Senior Cryptography Analyst

Aviva plc; Markham; On-site; CAD 100,000 - 125,000; Full time

Benefits offered by this job

Base salary with bonus potential

Retirement savings plan

Health benefits

Job summary

Aviva Canada is seeking a Senior Cryptography Analyst to safeguard cryptographic assets, govern Vault services, and drive Post-Quantum Cryptography readiness.

You will own key and secrets management, TLS certificate lifecycle, and automation across enterprise platforms, partnering with architecture and engineering teams for secure transformation.

Qualifications

• Extensive HashiCorp Vault administration and governance.
• Strong PKI and TLS certificate lifecycle management experience.
• Experience with encryption standards, cryptographic algorithms, and key management practices.
• Knowledge of AWS KMS and Hardware Security Modules (Thales Luna preferred).
• Experience in 24x7 production services and incident management.

Responsibilities

• Act as enterprise cryptography SME for encryption, PKI, and secrets management.
• Oversee Vault services, key rotation, and privileged secrets governance.
• Lead TLS certificate lifecycle governance and automation initiatives.
• Drive PQC readiness assessments and crypto migrations.
• Coordinate risk assessments, security reviews, and incident response.

Skills

Vault administration

PKI

TLS certificate management

Key management

Automation

AWS KMS

HSMs

RBAC

Incident management

Tools

HashiCorp Vault

Kubernetes

Sectigo

ACME

CI/CD

Cloud-native services

Job description

Individually we are people, but together we are Aviva. Individually these are just words, but together they are our Values – Care, Commitment, Community, and Confidence. At Aviva Canada, we put people first, our employees, our customers, and our communities. We’re proud of a culture built on care, inclusion, and collaboration, where your voice matters and your growth is supported. We’re not just about insurance; we’re about making a real difference by protecting what matters most.

The Senior Cryptography Analyst plays a critical security role responsible for safeguarding Aviva Canada's cryptographic assets, ensuring the secure management of keys, secrets, and certificates, driving Post-Quantum Cryptography readiness, and providing governance and operational oversight of two business-critical 24x7 cryptographic services. This role serves as a trusted advisor on cryptographic strategy, compliance, operational excellence, and future-state cryptographic transformation.

What you'll do

Cryptography Governance & Advisory

• Act as the enterprise SME for cryptography, encryption, PKI, and secrets management.
• Advise teams on encryption strategies, cryptographic controls, and approved solutions.
• Develop and maintain cryptographic standards, procedures, and guidelines.
• Review solution designs and provide guidance on encryption at rest/in transit, key and secrets management, certificates, and algorithms.
• Support security architecture reviews and risk assessments.

Encryption Key & Secrets Lifecycle Management

• Own governance and lifecycle management of enterprise encryption keys and secrets.
• Oversee key generation, storage, rotation, archival, and destruction.
• Manage HashiCorp Vault services and protect privileged secrets and cryptographic assets.
• Ensure compliance with industry standards and regulatory requirements.
• Define and monitor key management benchmarks and the efficiency of operations.

HashiCorp Vault Service Ownership

• Provide administration and operational oversight of HashiCorp Vault platforms.
• Manage authentication, RBAC, access governance, secrets lifecycle, and tenant onboarding/offboarding.
• Support integrations with AWS KMS, HSMs, cloud secret stores, and automation platforms.
• Lead efforts to fix issues, incident resolution, and platform modernization initiatives.

TLS Certificate Lifecycle & Automation

• Own TLS/SSL certificate governance and lifecycle management.
• Oversee certificate issuance, renewal, replacement, revocation, and retirement.
• Drive automation using ACME, Sectigo, Vault PKI, Cert-Manager, Kubernetes, and cloud-native services.
• Establish certificate standards for CAs, key lengths, algorithms, and ownership.
• Reduce manual processes through automation and continuous improvement.

Post-Quantum Cryptography (PQC) Assessment & Readiness

• Lead enterprise PQC readiness assessments.
• Maintain visibility of cryptographic assets across applications, certificates, keys, and secrets.
• Assess PQC risks and develop transition and remediation strategies.
• Partner with architecture and engineering teams on migration planning.
• Monitor industry and regulatory developments in quantum-resistant cryptography.

Operational Leadership & Service Management

• Provide operational leadership for TLS Certificate Management and HashiCorp Vault services.
• Oversee contractor resources, service delivery, and operational priorities.
• Monitor service performance, availability, incidents, and improvement opportunities.
• Ensure resilience, availability, and continuous service enhancement.

Incident, Change & Critical Issue Management

• Function as the main point of contact for major incidents, emergencies, and service outages related to customer concerns.
• Participate in after-hours support and incident response.
• Lead root cause analysis and remediation of cryptography-related issues.
• Support change management, CAB activities, and proactive risk mitigation.

HSM & Root of Trust Management

• Support enterprise HSM infrastructure, including Thales Luna HSM platforms.
• Manage auto-unseal configurations, root key protection, key rotation, and disaster recovery.
• Coordinate platform upgrades and lifecycle management.
• Maintain secure root-of-trust controls across cryptographic services.

Compliance, Risk & Audit Governance

• Serve as the authority for enterprise cryptographic compliance and governance.
• Ensure alignment with security policies, regulations, audit requirements, and governance frameworks.
• Support audits and maintain compliance evidence and reporting.
• Identify and remediate cryptographic risks and control gaps.

Monitoring, Reporting & Service Metrics

• Develop executive and operational reporting for cryptographic services.
• Track critical metrics covering Vault health, certificate management, automation, compliance, and PQC readiness.
• Leverage monitoring and reporting tools including Dynatrace, Rapid7, SiteScope, Power BI, and Excel.
• Provide insights to improve service performance and governance.

What you’ll bring

• Technical Expertise Extensive experience with HashiCorp Vault administration and governance.
• Strong PKI and TLS certificate lifecycle management experience.
• Experience implementing and supporting TLS certificate automation solutions.
• Experience performing Post-Quantum Cryptography assessments and readiness planning.
• Solid understanding of encryption standards, cryptographic algorithms, and key management practices.
• Experience with Hardware Security Modules (Thales Luna preferred).
• Knowledge of AWS cloud services and KMS technologies.
• Experience integrating cryptographic services into enterprise platforms and applications.
• Scripting and automation experience using APIs and CI/CD pipelines.
• Leadership & Governance Experience leading vendors, consultants, or contract resources.
• Ability to influence security and technology decisions across multiple teams.
• Strong understanding of regulatory, audit, and compliance requirements.
• Experience operating critical production services within a 24x7 environment.
• Strong incident and problem management experience.

What makes you stand out

• Experience in insurance or financial services.
• Kubernetes and Cert-Manager experience.
• Cloud security and DevSecOps experience.
• PQC frameworks, standards, and industry transition planning experience.

What you’ll get

The salary band for this position ranges from $100,000 to $125,000. Please note that individual salary is determined by factors such as job-related knowledge, skills and experience, as well as internal equity.

Compelling rewards package including base compensation, eligibility for annual bonus, retirement savings, share plan, health benefits, personal wellness, and volunteer opportunities.

Outstanding Career Development opportunities. We’ll support your professional development education.

Competitive vacation package with the option to purchase 5 extra days off per year.

Employee driven programs focused on gender, LGBTQ+, origins, diversity, and inclusion.

Corporate wellness programs to support our employees’ physical and mental health.

Employee discount on home and auto insurance (where applicable).

Hybrid flexible work model.

This job advertisement is for an existing vacancy which has been posted both internally & externally. Aviva Canada may use AI (Artificial Intelligence) tools to assist us throughout the recruitment process to screen, assess or select applicants for a position.

Aviva Canada welcomes applications from all qualified individuals and has a process in place to provide accommodations for persons with disabilities at all stages of the hiring process and during employment. If you require an accommodation during the interview or hiring process, please contact your Aviva Talent Acquisition Partner so that an appropriate accommodation can be arranged.

#LI-PS1 #LI-Hybrid

We help our 19.5 million customers to save for the future and manage the risks of everyday life. To give these customers the best possible products and service we know we must make Aviva the most attractive choice for talented, entrepreneurial people with diverse backgrounds and an evolving range of expertise and insight. So, we’re passionate about helping our 23,000 people to do the best work of their lives, to enable them to make a positive difference to the lives of our customers.