Lead PKI & Cryptographic Security Engineer

SECU; North Carolina; On-site; USD 150,000 - 190,000; Full time

Job summary

SECU, North Carolina’s State Employees Credit Union, seeks a Lead Cryptographic Engineer to own the design, operation, and continuous improvement of the cryptographic infrastructure protecting member and enterprise data. You will steward PKI, key management, and certificate lifecycle tooling across cloud and on‑prem environments.

As a senior technical leader, you will mentor engineers and partner with Security, Infrastructure, and Compliance teams.

Qualifications

• 7+ years in information security with focus on PKI and cryptographic systems.
• Production PKI ownership including CA hierarchy design and HSM operations.
• Hands-on tooling experience with Venafi, CyberArk, DigiCert, and ADCS.

Responsibilities

• Design and operate key management across cloud KMS and on-prem HSMs.
• Lead key generation/signing ceremonies with split knowledge and auditable procedures.
• Oversee enterprise PKI including offline root, issuing CA hierarchy, and CBOM.
• Automate certificate lifecycle to reduce manual issuance, renewal, and revocation.
• Ensure PKI operations comply with CA/Browser Forum baselines and industry standards.
• Plan and support transition to post-quantum cryptography (PQC) and related roadmaps.
• Develop cryptographic policies, standards, and runbooks for envelope encryption and data protection.
• Mentor junior engineers and contribute to the Data Protection roadmap.

Skills

PKI management

HSM operations

Python

Go

CI/CD

Cloud security

TLS/S/MIME

cryptographic protocols

leadership

communication

Education

Bachelor's degree in IT Security

Associates degree acceptable with experience

Tools

Venafi

DigiCert

Microsoft ADCS

HSM platforms (Thales, Entrust nShield, AWS CloudHSM)

Job description

SECU, North Carolina’s State Employees Credit Union, seeks a Lead Cryptographic Engineer to own the design, operation, and continuous improvement of the cryptographic infrastructure protecting member and enterprise data. You will steward PKI, key management, and certificate lifecycle tooling across cloud and on‑prem environments.

As a senior technical leader, you will mentor engineers and partner with Security, Infrastructure, and Compliance teams.