Data Security and Encryption Engineer

Description

The company designs identity management and data protection systems for banks, governments and mobile services. More than 30,000 organisations use its products to verify identities, control access, analyse data and encrypt information. The company has 80,000 employees in 68 countries.

The Czech team has over 400 staff from 45 nationalities, working across 15 teams on government, banking, mobile and IoT projects. Its software is configured and embedded in payment cards, SIM cards, travel passes, authentication tokens and secure ID documents such as ePassports, eIDs, eHealth cards and eDriving licences. English is the official corporate language.

You will join as an encryption, key management and HSM engineer, designing, building, integrating and supporting security solutions that cover encryption, key management, databases and network infrastructure. The role needs hands-on cryptography skills and the ability to solve complex integration problems across applications, databases, HSMs and networks.

Responsibilities

• Design, implement, integrate and support enterprise encryption and key management solutions.
• Troubleshoot complex integrations across applications, databases, HSMs and networks.
• Give technical guidance on cryptographic key lifecycle management and security best practice.

Requirements

• 5+ years in cybersecurity, infrastructure security, cryptography, key management or related fields.
• Relevant security certifications, such as CISSP, CCSP or Security+, or vendor HSM or KMS certifications.
• Experience in customer-facing consulting, implementation or technical support.
• Willingness to obtain EU security clearance, with the company's help.
• Strong grasp of encryption concepts and cryptographic fundamentals.
• Hands-on work with symmetric and asymmetric encryption.
• Understanding of digital signatures, certificates and PKI.
• Understanding of encryption at rest and in transit, plus TLS/SSL and certificate lifecycle management.
• Strong understanding of key lifecycle management: generation, rotation, storage, backup and recovery, archival and destruction.
• Experience with key management systems.
• Understanding of key hierarchies, key wrapping and separation of duties.
• Good grasp of TCP/IP, DNS, routing, firewalls and load balancers.
• Experience troubleshooting connectivity between applications, databases, KMS and HSM infrastructure.
• Understanding of TLS, ports, certificates and network-level troubleshooting.
• Able to use ping, telnet, nc, curl, openssl, tcpdump or Wireshark.
• Strong troubleshooting across Linux, networking, databases and security infrastructure, with good Linux/Unix administration and basic Windows Server administration.
• Strong troubleshooting and log analysis skills.
• Able to analyse issues across the application, network, database, KMS and HSM layers.
• Experience with AWS KMS, Azure Key Vault, OCI or Google Cloud KMS.
• Nice-to-have: experience with the company's network HSM products.
• Nice-to-have: experience with the company's data security platform.
• Nice-to-have: knowledge of PKCS11, JCE, OpenSSL and CNG/CAPI.
• Highly desirable: knowledge of KMIP.
• Nice-to-have: experience with KMIP implementations.
• Nice-to-have: experience with Oracle TDE or SQL Server TDE.
• Nice-to-have: knowledge of cloud and hybrid-cloud encryption architectures.
• Nice-to-have: experience with PKI, certificate authorities and certificate lifecycle automation.
• Nice-to-have: experience working with enterprise customers and supporting production environments.

Conditions

Travel 50% of the time.

Benefits

• A mobility policy that lets thousands of employees each year move between roles at home or abroad, either within their field or into new ones.