Lead Security & Cryptography Engineer

As the Lead Security and Cryptography Engineer at Aadhcode Solutions PVT, you own the cryptographic design of a transaction-authorization platform for banks, payment providers and government agencies. From day one, you take the platform through a bank pilot and an independent third-party security review.

What you'll do

• Own the cryptographic architecture: signing, key hierarchy, algorithm choices and the decision records behind them
• Design and implement key management on AWS CloudHSM (PKCS#11), including key ceremonies, rotation, backup and disaster recovery
• Build signed approval receipts (JWS/COSE) and an offline verifier that auditors can run without your systems
• Verify device attestation on the server: Apple App Attest, Android Key Attestation/StrongBox and Play Integrity, plus FIDO2/WebAuthn for desktop
• Design the tamper-evident audit ledger with the backend team
• Set the post-quantum strategy (ML-DSA/Dilithium readiness) and the ability to swap algorithms without breaking stored records
• Lead threat modelling and the security gates in the pipeline (SAST/DAST/SBOM), and act as the main contact for the external security review
• Turn compliance requirements into concrete technical controls with your compliance engineer: PSD2 strong customer authentication, PCI DSS, SOC 2 and FedRAMP readiness
• Mentor backend engineers moving from Java to Go on secure coding practices

What you bring

• 8+ years in security engineering, with at least 3 years designing production cryptographic systems (implementing protocols counts; calling libraries alone does not)
• Hands-on HSM experience with CloudHSM, Thales/Luna or similar, including PKCS#11 and real key ceremonies
• Deep working knowledge of ECDSA/EdDSA, JWS/COSE, X.509 and certificate chains, hashing and Merkle structures, and constant-time implementation concerns
• Experience with mobile secure hardware (Secure Enclave, StrongBox) and attestation flows
• Strong Go programming skills
• Experience taking systems through external penetration tests or security reviews in fintech, banking or government

Nice to have

• Post-quantum migration work (ML-DSA, hybrid signatures)
• PSD2 dynamic linking, FFIEC or PCI DSS experience
• Standards contributions (IETF, FIDO Alliance, W3C) or open-source cryptography work
• Rust programming experience