Cryptography Engineer

Qorsa Corp; Southwestern Ontario; On-site; CAD 120,000 - 180,000; Full time

Benefits offered by this job

Dental care

Extended health care

Vision care

On-site parking

Job summary

Qorsa Corp in Waterloo, Ontario, seeks a Cryptography Engineer to advance the crypto core of CasQade—our crypto‑agile TLS and PKI platform—and related hardware programs. You will decide algorithms, implement them, and enable customers to migrate fleets without downtime, partnering with Go-based systems and hardware teams.

The role emphasizes production-grade cryptography, security standards, and collaboration across software, hardware, and security engineering.

Qualifications

• Experience implementing cryptography in production software.
• Strong understanding of TLS 1.3, X.509 certificate validation and public-key cryptography.
• Working knowledge of current issues in post-quantum cryptography.
• Comfort working in Go, Rust, C or similar languages.
• Eligibility for Government of Canada security clearance (Secret level).

Responsibilities

• Implement post-quantum and hybrid algorithms (ML-KEM, ML-DSA) in our TLS stack and certificate authority.
• Design how hosts negotiate, switch and retire algorithms across a fleet, and how those changes are signed and distributed.
• Maintain the crypto provider interface that lets the platform use software implementations or hardware-backed keys in HSMs and PKCS#11 tokens.
• Define certificate profiles and key hierarchies for post-quantum and hybrid agile PKI.
• Review cryptographic code across the product for correctness, constant-time behaviour and misuse of primitives.
• Write test vectors, fuzz targets and interoperability tests against other TLS and PKI implementations.
• Follow IETF and NIST standards work and decide when a draft is stable enough to implement.
• Support FIPS 140-3 and Common Criteria preparation where our products need validation.

Skills

Cryptography in prod

TLS 1.3 & X.509

Post-quantum crypto

Go / Rust / C

Security clearance eligibility

Tools

HSMs

PKCS#11

Job description

About Qorsa

Qorsa is a Canadian post-quantum cryptography and cybersecurity company building CasQade — a crypto-agile security platform protecting sovereign government, defence, financial, and critical-infrastructure networks against current and emerging cryptographic threats. We are headquartered in Waterloo, Ontario, with a European subsidiary in The Hague, Netherlands. Our work spans post-quantum cryptography, explainable AI, AI-driven threat intelligence, cryptographic agility, hardware security, and distributed systems, with active engagements across Canadian defence, NATO, and allied partner organizations.

The Role

We are hiring a Cryptography Engineer to work on the cryptography at the core of CasQade, our crypto-agile TLS and PKI platform, and on related products including our hardware program. You will decide which algorithms and parameters we ship, implement them correctly, and make it possible for customers to move entire fleets to new algorithms without taking systems offline.

Most of the code is Go. You will work closely with the engineers building our certificate authority and TLS proxy, and with our hardware team on the interface between software and silicon.

This is frontier work. Post-quantum standards are still settling, and much of the value you bring will be judgement: knowing when a draft is stable enough to build on, and how to ship cryptography that stays correct as the algorithms underneath it change.

Responsibilities

• Implement post-quantum and hybrid algorithms (ML-KEM, ML-DSA) in our TLS stack and certificate authority.
• Design how hosts negotiate, switch and retire algorithms across a fleet, and how those changes are signed and distributed.
• Maintain the crypto provider interface that lets the platform use software implementations or hardware-backed keys in HSMs and PKCS#11 tokens.
• Define certificate profiles and key hierarchies for post-quantum and hybrid agile PKI.
• Review cryptographic code across the product for correctness, constant-time behaviour and misuse of primitives.
• Write test vectors, fuzz targets and interoperability tests against other TLS and PKI implementations.
• Follow IETF and NIST standards work and decide when a draft is stable enough to implement.
• Support FIPS 140-3 and Common Criteria preparation where our products need validation.

What We’re Looking For

• Experience implementing cryptography in production software.
• A good understanding of TLS 1.3, X.509 certificate validation and public-key cryptography.
• Working knowledge of current issues in post-quantum cryptography.
• Comfort working in Go, Rust, C or similar languages.
• Excellent communication skills and genuine comfort working across disciplines, with software, hardware and security engineers.
• Eligibility for Government of Canada security clearance (Secret level).

Strong Assets

• Proficiency implementing directly from RFCs and NIST specifications.
• Contributions to an open-source cryptography or TLS library.
• Experience with HSMs, PKCS#11, or cryptography on embedded or custom hardware.
• Experience writing constant-time code and reasoning about side channels.
• Experience taking a product through FIPS 140-3 or Common Criteria validation.

Compensation

We compensate exceptionally well — a strong base salary plus meaningful stock options in a rapidly growing company.

Benefits

• Dental care
• Extended health care
• Vision care
• On-site parking

Work Location: In person, Waterloo, Ontario.