Senior Product Security Engineer – Cryptography

Jobtailor; Massachusetts; On-site; USD 150,000 - 230,000; Full time

Job summary

Jobtailor is seeking a security engineer to serve as the primary technical owner for auditing Go-based cryptographic implementations in OpenShift and container runtimes such as CRI-O and Podman.

You will identify cryptographic discrepancies, ensure use of host FIPS/PQC providers, and drive the deployment of crypto inventory tools across the portfolio.

Qualifications

• Deep, hands-on experience in Go and Python is required.
• Broad knowledge in applied cryptography (PKI, TLS, digital signatures).
• Strong understanding of modern cryptographic challenges, including PQC.
• Solid grasp of OCI specifications and container runtimes related to cryptographic hardware.

Responsibilities

• Act as the primary technical owner for auditing Go-based cryptographic implementations within OpenShift and container runtimes (CRI‑O, Podman).
• Identify and resolve cryptographic discrepancies where containerized applications fail to leverage host FIPS or PQC providers.
• Own the ongoing implementation and integration of cryptographic inventory tools (e.g. Crypto Scanner).
• Define and implement scanner policies for detecting cryptographic assets in build pipelines with the Principal Product Security Engineer.
• Collaborate with pipeline and data teams to produce a sustainable Cryptographic Bill of Materials (CBOM).
• Work with product teams to integrate Merkle Tree Certificate support within the security fabric.
• Serve as go-to technical consultant for product teams navigating cryptographic migrations (PQC, FIPS).
• Consult with engineers to audit code and plan migrations aligned with policy.
• Create documentation, best-practice guides, and office hours to scale cryptographic expertise.
• Define functional requirements for integration of new cryptographic tools, including runtime instrumentation for core libraries.
• Track cryptographic dependencies across portfolio and coordinate with RHEL Security to resolve blockers.

Skills

Go

Python

Applied Cryptography

PKI

PQC

Container Security

Project Ownership

Collaboration

Problem Solving

SPIFFE/SPIRE

Sigstore/Cosign

Merkle Tree

FIPS

Job description

Responsibilities

• Act as the primary technical owner for auditing Go-based cryptographic implementations within OpenShift and container runtimes (CRI‑O, Podman).
• Identify and resolve cryptographic discrepancies where containerized applications fail to correctly leverage the host's FIPS or PQC providers.
• Act as the primary technical owner responsible for continuing the implementation and integration of Red Hats cryptographic inventory tools (e.g. Crypto Scanner).
• Partner with the Principal Product Security Engineer to define and implement scanner policies for detecting cryptographic assets in our build pipelines.
• Work directly with pipeline and data teams to integrate these tools and produce a sustainable Cryptographic Bill of Materials (CBOM).
• Partner with product teams to integrate Merkle Tree Certificate support within the portfolio’s unified security fabric.
• Serve as the primary go‑to technical consultant for product teams (like OpenShift, Ansible, and Middleware) navigating cryptographic migrations (e.g. PQC, FIPS).
• Consult directly with engineers to help them audit their code, understand their dependencies (e.g. python‑cryptography), and build migration plans that align with the portfolio‑wide policy.
• Enable other teams by creating documentation, best‑practice guides, and office hours to scale your expertise.
• Define the functional requirements for and partner on the integration of new cryptographic tools, such as runtime instrumentation for core libraries.
• Track and manage critical cryptographic dependencies across the portfolio, working with RHEL Security and other teams to resolve blockers and ensure the successful, sequential delivery of modern crypto capabilities.

Requirements

• Multi‑Language Technical Expertise: Deep, hands‑on experience in Go and Python is required.
• Applied Cryptography and PKI: Broad knowledge in applied cryptography (PKI, TLS, digital signatures).
• Strong understanding of modern cryptographic challenges, including Post‑Quantum Cryptography (PQC).
• Container & Cloud‑Native Security: Strong understanding of OCI specifications and how container runtimes interact with cryptographic hardware (HSMs) or kernel‑level providers.
• Project Ownership: Proven experience owning and delivering complex, cross‑team technical projects from design to completion.
• Collaborative Leadership: A track record of building relationships across teams and acting as a recognized go‑to person.
• Problem Solving: Strong analytical skills to diagnose complex dependencies and technical blockers in a large‑scale software portfolio.
• Bonus Skills: Previous experience contributing to or maintaining core cryptographic libraries or security‑focused Go projects.
• Familiarity with SPIFFE/SPIRE or Sigstore/Cosign.
• Experience with Merkle Tree implementations or binary‑level runtime analysis.
• Familiarity with FIPS validation processes in virtualized/containerized environments.