Senior Applied Cryptography Engineer

As a Senior Applied Cryptography Engineer at Threema, you will help design, build and scrutinize the cryptographic protocols behind our secure messenger, contributing to the effective privacy protection of millions of users worldwide. Threema is the world's best-selling secure messenger for both private users and businesses, with a growing user base that includes millions of private customers and thousands of businesses and organizations globally.

What you'll do

• Develop and specify cryptographic communication protocols
• Design cryptographic systems such as key management and multi-device synchronization
• Lead Threema's migration to quantum-safe cryptography, working together with cryptography researchers at IBM Research
• Own threat modeling for new product features and protocol designs in close collaboration with the product and engineering teams
• Analyze protocols, algorithms and implementations for security weaknesses and assess what new attack vectors mean for our products
• Assess vulnerability reports from our bug bounty partner and coordinate fixes with the engineering teams
• Follow current developments in applied cryptography and turn relevant findings into concrete product improvements
• Maintain contacts with the security research community and represent Threema at conferences if you enjoy it

What you bring

• A degree in computer science, mathematics or information security (ideally with a focus on cryptography) or equivalent practical experience
• A solid understanding of modern cryptographic primitives such as AEAD, key exchange, KDFs and digital signatures, and knowledge of how they fail when combined incorrectly
• Working knowledge of key encapsulation mechanisms and post-quantum cryptography, including hybrid constructions such as X25519MLKEM768
• Experience designing or reviewing security protocols, ideally in end-to-end encryption, key agreement or multi-device settings
• The ability to write code yourself in at least one of Rust, Kotlin, Swift, TypeScript or something comparable
• Experience reviewing implementations for side channels, nonce reuse, misuse-prone APIs and similar problems
• Familiarity with current frontier AI models and the ability to use them as a productivity multiplier in design work and coding, for example to review specification drafts, survey recent literature, or identify weaknesses in a protocol design
• A strong sense of responsibility and a precise way of working
• The ability to write a protocol specification that someone else can implement and explain cryptographic trade-offs to people who are not cryptographers
• Pragmatic judgment about when a design is good enough to ship and when it is not
• Willingness to have your own designs scrutinized and to scrutinize other people's work with care
• Good written and spoken English (at least B2 level)

Nice to have

• Practical experience with hybrid post-quantum handshakes
• Experience with formal protocol verification
• Published research or CVEs
• Experience with coordinated vulnerability disclosure
• German language skills

What we offer

• A young, motivated team with straightforward communication
• Flexible working hours with the option to work from home up to two days per week
• The option to work from anywhere for two weeks per year
• The option to take unpaid leave
• Your choice of hardware (macOS or Linux)
• A public transportation discount or parking space with electric car charging available
• Free use of the fitness room, including a fitness trainer once a month
• Professional massage once a month
• Internal German or English courses
• Regular company events and aperitifs
• The satisfaction of contributing to the effective protection of the privacy of millions of people

Place of work: Pfäffikon SZ (Greater Zurich Area)

Start date: Immediately or by agreement

About Threema

Threema is the world's best-selling secure messenger, serving millions of private users and thousands of businesses and organizations globally since 2012. The company is committed to ensuring that users can communicate freely without worrying about their privacy.