The ideal candidate must have strong hands-on experience with HSM platforms and a proven background in cryptographic architecture, secure key lifecycle management, and enterprise security integration.

## Key Responsibilities

- Design and implement secure HSM architectures for enterprise and cloud environments.
- Architect cryptographic key management solutions, including key generation, storage, rotation, backup, recovery, and destruction.
- Deploy, configure, and integrate HSM platforms with enterprise applications and security infrastructure.
- Design and review PKI architectures, certificate authorities, digital certificates, and certificate lifecycle management.
- Implement encryption, digital signatures, key wrapping, and cryptographic operations using HSMs.
- Integrate HSM solutions with cloud platforms, applications, databases, and identity management systems.
- Assess existing HSM configurations, security controls, access policies, and cryptographic practices.
- Design high-availability, disaster recovery, and secure backup strategies for HSM infrastructure.
- Establish role-based access controls, separation of duties, dual control, and secure administrative procedures.
- Develop architecture diagrams, technical standards, security assessment reports, and implementation recommendations.
- Collaborate with application, infrastructure, cloud, and security engineering teams.

Mandatory Qualifications

- 8+ years of cybersecurity or security engineering experience.
- *Minimum 3+ years of hands-on HSM implementation or architecture experience.*
- Proven experience designing or implementing enterprise HSM solutions.
- Strong knowledge of cryptographic key lifecycle management and PKI.
- Experience integrating HSMs with enterprise or cloud applications.
- Ability to independently assess security architecture and recommend improvements.
- Strong technical documentation and stakeholder communication skills.

## Preferred Qualifications

- Experience with HSM migration, firmware upgrades, clustering, and disaster recovery.
- Multi-cloud cryptographic architecture experience.
- Knowledge of secrets management platforms such as HashiCorp Vault.
- CISSP, CCSP, or relevant cloud security certifications.
- Vendor-specific HSM training or certifications.

## Expected Deliverables

1. HSM security architecture and design documentation.
2. Cryptographic key management and PKI architecture review.
3. HSM configuration and security control assessment.
4. Identified security gaps and remediation recommendations.
5. High-availability, disaster recovery, and key recovery design.
6. Final architecture recommendations and stakeholder walkthrough.