Sr System Security Engineer - PKI, Certificate & Key Management

NTT SINGAPORE PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

NTT SINGAPORE PTE. LTD. is seeking an experienced System Security Engineer to design and implement enterprise PKI, CLM, and KMS/HSM security solutions. This role emphasizes cryptography and security engineering beyond general SOC tasks.

The ideal candidate has hands-on PKI, certificate management, HSM experience, familiarity with CLM platforms, and strong scripting for automation, with collaboration across security architects, infrastructure teams and vendors.

Qualifications

• Degree in CS/IT/Cybersecurity or related.
• Minimum 5 years IT/security experience.
• 2+ years hands-on PKI/HSM experience.
• Strong X.509, TLS/mTLS knowledge.
• Experience with CLM platforms.
• Banking/regulated environment experience preferred.

Responsibilities

• Design, implement and operationalise enterprise PKI, Certificate Lifecycle Management and Key Management solutions.
• Design and manage CA hierarchies, including Root and Subordinate CAs.
• Implement certificate lifecycle processes covering discovery, issuance, enrolment, renewal, revocation and expiry management.
• Design and integrate CLM platforms such as CyberArk Venafi, Keyfactor, Entrust or equivalent with enterprise Certificate Authorities.
• Design, deploy and integrate HSM and enterprise Key Management solutions such as Entrust nShield, Thales CipherTrust/Luna HSM or equivalent.
• Support HSM operations including key generation, rotation, key ceremonies and secure key protection.
• Integrate certificate and key-management platforms with enterprise applications and security systems using REST APIs and automation.
• Design and support cloud cryptographic solutions using AWS KMS, ACM, Secrets Manager and CloudHSM.
• Support cryptographic asset discovery and maintain certificate/key inventories or Cryptographic Bill of Materials (CBOM).
• Apply cryptographic standards and best practices including X.509, PKCS, FIPS and NIST.
• Support cryptographic modernization and Post-Quantum Cryptography (PQC)/crypto-agility initiatives.
• Work closely with security architects, application owners, infrastructure teams and technology vendors throughout solution design and implementation.
• Troubleshoot complex PKI, certificate, HSM and key-management issues.

Skills

PKI design

Certificate lifecycle

HSM expertise

CLM platforms

AWS KMS

REST APIs

Python

PowerShell

Bash

Automation

Education

Degree in CS/IT/Cybersecurity

Tools

CyberArk Venafi

Keyfactor

Entrust

AppViewX

Entrust nShield

Thales CipherTrust

Thales Luna

AWS CloudHSM

Job description

Location: Central Singapore

Employment Type: 12-Month Contract, Renewable

Seniority: Mid-Level / Senior

Job Summary

We are looking for an experienced System Security Engineer with strong hands-on expertise in the design and implementation of enterprise PKI, Certificate Lifecycle Management (CLM), Key Management and HSM security solutions.

This is a specialist cryptography/security engineering position and is not a general SOC, vulnerability management or cybersecurity operations role.

Key Responsibilities

• Design, implement and operationalise enterprise PKI, Certificate Lifecycle Management and Key Management solutions.
• Design and manage CA hierarchies , including Root and Subordinate CAs.
• Implement certificate lifecycle processes covering discovery, issuance, enrolment, renewal, revocation and expiry management.
• Design and integrate CLM platforms such as CyberArk Venafi, Keyfactor, Entrust or equivalent with enterprise Certificate Authorities.
• Design, deploy and integrate HSM and enterprise Key Management solutions such as Entrust nShield, Thales CipherTrust/Luna HSM or equivalent.
• Support HSM operations including key generation, rotation, key ceremonies and secure key protection.
• Integrate certificate and key-management platforms with enterprise applications and security systems using REST APIs and automation.
• Design and support cloud cryptographic solutions using AWS KMS, ACM, Secrets Manager and CloudHSM.
• Support cryptographic asset discovery and maintain certificate/key inventories or Cryptographic Bill of Materials (CBOM).
• Apply cryptographic standards and best practices including X.509, PKCS, FIPS and NIST.
• Support cryptographic modernization and Post-Quantum Cryptography (PQC)/crypto-agility initiatives.
• Work closely with security architects, application owners, infrastructure teams and technology vendors throughout solution design and implementation.
• Troubleshoot complex PKI, certificate, HSM and key-management issues.

Requirements

• Degree in Computer Science, Information Technology, Cybersecurity or related discipline.
• Minimum 5 years of IT/security experience, including at least 2 years of hands-on PKI, Certificate Management, HSM or Enterprise Key Management experience.
• Strong experience designing and implementing , rather than only supporting, enterprise certificate and key-management solutions.
• Strong knowledge of X.509, TLS/mTLS, CA hierarchy, certificate issuance/renewal/revocation and PKI architecture.
• Hands-on experience with CyberArk Venafi / Keyfactor / Entrust / AppViewX or similar CLM platforms.
• Hands-on experience with Entrust nShield / Thales CipherTrust / Thales Luna / AWS CloudHSM or similar HSM/KMS technologies.
• Knowledge of AWS KMS, ACM, Secrets Manager and CloudHSM is highly desirable.
• Experience with Python, PowerShell, Bash and/or REST APIs for automation is advantageous.
• Knowledge of FIPS, NIST, PKCS, crypto-agility and PQC is advantageous.
• Strong stakeholder and vendor management skills.
• Experience within banking, financial services or other highly regulated enterprise environments is preferred.

We look forward to your application!