Applied Cryptography and Key Recovery Engineer

HushOne, Inc.; Kirkland (WA); Hybrid; USD 150,000 - 210,000; Full time

Benefits offered by this job

Equity (stock options)

401(k) with company match

Health, dental and vision insurance

Gym membership

AI tokens budget

Job summary

HushOne, Inc. is seeking a security-focused engineer to design and implement cryptographic solutions for protecting sensitive data. You will work with encryption, key hierarchies, rotation and secure sharing, while modeling recovery scenarios and documenting decryption access.

Ideal candidates reason about entropy, authentication and protocol composition, and understand cryptographic erasure limits. Realistic, person-centered recovery design is required.

Qualifications

• Applied cryptography with secure implementation experience.
• Reason about entropy, authentication, and protocol composition.
• Understand the limits of cryptographic erasure.
• Design recovery for a real person, not an ideal user.

Responsibilities

• Use cryptographic libraries and protocols for encryption, key hierarchy, rotation and secure sharing.
• Model recovery contacts, service compromise and insiders; document who can decrypt data.
• Deliver a reviewed key-management design and a tested recovery prototype within 90 days.
• Explain how a user can recover after losing devices without undisclosed master keys.

Skills

Applied cryptography

Secure implementation

Entropy reasoning

Authentication

Protocol composition

Cryptographic erasure

Tools

HSM

Secure enclave

Job description

You design key custody and recovery, so protecting somebody's information does not mean a lost device ends their digital life. These two goals genuinely conflict, and the quality of this role is in how honestly you handle the conflict rather than in picking a side.

The work:

Use established cryptographic libraries and protocols for encryption, key hierarchy, rotation and secure sharing. Work with platform hardware protections where available. Model recovery contacts, service compromise and malicious insiders, and document exactly who can decrypt which data.

What good looks like:

In your first 90 days, deliver a reviewed key-management design and a tested recovery prototype with explicit security assumptions.

Evidence we look for:

Bring applied cryptography and secure implementation experience. Be able to reason about entropy, authentication, protocol composition and the limits of cryptographic erasure.

Required:

• Applied cryptography with secure implementation experience, not only design
• You reason well about entropy, authentication, and protocol composition
• You understand the limits of cryptographic erasure and do not oversell it
• You design recovery for a real person having a bad day, not for an ideal user

Nice to have:

• Threshold cryptography or social recovery schemes
• Secure enclave or HSM key custody
• You have had a design reviewed or audited externally

The exercise:

Explain how a user can recover after losing every device without introducing an undisclosed service-side master key.

How we work:

We work together in the office, five days a week, and you can be based at any of our garages: Kirkland Garage (Kirkland, WA); UAE Garage (Dubai, Dubai). We hire across the United States, India and the UAE. We are remote-friendly around family: if you need to work from home some days to look after the people you love, we arrange that with you one person at a time, and we encourage people to use it rather than tough it out.

Pay:

We publish what we pay. Indicative ranges by market and level are on our compensation page, and they are realistic going market rates rather than headline numbers. Wherever we hire we pay at least the local market rate, and for full-time roles our floor is a living wage, never the statutory minimum. Compensation is reviewed every year and on promotion.

Equity:

Every full-time teammate gets stock options. Four-year vesting with a one-year cliff, sized to role, level and impact, and confirmed in writing at offer. High performers earn refresh grants.

Bonus and commission:

An annual performance bonus tied to clear company and personal goals, indicatively 10 to 20 percent of base for non-sales roles. Customer-facing roles carry on-target earnings, typically a 50/50 split of base and variable, with uncapped commission and accelerators above quota.

Health and peace of mind:

Medical, dental and vision for you and your family, plus life and disability cover. We have chosen the highest plan tier available to us rather than the cheapest one that clears the bar, because the point of this is that you never have to think about it. The specific plan numbers are confirmed in your offer letter.

401(k) with company matching:

A 401(k) with a company match, so the years you spend here compound into something that is yours whatever happens next. The match formula is confirmed in your offer letter.

AI tokens:

A budget of AI tokens of your own, because a company that says you should own your AI cannot be the company that rations it. Use them on the work and on whatever you are curious about.

Gym, and the everyday things:

A gym membership, and a corporate benefits programme with its own app, where you redeem real discounts with a long list of retailers on the ordinary purchases of a life.

Family:

We are remote-friendly around your family, arranged one person at a time, and we would rather you took it than toughed it out.

Referrals:

Refer someone we hire full-time who stays a year and you get $1,000 plus $10,000 in referral stock-based equity, on top of your own package.