Lead HSM / Cryptography Architect

Job Title: Lead HSM / Cryptography Architect

Location: Remote

Duration: 2 Months

Position Overview:

Lead HSM / Cryptography Architect for a two-month remote engagement supporting our customer. This role carries overall technical ownership of an enterprise-wide HSM assessment — spanning discovery and inventory, physical health assessment, credential and access validation, key/card material management, monitoring, and final documentation. The Lead directs the engagement’s technical approach, produces the client-facing deliverables, and works alongside a Payment HSM Specialist who executes hands-on tasks against the same scope of work.

Key Responsibilities

Discovery, Inventory & Architecture

• Own the methodology and quality of the complete HSM inventory — model, serial number, firmware version, location, network information, partition configuration, and operational status.
• Direct the comprehensive key inventory — key purpose, ownership, algorithm, key length, lifecycle status, and associated Smart Cards or physical cards.
• Oversee the license, enabled-feature, optional-module, and support/maintenance inventory for each HSM.
• Document partition configuration, application ownership, and HSM usage by application or service.
• Physical Inspection & Health Assessment
• Lead the physical inspection and operational-status verification of all HSMs.
• Assess the health and functionality of power supplies, fans, batteries, tamper mechanisms, and other hardware components.
• Review hardware error logs, audit logs, and system events, and own the findings on existing or historical issues.
• Identify failed, degraded, unsupported, or end-of-life hardware components and prioritize remediation.
• Credential & Access Validation
• Direct validation of all Smart Cards, physical cards, PED keys, and authentication devices.
• Validate ACS and OCS cards and confirm expected functionality.
• Own documentation of access procedures and ownership for all administrative and operational credentials.
• Validate the full role and credential model: HSM Security Officer (SO), Audit Officer (AU), Partition Security Officer (PSO), Partition Owner (PO), Crypto Officer (CO), and Crypto User (CU).
• Confirm credential custodians are identified and documented across all roles. 
• Card & Key Material Management
• Direct creation and validation of two complete sets of CTA cards.
• Direct creation and validation of two complete sets of Left and Right Administrator cards.
• Direct creation and validation of two complete sets of LMK cards.
• Oversee creation of two On-Call cards with read-only privileges for operational support personnel.
• Own verification of secure storage, handling procedures, and chain of custody for all cards and authentication materials. 
• Monitoring
• Architect SNMP monitoring and alerting configuration for all HSMs, and validate it end to end.
• Documentation & Knowledge Transfer
• Author and finalize HSM operational procedures and administration runbooks.
• Lead knowledge transfer sessions with designated operations personnel.
• Own the final assessment report — inventory, findings, risks, gaps, recommendations, and remediation actions — and serve as primary technical point of contact for the engagement.

Required Qualifications

• 10+ years of experience in HSM administration, applied cryptography, or cryptographic architecture, including prior lead or architect-level engagements.
• Deep hands-on expertise across enterprise HSM platforms and their key-custodian models (e.g., LMK, CTA, Administrator card schemes, split-knowledge/dual-control principles).
• Demonstrated experience leading enterprise HSM assessments — inventory, physical health assessment, and gap analysis — from scoping through final report.
• Strong command of HSM role-based access models (SO, AU, PSO, PO, CO, CU) and credential custodianship practices.
• Experience authoring operational runbooks and delivering executive-ready assessment reports for enterprise clients.
• Proven ability to direct and quality-check the work of another specialist on a shared scope of work.
• Excellent written and verbal communication skills, with comfort presenting findings directly to client operations and security stakeholders.

Preferred Qualifications

• Direct experience with Thales HSM ecosystems (e.g., payShield) and their LMK/CTA/Administrator card processes.
• Experience configuring SNMP-based monitoring and alerting for HSM fleets.
• Financial services or payments-industry background.
• Relevant certifications (e.g., CISSP, CISM, or vendor-specific HSM certifications).