EKMS Senior Engineer

Encryption Engineer 
Today’s world is fueled by vast amounts of information which makes data more valuable than ever before. Best security practices have informed many organizations to take full control of their cryptographic keys which encrypt data on-premises and in the cloud rather than leaving those responsibilities to cloud providers or third-party companies. Protecting data in information systems is central to this role, and everyone in EY Information Security has a critical role to play. Join a global team of almost 900 people who collaborate to support the business of EY by protecting EY and client information assets! Our Information Security professionals enable EY to work securely and deliver secure products and services, as well as detect and quickly respond to security events as they happen. Together, the efforts of our dedicated team helps protect the EY brand and build client trust.

Within Information Security we blend risk strategy, digital identity, cyber defense, application security and technology solutions as we consider the entire security lifecycle.

You will join a team of hardworking, security-focused individuals dedicated to supporting, protecting and enabling the business through innovative, secure solutions that provide speed to market and business value.

The opportunity
The Encryption Engineer will be a member of the Cryptography team within the Information Security Identity and Access Management Services (IAMS) team. This Engineer will deploy, configure and maintain a centralized key management tool and ensure that storage of sensitive key material reside only in a Hardware Security Module (HSM). 

Your key responsibilities

• Deploy and configure enterprise key management and HSM tools, which will centralize key lifecycle administration across the global EY platform for data at rest and data in transit. Your responsibilities include:
• Deploy and configure the Firm’s enterprise key management tools.
• Deploy and configure the Firm’s Hardware Security Module.
• Implement process automations as it relates to enterprise key management and HSM administration.
• Maintain and update the enterprise key management tools to support new business requirements while maintaining the fundamentals of a centralised key management service.
• Support integration of HSMs to support Apache, Nginx, Windows IIS and Java keystores.
• Support cloud application teams in centralizing storage of sensitive key material in proprietary repositories such as Azure Key Vault (AKV) and Goggle Cloud Key Management Services while aligning to the overall EY key management strategy.
• Provide Level 3 and 4 support to operational team on key management which has a direct impact of the Recovery Time Objective (RTO).
• Document operational procedures for deployment and configuration of security appliance.
• Update system configuration runbook regularly.
• Lead HSM engineering and enterprise key management efforts across the internal infrastructure and cloud environments.
• Work with cross functional teams and collaborate with IAM Operations.
• Research on impact of future computer security standard such as Federal Information Processing Standard 140-3 (FIPS 140-3), Cryptographic Module Validation Program (CMVP), Common Criteria (ISO/IEC 15408) on EY KMS strategy.
• Research on business problems that can be solved by a quantum computer faster than a classical computer and suggest areas in EY KMS strategy which require updates.
• Provide subject matter expertise on HSM, FIPS, CMVP, ISO/IEC 15408 to project teams, and other audiences as needed

Skills and attributes for success

• A successful candidate for this role impacts EY business by deploying and configuring security tools recommended in EY key management strategy. As such, candidates must possess:
• Experience with Key Management Life Cycle - Key Generation, Storage, Distribution, Backup, Rotation, Revocation, Destruction, etc.
• Experience with major enterprise key management system as well as cloud based key management services
• Hands on experience and knowledge of TLS, PKI, HSMs, KMIP, Digital Certificate Management, Azure Key Vault, and transparent database encryption
• Experience with FIPS 140-2 compliance requirements and implementation
• Experience in security key management, security standards, cryptography, certificate management lifecycle and PKI
• Understanding of cloud computing architecture, technical design, and implementation
• To qualify for the role, you must have
• Degree in Computer Science, Computer Engineering or 5 years Security Engineering Experience or equivalent
• 3+ years’ experience in enterprise key management, HSM configuration, application layer encryption, and transparent data encryption

Ideally, you’ll also have

• Experience working with diverse, globally distributed teams
• Ability to work well in a highly matrixed environment yet builds credibility to drive execution outside of direct chain of command while working across all organizational levels.
• Strong analytical and problem-solving skills.
• A security industry certification such as Security+, Network+, Cryptography Certification. 
• Ability to work independently or with a team, under minimum supervision

What we look for
A successful candidate for this role would be expected to think like an Engineer. Thinking like an engineer means looking at situations from multiple lenses. It means persistence, originality and apply technical concepts rather than popular opinion. Networking with key stakeholders and sponsors, cross-teaming across the organization is required for this role, as such we would look out for relationship builder. As an engineer slowing down to enjoy the process rather than fixating on its conclusion is key in this role.

What we offer
As part of this role, you will work in a highly coordinated, globally diverse team with the opportunity and tools to grow, develop and drive your career forward. Here, you can combine global opportunity with flexible working. The EY benefits package goes above and beyond too, focusing on your physical, emotional, financial and social well-being. Your recruiter can talk to you about the benefits available in your country. Here’s a snapshot of what we offer:

• Continuous learning: You will develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We will provide the tools and flexibility, so you can make a significant impact, your way.
• Confidence: We will provide you the insights, coaching and self-assurance in your decision making that the world needs.
• Diverse and inclusive culture: You will be accepted for who you are and empowered to use your voice to help others find theirs.