Senior Lead Security Engineer - PKI, Cryptography

JPMorgan Chase & Co.•Plano, TX

10d

About The Position

As a Senior Lead Security Engineer at JPMorganChase within the Cybersecurity, Technology and Controls organization, you will contribute to an agile team delivering software solutions that meet functional and user requirements while preventing misuse, circumvention, and malicious behavior. You will apply deep technical expertise and problem-solving methodologies to address cybersecurity challenges spanning multiple technology domains and drive meaningful business impact. The role owns the cryptography and key management strategy across platforms and applications, leads development of key-management and data-protection capabilities, and delivers applied cryptography solutions. It also covers cryptographic lifecycle controls, reusable engineering patterns, certificate and identity-related cryptography, algorithm agility and post-quantum readiness, and security assurance. The Senior Lead partners with engineering teams and senior stakeholders to integrate security into the software development lifecycle, guide decisions during vulnerability periods, and improve engineering practices through mentoring, documentation, and operational readiness.

Requirements

Formal training or certification in security engineering concepts and 5+ years of applied experience.
Strong foundation in system design and applied cryptography, with demonstrated experience building secure systems.
Hands-on experience with key management concepts and implementations, including envelope encryption, key hierarchies, rotation, least-privilege access, segregation of duties, audit logging, and break-glass controls.
Ability to translate security and control requirements into testable, observable, and auditable engineering deliverables.
Advanced hands-on Java experience, strong testing discipline, and secure coding practices.
Experience designing and operating enterprise-grade services using reliability practices such as service-level objectives, monitoring and alerting, capacity planning, and disaster recovery considerations.
Extensive experience with threat modeling, vulnerability discovery, and coordinating penetration testing and security assessment results, including driving remediations to closure.
Demonstrated ability to lead cross-functional initiatives, drive adoption across multiple teams, and communicate risk and tradeoffs clearly to senior stakeholders.
Ability to review and validate AI-assisted security recommendations before adoption, escalate uncertainty, and ensure outcomes align with security, resiliency, and auditability expectations.

Nice To Haves

Deep experience with hardware security modules and key management service platforms, including operational controls such as quorum/M-of-N, partitioning, backup and restore, upgrades, and incident response.
Experience with PKI and TLS at scale, including certificate automation, mTLS, cipher policy, rotation, and certificate revocation considerations.
Experience with secrets management and service-to-service authentication patterns.
Familiarity with post-quantum cryptography concepts and practical migration planning, including inventory management, algorithm agility, and staged rollout.
Demonstrated security-first and shift-left mindset through building guardrails and paved roads rather than solely conducting reviews.

Responsibilities

Own the cryptography and key management strategy and roadmap across platforms and applications, including standards, reference architectures, and secure-by-default patterns for encryption, signing, and key lifecycle.
Lead the design and development of key management and data protection capabilities, including HSM and key management service integrations, envelope encryption, key hierarchies, rotation, revocation, backup and restore, and access controls.
Design and deliver applied cryptography solutions for data-at-rest, in-transit, and in-use use cases, balancing security, reliability, latency, and cost.
Establish and operate cryptographic key lifecycle controls for generation, storage, distribution, use restrictions, rotation, decommissioning and destruction, and audit logging and monitoring.
Partner with engineering teams to embed cryptography safely through reusable libraries and SDKs, secure configuration baselines, and migration plans away from legacy algorithms or unsafe implementations.
Own certificate and identity-related cryptography, including PKI and TLS guidance, certificate issuance and rotation automation, and mTLS patterns, while reducing certificate and key operational risk.
Drive algorithm agility and post-quantum readiness through cryptographic-use inventories, upgrade paths, proof-of-concepts, and staged migration planning.
Advise stakeholders and senior business leaders during vulnerability periods through risk assessments, compensating controls, prioritization, and clear decision options and tradeoffs.
Build shift-left security into the software development lifecycle and toolchain through threat modeling, secure design reviews, static and dynamic analysis, secret scanning, cryptographic misuse checks, and policy-as-code where applicable.
Lead security testing and assurance for cryptographic and key systems, including design reviews, attack simulations, penetration test coordination, control validation, and remediation ownership.
Improve team engineering practices through mentoring, code review standards, documentation and runbooks, operational readiness reviews, and incident learning.

Benefits

Competitive total rewards package, including base salary determined by role, experience, skill set, and location.
Eligible roles may receive commission-based pay and/or discretionary incentive compensation in cash and/or forfeitable equity.
Comprehensive health care coverage.
On-site health and wellness centers.
Retirement savings plan.
Backup childcare.
Tuition reimbursement.
Mental health support.
Financial coaching.

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume