Sr System Security Engineer – PKI, Certificate & Key Management

Location: Central Singapore

Employment Type: 12-Month Contract, Renewable

Seniority: Mid-Level / Senior

Job Summary

We are looking for an experienced System Security Engineer with strong hands-on expertise in the design and implementation of enterprise PKI, Certificate Lifecycle Management (CLM), Key Management and HSM security solutions .

This is a specialist cryptography/security engineering position and is not a general SOC, vulnerability management or cybersecurity operations role .

Key Responsibilities

• Design, implement and operationalise enterprise PKI, Certificate Lifecycle Management and Key Management solutions.
• Design and manage CA hierarchies , including Root and Subordinate CAs.
• Implement certificate lifecycle processes covering discovery, issuance, enrolment, renewal, revocation and expiry management .
• Design and integrate CLM platforms such as CyberArk Venafi, Keyfactor, Entrust or equivalent with enterprise Certificate Authorities.
• Design, deploy and integrate HSM and enterprise Key Management solutions such as Entrust nShield, Thales CipherTrust/Luna HSM or equivalent .
• Support HSM operations including key generation, rotation, key ceremonies and secure key protection .
• Integrate certificate and key-management platforms with enterprise applications and security systems using REST APIs and automation .
• Design and support cloud cryptographic solutions using AWS KMS, ACM, Secrets Manager and CloudHSM .
• Support cryptographic asset discovery and maintain certificate/key inventories or Cryptographic Bill of Materials (CBOM) .
• Apply cryptographic standards and best practices including X.509, PKCS, FIPS and NIST .
• Support cryptographic modernization and Post-Quantum Cryptography (PQC)/crypto-agility initiatives.
• Work closely with security architects, application owners, infrastructure teams and technology vendors throughout solution design and implementation.
• Troubleshoot complex PKI, certificate, HSM and key-management issues.

Requirements

• Degree in Computer Science, Information Technology, Cybersecurity or related discipline.
• Minimum 5 years of IT/security experience , including at least 2 years of hands-on PKI, Certificate Management, HSM or Enterprise Key Management experience .
• Strong experience designing and implementing , rather than only supporting, enterprise certificate and key-management solutions.
• Strong knowledge of X.509, TLS/mTLS, CA hierarchy, certificate issuance/renewal/revocation and PKI architecture .
• Hands-on experience with CyberArk Venafi / Keyfactor / Entrust / AppViewX or similar CLM platforms .
• Hands-on experience with Entrust nShield / Thales CipherTrust / Thales Luna / AWS CloudHSM or similar HSM/KMS technologies .
• Knowledge of AWS KMS, ACM, Secrets Manager and CloudHSM is highly desirable.
• Experience with Python, PowerShell, Bash and/or REST APIs for automation is advantageous.
• Knowledge of FIPS, NIST, PKCS, crypto-agility and PQC is advantageous.
• Strong stakeholder and vendor management skills.
• Experience within banking, financial services or other highly regulated enterprise environments is preferred.

Interested candidates are kindly requested to email their CV with their experience to sandeep.sringeripai@global.ntt

We look forward to your application!