Lead certificate lifecycle automation efforts, reducing manual issuance, renewal, and revocation processes across the enterprise.
Ensure PKI operations and certificate issuance practices remain compliant with CA/Browser Forum baseline requirements and applicable industry standards.
Evaluate, plan, and support the organization's transition to post-quantum cryptography (PQC), including algorithm agility and migration roadmaps.
Develop and maintain cryptographic policies, standards, certificate practice statements, and operational runbooks. Set standards for envelope encryption, tokenization, field-level encryption, and data-at-rest and in-transit protection.
Build and maintain a cryptographic bill of materials (CBOM) covering algorithms, libraries, and dependencies across the estate.
Partner with Security Engineering, Infrastructure, and Compliance teams to support audits, risk assessments, and incident response involving cryptographic assets.
Mentor junior engineers and contribute to the Data Protection team's technical roadmap.
Required Education & Experience (Knowledge, Skills, & Abilities)
7+ years of experience in information security, with a focus on public key infrastructure and cryptographic systems.
Demonstrated ownership of a production PKI, including CA hierarchy design and HSM operations (Thales, Entrust nShield, AWS CloudHSM, or equivalent).
Hands-on experience with Venafi, Cyberark, DigiCert, Microsoft ADCS or other Cryptographic related tooling in a production enterprise environment.
Working knowledge of HSMs, certificate lifecycle automation tooling, and CA/Browser Forum compliance requirements.
Practical automation skills in Python, Go, or a comparable language, and comfort working with APIs, infrastructure as code, and CI/CD systems.
Familiarity with post-quantum cryptography concepts and emerging NIST standards.
Strong understanding of cryptographic protocols (TLS, S/MIME, code signing) and key management best practices.
Experience operating cryptographic services in a major cloud environment (AWS, Azure, or GCP) at scale.
Excellent written and verbal communication skills, with the ability to advise technical and non-technical stakeholders.
Preferred Education & Experience (Knowledge, Skills, & Abilities)
Associates, Bachelors, or advanced degree in IT Security or related field
Experience in financial services or another highly regulated industry
Security certifications such as Security+, GIAC, or CISSP
Familiarity with building dashboards or metrics reporting for security programs
SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
Disclaimer
State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.
