Staff Engineer, Security: Encryption & Tokenization

Government Employees Insurance Company; Bethesda (MD); On-site; USD 110,000 - 230,000; Full time

Job summary

GEICO is seeking a Staff Engineer – Platform Security Engineering specializing in Encryption and Tokenization to design, implement, and maintain a robust data-protection platform. You will lead the creation of secure components, collaborate with multiple teams to meet regulatory requirements, and drive architectural decisions for scalable cryptographic solutions.

The role emphasizes security-first engineering, reliable production services, and mentorship across the team, with opportunities to

Qualifications

• Strong understanding of cryptographic encryption, tokenization, and Key Management Systems (KMS).
• Experience designing secure, scalable data protection solutions using open-source cryptography libraries and protocols (e.g., FPE, AEAD).
• Strong software engineering skills, with experience building production grade services (Go preferred).
• Working knowledge of key management technologies and libraries, such as Google Tink, PKCS#11, JCE, and OpenSSL.
• Experience operating stateful systems such as PostgreSQL, including replication and reliability considerations.
• Proven problem-solving skills with a security first mindset and proactive approach to risk mitigation.
• Experience applying site reliability engineering (SRE) practices, including monitoring, alerting, and incident response (Grafana, Prometheus, Open Telemetry, eBPF).
• Experience building and maintaining CI/CD pipelines and infrastructure as code (e.g., Bazel, Terraform, Argo CD/Workflows/Rollouts).
• Strong communication skills, with the ability to explain technical concepts clearly to engineers and partner teams.
• Familiarity with hardware security modules (HSMs) and cryptography standards.
• Experience: 6+ years of experience in security or software engineering with a focus on encryption, tokenization, key management, or cryptography.

Responsibilities

• Lead the design, development, and evolution of encryption, tokenization, and key management solutions within a defined platform or product domain.
• Drive hands-on implementation of secure data protection capabilities, contributing directly to production-ready systems while setting technical direction for the team.
• Ensure the quality, reliability, and operational excellence of encryption and tokenization services, including high availability, disaster recovery, observability, and auditable logging.
• Partner closely with compliance, security, data governance, and application teams to ensure cryptographic solutions align with company policies and regulatory requirements.
• Contribute to architectural decisions by proposing scalable, resilient designs for key management systems and data protection workflows.
• Apply knowledge of modern cryptography trends and standards to improve platform security and inform technical decisions.
• Provide technical mentorship and guidance to engineers on the team, helping raise the bar on secure coding, design quality, and operational practices.
• Collaborate with product and engineering stakeholders to integrate encryption and tokenization solutions that support business and platform goals.
• Identify opportunities to improve performance, cost efficiency, and developer experience within the encryption and key management ecosystem.

Skills

cryptographic encryption

tokenization

Key Management Systems

Go

PostgreSQL

SRE practices

CI/CD pipelines

infrastructure as code

communication skills

cryptography standards

HSMs

cloud environments (AWS, GCP, Azure)

Education

Bachelor’s degree in computer science or equivalent

Tools

Google Tink

PKCS#11

JCE

OpenSSL

Bazel

Terraform

Argo CD/Workflows/Rollouts

Grafana

Prometheus

Open Telemetry

eBPF

Job description

GEICO is seeking a Staff Engineer – Platform Security Engineering specializing in Encryption and Tokenization to design, implement, and maintain a robust data-protection platform. You will lead the creation of secure components, collaborate with multiple teams to meet regulatory requirements, and drive architectural decisions for scalable cryptographic solutions.

The role emphasizes security-first engineering, reliable production services, and mentorship across the team, with opportunities to