Cryptography Engineer

Stott and May; Brussel Hoofdstad; Sur place; EUR 90 000 - 120 000; Plein temps

Résumé du poste

Stott and May is seeking a Cryptography Engineer for Key, Certificate & HSM Management. This contract role in Belgium entails hybrid work (50% on site, 50% remote) and requires strong expertise in HSM, PKI, HashiCorp Vault, and cryptographic standards.

You will own lifecycle management of keys and certificates, lead initiatives like post-quantum readiness, and collaborate with security and IT teams to satisfy regulatory requirements including PSD2 and PCI.

Qualifications

• 5+ years of cryptography/security experience.
• Experience with HSM platforms and PKI operations.
• Ability to translate requirements into secure IT solutions.
• Familiarity with agile development practices.

Responsabilités

• Manage the lifecycle of keys, certificates and secrets, including rotation, revocation and access control.
• Monitor and maintain HSM infrastructure to ensure high availability and compliance.
• Troubleshoot incidents and close security gaps across authentication, encryption and secret storage.
• Lead crypto initiatives such as post-quantum readiness and HSM lifecycle management.
• Collaborate with IT architects and security teams to translate regulatory and business requirements into technical solutions.

Connaissances

HSMs

PKI

HashiCorp Vault

NIST

High availability

Agile

MS Office

Outils

Entrust nShield

nCipher

Python

Bash

ServiceNow

Rally

Description du poste

Cryptography Engineer - Key, Certificate & HSM Management

Engagement:Freelance / contract

Location:Belgium - hybrid (50% on site, 50% homeworking)

Experience required:5+ years relevant experience

Context

Our client is a major financial institution operating a dedicated Key, Certificate and Key Management team of approximately 15 specialists in Belgium, sitting within a wider production security function.

The team owns the lifecycle management of cryptographic keys, digital certificates (internal, group and public) and application secrets managed through HashiCorp Vault. Its mission is to secure electronic transactions, authentication flows and cloud-hosted applications while maintaining full compliance with EU and internal regulatory requirements, including PSD2 and PCI.

The team also operates and supports the organisation's Hardware Security Module (HSM) estate, providing a trusted environment for both internal and external consumers. It acts as the go‑to partner for stakeholders across the business, delivering cost‑efficient and reliable security solutions.

Responsibilities

Operations

• Manage the lifecycle of cryptographic keys, digital certificates and application secrets, including rotation, revocation and access control.
• Monitor and maintain HSM infrastructure; including enterprise HSM appliances and mainframe TKE; to ensure high availability and compliance.
• Troubleshoot incidents and work with delivery teams to close security gaps across authentication, encryption and secret storage.

Expertise & Projects

• Act as a Crypto Design Authority, advising on cryptographic standards, algorithms and best practice (NIST, PCI‑DSS, PSD2).
• Lead or contribute to strategic initiatives, including:
• Post-quantum cryptography;risk assessment and migration towards quantum-resistant solutions.
• EKU readiness;preparing systems for Extended Key Usage compliance.
• HSM lifecycle management;support, configuration and key ceremonies.
• Crypto agility;improving certificate and key lifecycle management processes.
• Platform integration;aligning local platforms with central group tooling.
• Partner with central security functions, IT architects and application owners to translate regulatory and business requirements into technical solutions.

Must-have skills

• Deep IT security expertise, with technical mastery ofHSMs,PKI,HashiCorp Vaultand cryptographic standards (NIST).
• Proven operational oversight of high-availability infrastructure.
• Ability to translate abstract security requirements into feasible IT solutions, balancing cost efficiency, compliance and developer practicality.
• Comfortable working in an agile environment — anticipating change and prioritising flexibly without compromising production stability.
• Microsoft Office (Word, Excel, PowerPoint).

Preferred

• Hands‑on experience withEntrust nShield / nCipheror equivalent enterprise HSM platforms.
• Scripting (Python, Bash or similar).
• ServiceNow, Rally.
• Formal agile methodology adoption.

Languages: French & English