Cryptographic Key Management Operations Engineer

About the role

State Street is looking for a Cryptographic Key Management Operations Engineer in Singapore to support the end-to-end lifecycle management of cryptographic keys across cloud, on-premises, infrastructure and IoT environments. The role ensures secure generation, distribution, rotation, revocation and retirement of encryption keys while meeting regulatory requirements, industry standards and enterprise security policies, working closely with cybersecurity, cloud, infrastructure and application teams.

Key responsibilities

• Support the day-to-day operation and security of key management services, ensuring compliance with PCI DSS, GDPR, FIPS 140-3 and NIST guidance.
• Manage the full key lifecycle: generation, storage, distribution, rotation, escrow, revocation and retirement across cloud, on-premises and IoT environments.
• Monitor, investigate and respond to key management incidents such as key compromise, expiration and policy violations.
• Maintain the availability, integrity and security of key management infrastructure and troubleshoot issues.
• Partner with cybersecurity, cloud, infrastructure, engineering and DevSecOps teams to integrate cryptographic services into applications and platforms.
• Automate and optimise key management using APIs, Key Management Systems (KMS), infrastructure-as-code (IaC) and security orchestration.
• Develop operational procedures, runbooks and technical documentation, and produce operational, compliance and risk reports.
• Stay current with emerging cryptography, post-quantum developments and regulatory requirements.

Required profile

• Bachelor's degree in Computer Science, Cybersecurity, Information Security, Engineering or a related field; equivalent practical experience also considered.
• 3+ years of experience supporting cryptographic operations, key management platforms, information security or cybersecurity in a financial services or regulated industry.
• Strong understanding of symmetric and asymmetric encryption, PKI, certificate management and HSMs.
• Hands-on experience with AWS KMS, Azure Key Vault, OCI Vault and Fortanix DSM.
• Knowledge of PCI DSS, FIPS 140-3, NIST, ISO 27001 and related standards.
• Familiarity with IoT security, embedded cryptography, device identity management, SIEM and monitoring platforms, and automation/scripting tools such as Python, PowerShell and Terraform.
• Agile, Jira and Confluence; security certifications such as CISSP, CISM, CCSP or AWS Security Specialty preferred; exposure to post-quantum cryptography highly desirable.