Secure-by-Design Encryption Engineer (DevSecOps)

State Street; Princeton (NJ); Hybrid; USD 120,000 - 203,000; Full time

Benefits offered by this job

401(k) with company match

Comprehensive benefits package

Paid time off

Job summary

State Street is seeking an Encryption Engineer (DevSecOps & SDLC) to embed encryption and key management controls across the SDLC and CI/CD pipelines. You will design secure-by-default capabilities and develop reusable IaC templates to accelerate enterprise adoption.

The role collaborates with platform, cloud, and architecture teams to implement cryptographic standards, automate governance, and enable self-service security across on-prem and cloud environments.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Software Engineering, Information Technology, Cybersecurity, or related discipline, or equivalent practical experience.
• 8+ years of experience in software engineering, DevSecOps, platform engineering, cloud engineering, cybersecurity engineering, or related field.
• Experience integrating security controls into SDLC processes, CI/CD pipelines, and modern software delivery platforms.
• Working knowledge of encryption technologies, cryptographic key management, secrets management, certificate lifecycle management, and enterprise data protection controls.
• Experience implementing security automation within development pipelines using tools such as Harness, Jenkins, or similar platforms.
• Hands‑on experience with Infrastructure-as-Code technologies, including Terraform, CloudFormation, or equivalent automation frameworks.
• Proficiency in programming or scripting languages such as Python, Java, Go, C#, JavaScript, TypeScript, PowerShell, or Bash.
• Experience with cloud platforms including Azure, AWS, OCI, or GCP.
• Familiarity with Kubernetes, OpenShift, and cloud-native architectures.
• Understanding of software architecture principles, secure coding practices, and developer enablement methodologies.
• Knowledge of industry security and compliance frameworks (NIST, PCI DSS, ISO 27001).
• Experience with enterprise key management platforms, HSMs, cloud KMS, secrets management, or certificate management is desirable.
• Certifications such as CISSP, CCSP, Azure Security Engineer, AWS Security Specialty, CKS are a plus.

Responsibilities

• Embed enterprise encryption and key management controls into SDLC processes, DevSecOps pipelines, and platform engineering patterns.
• Design and implement secure-by-default encryption capabilities for application teams.
• Develop and maintain reusable automation, APIs, templates, and IaC modules to accelerate encryption adoption.
• Integrate enterprise key management, secrets, certificate management into standard developer workflows and CI/CD toolchains.
• Establish automated guardrails and policy-driven controls across the SDLC.
• Define architectural review triggers for non-conforming designs and address encryption risks early.
• Collaborate with engineering teams to implement approved cryptographic standards across cloud and on‑prem environments.
• Create technical standards and developer enablement materials for encryption and key management.
• Improve Encryption-by-Design program through automation and self-service adoption.
• Monitor implementations to identify gaps and remediation opportunities.
• Support regulatory, audit, and risk initiatives with automated compliance evidence.
• Drive adoption of encryption services by modernizing legacy implementations and aligning new solutions with standards.
• Reduce risk of non‑standard encryption through automated controls and scalable patterns.
• Minimize design exceptions and audit findings by embedding cryptographic controls into development processes.

Skills

Security automation

DevSecOps

Platform engineering

Cloud engineering

Cryptography

CI/CD

Python

Java

Education

Bachelor's degree in Computer Science or related field

Certs such as CISSP/CCSP (plus)

Tools

Terraform

CloudFormation

Harness

Jenkins

Kubernetes

OpenShift

Job description

State Street is seeking an Encryption Engineer (DevSecOps & SDLC) to embed encryption and key management controls across the SDLC and CI/CD pipelines. You will design secure-by-default capabilities and develop reusable IaC templates to accelerate enterprise adoption.

The role collaborates with platform, cloud, and architecture teams to implement cryptographic standards, automate governance, and enable self-service security across on-prem and cloud environments.