Senior Lead Security Engineer - PKI, Cryptography

JPMorganChase•Plano, TX

About The Position

As a Senior Lead Security Engineer within JPMorganChase’s Cybersecurity, Technology and Controls organization, you will help an agile team deliver software that meets functional and user requirements while preventing misuse, circumvention, and malicious behavior. You will apply deep technical expertise and problem-solving methods to cybersecurity challenges across technology domains and drive meaningful business impact. The role owns cryptography and key management strategy, develops data protection capabilities, and helps engineering teams adopt secure cryptographic patterns. It also drives certificate and identity-related cryptography, algorithm agility and post-quantum readiness, shift-left security practices, cryptographic assurance, and improvements to team engineering practices.

Requirements

Formal training or certification in security engineering concepts and at least 5 years of applied experience.
Strong foundation in system design and applied cryptography, with demonstrated experience building secure systems.
Hands-on experience with key management concepts and implementations, including envelope encryption, key hierarchies, rotation, least-privilege access, segregation of duties, audit logging, and break-glass controls.
Ability to translate security and control requirements into engineering deliverables that are testable, observable, and auditable.
Advanced, hands-on Java experience, with strong testing discipline and secure coding practices.
Experience designing and operating enterprise-grade services, including service-level objectives, monitoring and alerting, capacity planning, and disaster recovery considerations.
Extensive experience with threat modeling, vulnerability discovery, and coordinating penetration testing and security assessment results, including driving remediation to closure.
Demonstrated ability to lead cross-functional initiatives, drive adoption across multiple teams, and communicate risks and tradeoffs clearly to senior stakeholders.
Ability to review and validate AI-assisted security recommendations before adoption, escalate uncertainty, and ensure outcomes meet security, resiliency, and auditability expectations.

Nice To Haves

Deep experience with hardware security modules and key management service platforms, including quorum/M-of-N, partitioning, backup and restore, upgrades, and incident response controls.
Experience with public key infrastructure and transport layer security at scale, including certificate automation, mutual transport layer security, cipher policy, rotation, and certificate revocation considerations.
Experience with secrets management and service-to-service authentication patterns.
Familiarity with post-quantum cryptography concepts and practical migration planning, including inventory management, algorithm agility, and staged rollout.
Demonstrated security-first and shift-left mindset through building guardrails and paved roads rather than solely conducting reviews.

Responsibilities

Own the cryptography and key management strategy and roadmap across platforms and applications, including standards, reference architectures, and secure-by-default patterns for encryption, signing, and key lifecycle.
Lead the design and development of key management and data protection capabilities, including hardware security module and key management service integrations, envelope encryption, key hierarchies, rotation, revocation, backup and restore, and access controls.
Design and deliver applied cryptography solutions for data-at-rest, in-transit, and in-use use cases, balancing security, reliability, latency, and cost.
Establish and operate cryptographic key lifecycle controls, including key generation, storage, distribution, usage restrictions, rotation schedules, decommissioning and destruction, and audit logging and monitoring.
Partner with engineering teams to embed cryptography using reusable libraries and software development kits, secure configuration baselines, and migration plans away from legacy algorithms or unsafe implementations.
Own certificate and identity-related cryptography, including public key infrastructure and transport layer security guidance, certificate issuance and rotation automation, and mutual transport layer security patterns.
Drive algorithm agility and post-quantum readiness by maintaining an inventory of cryptographic usage, defining upgrade paths, running proofs of concept, and planning staged migrations.
Advise stakeholders and senior business leaders during vulnerability periods, including risk assessment, compensating controls, prioritization, and clear decision options and tradeoffs.
Build shift-left security into the software development lifecycle and toolchain through threat modeling, secure design reviews, static and dynamic analysis, secret scanning, cryptographic misuse checks, and policy-as-code where applicable.
Lead security testing and assurance for cryptographic and key systems, including design reviews, attack simulations, penetration test coordination, control validation, and remediation ownership.
Improve team engineering practices through mentoring, code review standards, documentation and runbooks, operational readiness reviews, and incident learning.