Cryptographic Key Management Operations Engineer

State Street is seeking a Cryptographic Key Management Operations Engineer to support the end-to-end lifecycle management of cryptographic keys across cloud, on-premises, infrastructure, and IoT environments. You will ensure the secure generation, distribution, rotation, revocation, and retirement of encryption keys while maintaining compliance with regulatory requirements, industry standards, and enterprise security policies. You'll work closely with cybersecurity, cloud, infrastructure, and application teams to maintain the availability, reliability, and security of enterprise key management services that support critical financial systems.

What you'll do

• Support the day-to-day operation and security of enterprise cryptographic key management services, ensuring compliance with financial industry regulations and standards including PCI DSS, GDPR, FIPS 140-3, and NIST guidance.
• Manage the complete cryptographic key lifecycle, including secure key generation, storage, distribution, rotation, revocation, escrow, and retirement across cloud, on-premises, and IoT environments.
• Monitor, investigate, and respond to key management incidents, including key compromise, expiration, policy violations, and operational failures, ensuring timely remediation and risk mitigation.
• Maintain the availability, integrity, and security of key management infrastructure, troubleshooting issues and ensuring adherence to service level objectives.
• Partner with cybersecurity, cloud, infrastructure, engineering, and DevSecOps teams to integrate cryptographic services into enterprise applications, platforms, and security frameworks.
• Automate and optimize key management processes using APIs, Key Management Systems (KMS), infrastructure-as-code (IaC), and security orchestration technologies.
• Support secure transaction processing and data protection by ensuring highly available and resilient key management services.
• Develop and maintain operational procedures, standards, runbooks, and technical documentation related to key management services.
• Produce operational, compliance, and risk reporting related to key usage, lifecycle events, service performance, and audit requirements.
• Stay current with emerging cryptographic technologies, evolving threat landscapes, post-quantum cryptography developments, and regulatory requirements to continuously improve key management practices.

What you bring

• A Bachelor's degree in Computer Science, Cybersecurity, Information Security, Engineering, or a related field; equivalent practical experience will also be considered.
• 3+ years of experience supporting cryptographic operations, key management platforms, information security, or cybersecurity services within a financial services organization or other regulated industry.
• Strong understanding of cryptographic key lifecycle management, including symmetric and asymmetric encryption, Public Key Infrastructure (PKI), certificate management, and Hardware Security Modules (HSMs).
• Hands-on experience with enterprise key management solutions such as AWS KMS, Azure Key Vault, OCI Vault, and Fortanix DSM.
• Knowledge of security and compliance standards including PCI DSS, FIPS 140-3, NIST, ISO 27001, and related regulatory requirements.
• Strong analytical and problem-solving skills with the ability to troubleshoot complex cryptographic and infrastructure-related issues.
• A proactive approach to operational excellence, automation, and continuous service improvement.
• The ability to work effectively across multiple teams and disciplines in a highly regulated and security-focused environment.
• Strong communication skills, with the ability to translate technical concepts into clear operational and business outcomes.
• A risk-focused mindset with a commitment to maintaining the confidentiality, integrity, and availability of sensitive data and cryptographic assets.
• Attention to detail and a commitment to maintaining high standards of security, governance, and operational discipline.

Nice to have

• Experience supporting cloud-native security services and enterprise encryption implementations.
• Familiarity with IoT security, embedded cryptography, and device identity management.
• Experience leveraging SIEM and monitoring platforms to support security operations and key access monitoring.
• Experience with automation and scripting technologies such as Python, PowerShell, Terraform, or similar tools.
• Familiarity with Agile delivery methodologies and collaboration tools such as Jira and Confluence.
• Security certifications such as CISSP, CISM, CCSP, AWS Security Specialty, or equivalent certifications.
• Exposure to post-quantum cryptography (PQC), cryptographic agility programs, and emerging cryptographic frameworks.

About State Street

State Street is a global financial services company that helps institutional investors manage risk and drive performance. The company is committed to fostering an inclusive environment where employees feel valued and empowered, offering inclusive development opportunities, flexible work-life support, paid volunteer days, and vibrant employee networks.