Senior Lead Security Engineer: Cryptography & Key Management

Aumni; Plano (TX); On-site; USD 150,000 - 190,000; Full time

Job summary

JPMorganChase is seeking a Senior Lead Security Engineer to own cryptography and key management strategy across platforms. You will lead design, development, and operation of HSM integrations, envelope encryption, PKI, TLS, and risk-based controls in a fast-moving financial environment.

You will mentor teams, drive post-quantum readiness, and enable secure-by-default architectures while advising senior leaders during vulnerability periods and risk assessments.

Qualifications

• Formal training or certification on security engineering concepts and 5+ years applied experience.
• Strong foundation in system design and applied cryptography, with demonstrated experience building secure systems.
• Hands-on experience with key management concepts and implementations, including envelope encryption, key hierarchies, rotation, least-privilege access, segregation of duties, audit logging, and break-glass controls.

Responsibilities

• Own the cryptography and key management strategy and roadmap across platforms and applications, including standards, reference architectures, and secure-by-default patterns covering encryption, signing, and key lifecycle.
• Lead the design and development of key management and data protection capabilities, including hardware security module and key management service integrations, envelope encryption patterns, key hierarchies, rotation, revocation, backup/restore, and access controls.
• Design and deliver applied cryptography solutions for data-at-rest, in-transit, and in-use use cases, balancing security, reliability, latency, and cost.
• Establish and operate cryptographic key lifecycle controls encompassing key generation, storage, distribution, usage restrictions, rotation schedules, decommissioning/destruction, and audit logging/monitoring.
• Partner with engineering teams to embed cryptography safely via reusable libraries and software development kits, secure configuration baselines, and migration plans away from legacy algorithms or unsafe implementations.
• Own certificate and identity-related cryptography, including public key infrastructure and transport layer security guidance, certificate issuance/rotation automation, and mutual transport layer security patterns, while driving reductions in certificate and key operational risk.
• Drive algorithm agility and post-quantum readiness by maintaining an inventory of cryptographic usage, defining upgrade paths, running proof-of-concepts, and planning staged migrations.
• Advise stakeholders and senior business leaders during vulnerability periods, including risk assessment, compensating controls, prioritization, and clear decision options and tradeoffs.
• Build shift-left security into the software development lifecycle and toolchain through threat modeling, secure design reviews, static and dynamic analysis, secret scanning, cryptographic misuse checks, and policy-as-code where applicable.
• Lead security testing and assurance for cryptographic and key systems, including design reviews, attack simulations, penetration test coordination, validation of controls, and remediation ownership.
• Improve engineering practices across the team through mentoring, code review standards, documentation and runbooks, operational readiness reviews, and incident learning.

Skills

Security architecture

Applied cryptography

Key management

Java programming

Threat modeling

Vulnerability assessments

Security testing

Communication with stakeholders

Tools

HSM platforms

PKI & TLS

Envelope encryption

Job description

JPMorganChase is seeking a Senior Lead Security Engineer to own cryptography and key management strategy across platforms. You will lead design, development, and operation of HSM integrations, envelope encryption, PKI, TLS, and risk-based controls in a fast-moving financial environment.

You will mentor teams, drive post-quantum readiness, and enable secure-by-default architectures while advising senior leaders during vulnerability periods and risk assessments.