 000 - 185 000; Plein temps

Résumé du poste

Stott and May is seeking a Cryptography Engineer to join a Belgian, hybrid team focused on Key, Certificate and HSM management within a major financial institution.

You will own the lifecycle of cryptographic keys, certificates and Vault-based secrets, and lead crypto discussions including post-quantum readiness and HSM operations. The role requires collaboration with security architects, IT teams and application owners in a 50% on-site, 50% homeworking setup in Belgium.

Qualifications

• Deep IT security expertise with hands-on mastery of HSMs, PKI, Vault and cryptographic standards (NIST).
• Operational oversight of high-availability infrastructure.
• Ability to translate security requirements into feasible IT solutions balancing cost, compliance and practicality.
• Comfortable in an agile environment with production stability as a priority.

Responsabilités

• Manage the lifecycle of cryptographic keys, digital certificates and application secrets, including rotation and access control.
• Monitor and maintain HSM infrastructure to ensure high availability and compliance.
• Troubleshoot incidents and close security gaps across authentication, encryption and secret storage.

Connaissances

HSM management

PKI

HashiCorp Vault

NIST standards

High availability

Agile

Microsoft Office

Outils

Entrust nShield

nCipher

Python scripting

Bash scripting

Description du poste

Cryptography Engineer - Key, Certificate & HSM Management

Engagement: Freelance / contract

Location: Belgium - hybrid (50% on site, 50% homeworking)

Experience required: 5+ years relevant experience

Context

Our client is a major financial institution operating a dedicated Key, Certificate and Key Management team of approximately 15 specialists in Belgium, sitting within a wider production security function.

The team owns the lifecycle management of cryptographic keys, digital certificates (internal, group and public) and application secrets managed through HashiCorp Vault. Its mission is to secure electronic transactions, authentication flows and cloud-hosted applications while maintaining full compliance with EU and internal regulatory requirements, including PSD2 and PCI.

The team also operates and supports the organisation's Hardware Security Module (HSM) estate, providing a trusted environment for both internal and external consumers. It acts as the go-to partner for stakeholders across the business, delivering cost-efficient and reliable security solutions.

Responsibilities

Operations

• Manage the lifecycle of cryptographic keys, digital certificates and application secrets, including rotation, revocation and access control.
• Monitor and maintain HSM infrastructure; including enterprise HSM appliances and mainframe TKE; to ensure high availability and compliance.
• Troubleshoot incidents and work with delivery teams to close security gaps across authentication, encryption and secret storage.

Expertise & Projects

• Act as a Crypto Design Authority, advising on cryptographic standards, algorithms and best practice (NIST, PCI-DSS, PSD2).
• Lead or contribute to strategic initiatives, including:
• Post-quantum cryptography; risk assessment and migration towards quantum-resistant solutions.
• EKU readiness; preparing systems for Extended Key Usage compliance.
• HSM lifecycle management; support, configuration and key ceremonies.
• Crypto agility; improving certificate and key lifecycle management processes.
• Platform integration; aligning local platforms with central group tooling.
• Partner with central security functions, IT architects and application owners to translate regulatory and business requirements into technical solutions.

Must-have skills

• Deep IT security expertise, with technical mastery of HSMs, PKI, HashiCorp Vault and cryptographic standards (NIST).
• Proven operational oversight of high-availability infrastructure.
• Ability to translate abstract security requirements into feasible IT solutions, balancing cost efficiency, compliance and developer practicality.
• Comfortable working in an agile environment — anticipating change and prioritising flexibly without compromising production stability.
• Microsoft Office (Word, Excel, PowerPoint).

Preferred

• Hands-on experience with Entrust nShield / nCipher or equivalent enterprise HSM platforms.
• Scripting (Python, Bash or similar).
• ServiceNow, Rally.
• Formal agile methodology adoption.

Languages

French & English