Senior Cryptography Analyst

Aviva•Markham, ON

2d•CA$100,000 - CA$125,000•Hybrid

About The Position

The Senior Cryptography Analyst plays a critical security role responsible for safeguarding Aviva Canada's cryptographic assets, ensuring the secure management of keys, secrets, and certificates, driving Post-Quantum Cryptography readiness, and providing governance and operational oversight of two business-critical 24x7 cryptographic services. This role serves as a trusted advisor on cryptographic strategy, compliance, operational excellence, and future-state cryptographic transformation.

Requirements

Extensive experience with HashiCorp Vault administration and governance.
Strong PKI and TLS certificate lifecycle management experience.
Experience implementing and supporting TLS certificate automation solutions.
Experience performing Post-Quantum Cryptography assessments and readiness planning.
Solid understanding of encryption standards, cryptographic algorithms, and key management practices.
Experience with Hardware Security Modules (Thales Luna preferred).
Knowledge of AWS cloud services and KMS technologies.
Experience integrating cryptographic services into enterprise platforms and applications.
Scripting and automation experience using APIs and CI/CD pipelines.
Experience leading vendors, consultants, or contract resources.
Ability to influence security and technology decisions across multiple teams.
Strong understanding of regulatory, audit, and compliance requirements.
Experience operating critical production services within a 24x7 environment.
Strong incident and problem management experience.

Nice To Haves

Experience in insurance or financial services.
Kubernetes and Cert-Manager experience.
Cloud security and DevSecOps experience.
PQC frameworks, standards, and industry transition planning experience.

Responsibilities

Act as the enterprise SME for cryptography, encryption, PKI, and secrets management.
Advise teams on encryption strategies, cryptographic controls, and approved solutions.
Develop and maintain cryptographic standards, procedures, and guidelines.
Review solution designs and provide guidance on encryption at rest/in transit, key and secrets management, certificates, and algorithms.
Support security architecture reviews and risk assessments.
Own governance and lifecycle management of enterprise encryption keys and secrets.
Oversee key generation, storage, rotation, archival, and destruction.
Manage HashiCorp Vault services and protect privileged secrets and cryptographic assets.
Ensure compliance with industry standards and regulatory requirements.
Define and monitor key management benchmarks and the efficiency of operations.
Provide administration and operational oversight of HashiCorp Vault platforms.
Manage authentication, RBAC, access governance, secrets lifecycle, and tenant onboarding/offboarding.
Support integrations with AWS KMS, HSMs, cloud secret stores, and automation platforms.
Lead efforts to fix issues, incident resolution, and platform modernization initiatives.
Own TLS/SSL certificate governance and lifecycle management.
Oversee certificate issuance, renewal, replacement, revocation, and retirement.
Drive automation using ACME, Sectigo, Vault PKI, Cert-Manager, Kubernetes, and cloud-native services.
Establish certificate standards for CAs, key lengths, algorithms, and ownership.
Reduce manual processes through automation and continuous improvement.
Lead enterprise PQC readiness assessments.
Maintain visibility of cryptographic assets across applications, certificates, keys, and secrets.
Assess PQC risks and develop transition and remediation strategies.
Partner with architecture and engineering teams on migration planning.
Monitor industry and regulatory developments in quantum-resistant cryptography.
Provide operational leadership for TLS Certificate Management and HashiCorp Vault services.
Oversee contractor resources, service delivery, and operational priorities.
Monitor service performance, availability, incidents, and improvement opportunities.
Ensure resilience, availability, and continuous service enhancement.
Function as the main point of contact for major incidents, emergencies, and service outages related to customer concerns.
Participate in after-hours support and incident response.
Lead root cause analysis and remediation of cryptography-related issues.
Support change management, CAB activities, and proactive risk mitigation.
Support enterprise HSM infrastructure, including Thales Luna HSM platforms.
Manage auto-unseal configurations, root key protection, key rotation, and disaster recovery.
Coordinate platform upgrades and lifecycle management.
Maintain secure root-of-trust controls across cryptographic services.
Serve as the authority for enterprise cryptographic compliance and governance.
Ensure alignment with security policies, regulations, audit requirements, and governance frameworks.
Support audits and maintain compliance evidence and reporting.
Identify and remediate cryptographic risks and control gaps.
Develop executive and operational reporting for cryptographic services.
Track critical metrics covering Vault health, certificate management, automation, compliance, and PQC readiness.
Leverage monitoring and reporting tools including Dynatrace, Rapid7, SiteScope, Power BI, and Excel.
Provide insights to improve service performance and governance.

Benefits

Eligibility for annual bonus
Retirement savings
Share plan
Health benefits
Personal wellness
Volunteer opportunities
Outstanding Career Development opportunities
Professional development education support
Competitive vacation package with the option to purchase 5 extra days off per year
Employee driven programs focused on gender, LGBTQ+, origins, diversity, and inclusion
Corporate wellness programs
Employee discount on home and auto insurance (where applicable)