Technical Consultant - Data & Quantum Security

International Business Machines Corporation; Nevada; Remote; USD 150,000 - 210,000; Full time

Job summary

IBM is seeking a seasoned Data Security Architect to lead enterprise-grade data protection strategies and cryptographic transformations. You will shape the cryptographic posture across on-prem, cloud, and hybrid environments, guiding DLP, tokenization, and data masking at enterprise scale.

You will operate as a senior individual contributor, partnering with compliance, engineering, and executive stakeholders to prioritize cryptographic modernization and PQC readiness in a post-quantum world.

Qualifications

• Minimum 10+ years in information security with 5+ years in architecture or cryptography-focused roles.
• Deep understanding of symmetric/asymmetric cryptography, PKI, TLS, and certificate standards.
• Experience designing PKI infrastructure, CA hierarchies, HSM integration, and policy governance.
• Proven ability to define data protection frameworks and drive PQC readiness across large environments.

Responsibilities

• Own enterprise Data Protection Architecture across data at rest, in transit, and in use.
• Lead PQC readiness, CBOM discovery, and cryptographic transformation roadmaps.
• Develop data classification, DLP, tokenization, and data masking strategies at scale.
• Collaborate with stakeholders to evaluate threats and drive modernization programs.

Skills

Cryptography

PKI & HSM

KMS architecture

CBOM tooling

Post-Quantum

Cloud security

Threat modeling

Compliance frameworks

Data protection

Executive communication

Tools

Venafi

Keyfactor

AppViewX

DigiCert

Job description

Introduction

A career in IBM Consulting is built on long-term client relationships and close collaboration worldwide. You'll work with leading companies across industries, helping them shape their hybrid cloud and AI journeys. Work at the forefront of cryptographic modernization — one of the most critical and fast-moving areas in enterprise security. Opportunity to define the organization's quantum-safe security posture before the threat window closes. Collaborative culture with elite engineers, privacy counsel, and compliance professionals. Competitive compensation, flexible work model, and investment in your professional development.

Your role and responsibilities

We are seeking a seasoned Data Security Architect to lead the design, strategy, and implementation of enterprise-grade data protection solutions. This is a senior individual-contributor and advisory role responsible for shaping the cryptographic and data security posture of the organization — from classical PKI and key management to quantum-safe cryptographic transformation at scale.

You will work across engineering, compliance, and executive stakeholders to define frameworks, evaluate emerging threats, and drive data security modernization programs that protect our most sensitive assets — today and in a post-quantum world.

Key Responsibilities

Data Protection Strategy & Frameworks

• Design and own the enterprise Data Protection Architecture — covering data at rest, in transit, and in use across on-premises, cloud, and hybrid environments.

• Develop and maintain a Data Security Reference Architecture aligned with industry frameworks (NIST CSF, NIST SP 800-53, ISO 27001, DPDPA, GDPR, CCPA, PCI-DSS).

• Define data classification policies, protection controls, and governance standards across structured, unstructured, and streaming data.

• Architect Data Loss Prevention (DLP), tokenization, format-preserving encryption (FPE), and data masking solutions at enterprise scale.

• Develop capabilities to implement security for enterprise data security solutions e.g. Microsoft Purview, Varonis, Palo Alto, Cyera etc.

• Lead data security risk assessments, threat modeling exercises, and control gap analyses.

Quantum-Safe Discovery & Cryptographic Transformation

• Lead the organization's Post-Quantum Cryptography (PQC) readiness program — from cryptographic inventory to full migration.

• Conduct Cryptographic Bill of Materials (CBOM) discovery across applications, APIs, data stores, and infrastructure to identify quantum-vulnerable assets.

• Collaborate with application owners and platform teams to prioritize and execute cryptographic transformation roadmaps.

This role can be performed from anywhere in the US.

Required technical and professional expertise

• 10+ years of experience in information security, with 5+ years in a security architecture or cryptography-focused role.

• Deep expertise in cryptographic principles — symmetric/asymmetric algorithms, key derivation, digital signatures, certificate standards (X.509), and protocol-level security (TLS 1.3, SSH, IPsec).

• Hands-on experience designing and implementing PKI infrastructure, including CA hierarchies, HSM integration, and certificate policy governance.

• Demonstrated experience with KMS architecture across cloud and on-premises environments, including HSM-backed key material management.

• Practical experience with CLM platforms (Venafi, Keyfactor, AppViewX, DigiCert, or equivalent) and certificate automation at scale.

• Working knowledge of Post-Quantum Cryptography landscape, NIST PQC standardization process, and CBOM tooling.

• Proficiency with DLP, tokenization, data masking, and encryption technologies in enterprise environments.

• Experience architecting across major cloud platforms (AWS, Azure, GCP) with cloud-native security services.

• Strong knowledge of relevant compliance frameworks: NIST SP 800-57, PCI-DSS, GDPR, HIPAA, FedRAMP, SOC 2.

• Excellent communication skills — ability to translate complex cryptographic concepts to executive, technical, and compliance audiences.

Preferred technical and professional experience

• Experience with quantum-safe migration tooling (IBM Quantum Safe, KeyFactor, Entrust, Palo ALto, Thales or equivalent).

• Familiarity with CBOM/SBOM tooling and cryptographic asset discovery platforms.

• Background in zero-trust architecture with strong identity and workload certificate integration.

• Contributions to or engagement with NIST, ETSI, IETF, or Cloud Security Alliance (CSA) working groups.

• Experience in regulated industries (Financial Services, Healthcare, Defense, Government).

• Familiarity with FIPS 140-2/3 validation processes and cryptographic module evaluation.

IBM is committed to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender, gender identity or expression, sexual orientation, national origin, caste, genetics, pregnancy, disability, neurodivergence, age, veteran status, or other characteristics. IBM is also committed to compliance with all fair employment practices regarding citizenship and immigration status.