Senior Associate Cryptography Researcher

National Payments Corporation Of India (NPCI); Hyderabad; On-site; INR 1,500,000 - 2,200,000; Full time

Job summary

National Payments Corporation Of India (NPCI) seeks a security-focused cryptography expert to design and implement encryption, PKI, and secure transport across payment platforms. You will build reusable Java SDKs, evaluate TLS/mTLS configurations, and integrate with HSMs, while guiding threat modeling and PQC readiness.

Ideal candidates have deep knowledge of AES, RSA, ECC, JWT, and secure coding practices, plus hands-on Java/JCA/JCE experience and SDK development capabilities.

Qualifications

• Proficient in modern cryptography including AES, RSA, ECC, hashing, HMAC and key derivation.
• Experience with PKI, TLS/mTLS, JWT/JWS/JWE and OAuth2, with secure protocol handling.
• Strong Java development using JCA/JCE and production-grade SDKs/libraries.
• Familiar with Maven/Gradle, Git, CI/CD, JUnit and Mockito; avoid custom crypto algorithms.

Responsibilities

• Understand system architecture and data flows to apply encryption, signing, authentication and key management.
• Design and implement cryptographic solutions—encryption, signatures, hashing, key derivation, secure storage and transport.
• Build and maintain Java SDKs/libraries with clean APIs, versioning, docs and backward compatibility.
• Implement and troubleshoot PKI components: X.509, chain validation, CSRs, CRL/OCSP, TLS/mTLS config.
• Integrate with HSMs and key management systems (PKCS#11); design key lifecycle processes.
• Participate in threat modeling and design reviews; justify algorithms and key sizes.
• Remediate findings from code reviews, SAST/DAST, penetration tests and audits.
• Write unit/integration/negative tests and known-answer tests with standard vectors.
• Support SDK users; produce technical docs and compliance evidence.
• Stay updated on post-quantum cryptography developments and assess system impact.

Skills

Symmetric encryption

Asymmetric cryptography

Hashing

Key derivation

Authenticated encryption

Java (8+)

JCA/JCE

Bouncy Castle

Maven/Gradle

Git / CI/CD / JUnit / Mockito

Education

B.E./B.Tech/MCA or equivalent in CS/IT/Electronics

Tools

OpenSSL

PKCS#11

Bouncy Castle library

Job description

Job Description:

Key Responsibilities:

• Understand system architecture and data flows, and identify where encryption, signing, authentication, and key management are needed.
• Design and implement cryptographic solutions: encryption, digital signatures, hashing, key derivation, secure key storage, and secure transport.
• Build and maintain Java SDKs and libraries with clean APIs, versioning, documentation, and backward compatibility.
• Implement and troubleshoot PKI components: X.509 certificates, chain validation, CSRs, CRL/OCSP, and TLS/mTLS configuration.
• Integrate with HSMs and key management systems (PKCS#11), and design key lifecycle processes: generation, rotation, backup, and destruction.
• Take part in threat modelling and design reviews, and recommend algorithms, key sizes, and parameters with clear reasoning.
• Remediate findings from code reviews, static and dynamic analysis, penetration tests, and audits.
• Write unit, integration, and negative tests, including known-answer tests with standard test vectors.
• Support teams that integrate the SDK, and produce technical documentation and compliance evidence.
• Follow developments in post‑quantum cryptography (ML‑KEM, ML‑DSA, hybrid key exchange or Newer PQC algorithm) and help assess their impact on our systems.

Required SkillsCryptography (must be able to explain the reasoning, not only the usage)

• Symmetric encryption (AES; GCM, CBC, CTR modes) and the consequences of nonce/IV misuse.
• Asymmetric cryptography: RSA (OAEP, PSS), ECC (ECDSA, ECDH, Ed25519, X25519).
• Hashing, HMAC, key derivation (HKDF, PBKDF2), and secure random generation.
• Authenticated encryption and key management principles.

PKI and protocols

• X.509, certificate lifecycle, trust chain validation.
• TLS 1.2/1.3 and mTLS: handshake, cipher suites, session resumption.
• JWT/JWS/JWE, OAuth2, and signature formats such as CMS/PKCS#7.

Development

• Strong Java (Java 8 or later): collections, concurrency, exception handling, JVM basics.
• Hands-on experience with JCA/JCE and Bouncy Castle. Use of vetted libraries only, no custom algorithms.
• Experience building reusable libraries or SDKs with Maven or Gradle.
• Git, CI/CD, JUnit, and Mockito.

Security engineering

• Secure coding practices (OWASP Top 10): constant-time comparison, safe error handling, no secrets in logs.
• Understanding of threat modelling and trust boundaries.

Education: B.E./B.Tech/MCA or equivalent in Computer Science, IT, Electronics, or a related field.

Good to Have

• Android development: Android Keystore, secure storage, AAR packaging.
• HSM experience (PKCS#11) and key management systems.
• Experience in payments, banking, or fintech security (PCI DSS, RBI guidelines, ISO 27001).
• Knowledge of TLS stacks and gateways (OpenSSL, Tomcat, Bouncy Castle JSSE).
• Familiarity with SAST/DAST tools, Kotlin, Spring Boot, or Docker.
• Security certifications or open-source contributions.