Lead Cryptographic Engineer: PKI, Key Management & HSM Ops

SECU; Raleigh (NC); On-site; USD 150,000 - 210,000; Full time

Job summary

North Carolina State Employees Credit Union is seeking a Lead Cryptographic Engineer to own cryptographic infrastructure, certificate lifecycle, and key management at scale. You will collaborate with Security, Infrastructure, and Compliance teams to ensure data protection across member and enterprise systems.

The role requires leadership in PKI design, HSM operations, and automation, with a focus on policy development, audit readiness, and transition planning for post-quantum cryptography.

Qualifications

• 7+ years of information security experience with PKI and cryptographic systems.

Responsibilities

• Design and operate key management across cloud KMS and on-prem HSMs.
• Plan and execute key generation and signing ceremonies with split knowledge and dual control.
• Maintain enterprise cryptographic infrastructure including ADCS and certificate lifecycle platforms.
• Own PKI end-to-end: offline root, issuing CA hierarchy, and CP/CPS docs.
• Lead certificate lifecycle automation to reduce manual issuance and renewal.
• Ensure PKI operations comply with CA/Browser Forum and industry standards.
• Evaluate PQC transition and migration roadmaps.
• Develop cryptographic policies, standards, and runbooks; set data protection standards.
• Create CBOM covering algorithms, libraries, and dependencies.
• Collaborate on audits, risk assessments, and incident response for crypto assets.
• Mentor junior engineers and contribute to the Data Protection roadmap.

Skills

Public key infrastructure

Key management

Certificate lifecycle management

Python/Go automation

Cloud PKI

TLS/S/MIME/code signing

Communications with stakeholders

Education

Bachelor's degree or higher in IT Security

Tools

Venafi

DigiCert

ADCS

Thales HSM

Entrust nShield

AWS CloudHSM

CyberArk

Job description

North Carolina State Employees Credit Union is seeking a Lead Cryptographic Engineer to own cryptographic infrastructure, certificate lifecycle, and key management at scale. You will collaborate with Security, Infrastructure, and Compliance teams to ensure data protection across member and enterprise systems.

The role requires leadership in PKI design, HSM operations, and automation, with a focus on policy development, audit readiness, and transition planning for post-quantum cryptography.