We are seeking an experienced *HSM Security Architect* to design, implement, assess, and secure enterprise cryptographic infrastructure, including Hardware Security Modules (HSMs), Public Key Infrastructure (PKI), encryption services, and enterprise key management solutions.
The ideal candidate must have strong hands-on experience with HSM platforms and a proven background in cryptographic architecture, secure key lifecycle management, and enterprise security integration.
## Key Responsibilities
- Design and implement secure HSM architectures for enterprise and cloud environments.
- Architect cryptographic key management solutions, including key generation, storage, rotation, backup, recovery, and destruction.
- Deploy, configure, and integrate HSM platforms with enterprise applications and security infrastructure.
- Design and review PKI architectures, certificate authorities, digital certificates, and certificate lifecycle management.
- Implement encryption, digital signatures, key wrapping, and cryptographic operations using HSMs.
- Integrate HSM solutions with cloud platforms, applications, databases, and identity management systems.
- Assess existing HSM configurations, security controls, access policies, and cryptographic practices.
- Design high-availability, disaster recovery, and secure backup strategies for HSM infrastructure.
- Establish role-based access controls, separation of duties, dual control, and secure administrative procedures.
- Develop architecture diagrams, technical standards, security assessment reports, and implementation recommendations.
- Collaborate with application, infrastructure, cloud, and security engineering teams.
## Required Technical Skills
*HSM Platforms*
- Hands-on experience with one or more HSM technologies:
- Thales Luna HSM / payShield
- Entrust nShield
- AWS CloudHSM
- Azure Managed HSM
- Google Cloud HSM
*Cryptography & Key Management*
- AES, RSA, ECC, SHA-2/SHA-3, and digital signatures.
- Key generation, rotation, wrapping, backup, recovery, and destruction.
- PKCS#11, Java Cryptography Extension (JCE), Microsoft CNG, and HSM integration APIs.
- Enterprise Key Management Systems (KMS).
*PKI & Certificate Security*
- Certificate Authority (CA) architecture.
- X.509 certificates, TLS/mTLS, certificate enrollment, renewal, and revocation.
- Integration with enterprise PKI and certificate management solutions.
*Security Architecture & Compliance*
- FIPS 140-2 / 140-3.
- NIST cryptographic standards and key management guidelines.
- PCI DSS and relevant cryptographic security controls.
- Secure architecture reviews, threat modeling, and risk assessments.
## Mandatory Qualifications
- 8+ years of cybersecurity or security engineering experience.
- *Minimum 3+ years of hands-on HSM implementation or architecture experience.*
- Proven experience designing or implementing enterprise HSM solutions.
- Strong knowledge of cryptographic key lifecycle management and PKI.
- Experience integrating HSMs with enterprise or cloud applications.
- Ability to independently assess security architecture and recommend improvements.
- Strong technical documentation and stakeholder communication skills.
## Preferred Qualifications
- Experience with HSM migration, firmware upgrades, clustering, and disaster recovery.
- Multi-cloud cryptographic architecture experience.
- Knowledge of secrets management platforms such as HashiCorp Vault.
- CISSP, CCSP, or relevant cloud security certifications.
- Vendor-specific HSM training or certifications.
## Expected Deliverables
1. HSM security architecture and design documentation.
2. Cryptographic key management and PKI architecture review.
3. HSM configuration and security control assessment.
4. Identified security gaps and remediation recommendations.
5. High-availability, disaster recovery, and key recovery design.
6. Final architecture recommendations and stakeholder walkthrough.
## How to Apply
Interested candidates should share their updated resume, HSM platforms worked on, relevant implementation or architecture projects, availability, and expected hourly rate.
*Important:* Hands-on HSM architecture or implementation experience is mandatory. General cybersecurity architecture experience without direct HSM expertise is not sufficient.
