System Security Engineer

AVATAR MODERN TECHNO SERVICES PTE. LTD.; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

AVATAR MODERN TECHNO SERVICES PTE. LTD. is seeking a seasoned Cryptography Engineer/PKI program lead to coordinate delivery between IT security architects, partners, and consuming teams.

You will advance certificate and key management across on-prem and AWS, enabling a PQC transition with strong governance and operational excellence. The role requires deep PKI expertise, hands-on HSM experience, and proven ability to collaborate with vendors and internal teams to ensure security, reliability,

Qualifications

• 5+ years IT security with PKI or enterprise key management
• Strong knowledge of X.509, TLS/mTLS, PKCS, certificate authorities, and key hierarchies
• Hands-on experience with certificate lifecycle platforms (CyberArk Venafi, Keyfactor, Entrust)
• Hands-on experience with enterprise key management and/or HSMs (Entrust nShield, Thales CipherTrust, AWS KMS/CloudHSM)
• Experience integrating security platforms with enterprise systems via REST APIs (ServiceNow, PingOne, Splunk, Nessus)
• Proficiency in scripting languages (Python/PowerShell/Bash)
• Detail-oriented with strong analytical and problem-solving skills
• Experience with SDLC/Agile methodologies
• Excellent written and verbal communication; cross-stakeholder coordination

Responsibilities

• Coordinate delivery between IT security architects, partners, and consuming teams for PKI/CLM/EKMS
• Conduct requirement workshops across on-prem and AWS estates
• Review CLM/EKMS designs to meet security and operational needs
• Set up and streamline certificate and key management processes (issuance, renewal, revocation, rotation)
• Incorporate cryptography best practices (FIPS, NIST, X.509, PKCS) into workflows
• Monitor incidents related to certificates and keys; advise teams
• Manage vendor relationships for cryptographic solutions
• Coordinate projects between internal resources and external vendors
• Support cryptographic asset discovery and PQC transition; prep for cryptography engineer role

Skills

PKI management

Certificate lifecycle

HSMs

Cloud PKI (AWS)

Scripting: Python/PowerShell/Bash

REST API integration

Agile / SDLC

Communication skills

Education

Degree in Computer Science/Information Technology

Tools

CyberArk Venafi

Keyfactor

Entrust

AWS KMS/CloudHSM

Thales CipherTrust

ServiceNow

PingOne

Splunk

Nessus

Job description

Summary:

The successful candidate is responsible to coordinate delivery between IT security architects, implementation partners, and consuming teams. He/she will handle Cryptography Engineer function supporting the downstream Post-Quantum Cryptography (PQC) transition.

Responsibilities:

• Work closely with IT Security Architects (Cryptography and PKI), implementation partners (CLM, EKMS), CA/PKI operators, and application owners to implement and operationalize certificate and key management solutions using best-of-breed technology and methodology.
• Conduct requirement workshops with application teams and platform owners, analyze certificate and key management requirements holistically across on-premises and Cloud (AWS) estates.
• Contribute to, influence, and review the design of CLM and EKMS solutions to ensure they meet both security and operational needs; demonstrate technical depth in PKI, certificate lifecycle, and key management.
• Set up, improve, and streamline certificate and key management operational processes (issuance, renewal, revocation, discovery, rotation, escrow) for continuous improvement and to eliminate outage risk from expiry.
• Incorporate cryptographic and key management best practices (FIPS, NIST, X.509, PKCS) into operational workflows and platform configuration.
• Monitor, analyze, investigate, and resolve day-to-day operational incidents relating to certificates, keys, and HSMs; provide advisory to application teams.
• Manage and maintain strong vendor relationships (CyberArk, AgileSec, Entrust nShield) to ensure continuous support and knowledge transfer for current and future cryptographic needs.
• Play an active role in project coordination between internal resources and third parties/vendors for CLM and EKMS execution.
• Support the cryptographic asset discovery and inventory (CBOM) that underpins the PQC transition, and prepare to take on the cryptography engineer role for hybrid-PQC piloting and migration.

Requirements:

• Possess a degree in Computer Science/Information Technology or related fields.
• At least 5 years of working experience, of which at least 2 years hands-on in PKI, certificate lifecycle management, or enterprise key management and preferably within the financial services/banking industry.
• Good understanding of the principles, key controls, and processes relating to cryptography, PKI, and key management (X.509, TLS/mTLS, PKCS standards, certificate authorities, key hierarchies, HSM-backed key protection).
• Hands-on experience in implementing or operating a Certificate Lifecycle Management platform (e.g. CyberArk Venafi, Keyfactor, Entrust) - discovery, policy, automated enrolment/renewal, CA integration.
• Hands-on experience with enterprise key management and/or HSMs (e.g. Entrust nShield, Thales CipherTrust, AWS KMS/CloudHSM), including Security World / key ceremony concepts.
• Experience in integrating security platforms with enterprise systems via REST APIs — e.g. ITSM (ServiceNow), IAM/SSO (PingOne), SIEM/observability (Splunk, Datadog), vulnerability scanning (Nessus).
• Experience and proficient in scripting/programming languages for automation — e.g. Python, PowerShell, and/or Bash.
• Good at working with detail and meticulous in operations; strong analytical skills and enjoys complex problem solving.
• Experience with SDLC and/or Agile methodologies (e.g. Scrum, Kanban).
• A good team player with excellent written and verbal communication skills, and strong interpersonal skills to coordinate across diverse stakeholders and vendors.