Key Responsibilities:
- Understand system architecture and data flows, and identify where encryption, signing, authentication, and key management are needed.
- Design and implement cryptographic solutions: encryption, digital signatures, hashing, key derivation, secure key storage, and secure transport.
- Build and maintain Java SDKs and libraries with clean APIs, versioning, documentation, and backward compatibility.
- Implement and troubleshoot PKI components: X.509 certificates, chain validation, CSRs, CRL/OCSP, and TLS/mTLS configuration.
- Integrate with HSMs and key management systems (PKCS#11), and design key lifecycle processes: generation, rotation, backup, and destruction.
- Take part in threat modelling and design reviews, and recommend algorithms, key sizes, and parameters with clear reasoning.
- Remediate findings from code reviews, static and dynamic analysis, penetration tests, and audits.
- Write unit, integration, and negative tests, including known-answer tests with standard test vectors.
- Support teams that integrate the SDK, and produce technical documentation and compliance evidence.
- Follow developments in post-quantum cryptography (ML-KEM, ML-DSA, hybrid key exchange or Newer PQC algorithm) and help assess their impact on our systems.
Required Skills
Cryptography (must be able to explain the reasoning, not only the usage)
- Symmetric encryption (AES; GCM, CBC, CTR modes) and the consequences of nonce/IV misuse.
- Asymmetric cryptography: RSA (OAEP, PSS), ECC (ECDSA, ECDH, Ed25519, X25519).
- Hashing, HMAC, key derivation (HKDF, PBKDF2), and secure random generation.
- Authenticated encryption and key management principles. PKI and protocols
- X.509, certificate lifecycle, trust chain validation.
- TLS 1.2/1.3 and mTLS: handshake, cipher suites, session resumption.
- JWT/JWS/JWE, OAuth2, and signature formats such as CMS/PKCS#7. Development
- Strong Java (Java 8 or later): collections, concurrency, exception handling, JVM basics.
- Hands-on experience with JCA/JCE and Bouncy Castle. Use of vetted libraries only, no custom algorithms.
- Experience building reusable libraries or SDKs with Maven or Gradle.
- Git, CI/CD, JUnit, and Mockito. Security engineering
- Secure coding practices (OWASP Top 10): constant-time comparison, safe error handling, no secrets in logs.
- Understanding of threat modelling and trust boundaries.
Education:
B.E./B.Tech/MCA or equivalent in Computer Science, IT, Electronics, or a related field. Good to Have
- Android development: Android Keystore, secure storage, AAR packaging.
- HSM experience (PKCS#11) and key management systems.
- Experience in payments, banking, or fintech security (PCI DSS, RBI guidelines, ISO 27001).
- Knowledge of TLS stacks and gateways (OpenSSL, Tomcat, Bouncy Castle JSSE).
- Familiarity with SAST/DAST tools, Kotlin, Spring Boot, or Docker.
- Security certifications or open-source contributions.
