Cryptography Engineer - Key, Certificate & HSM Management

Engagement: Freelance / contract

Location: Belgium - hybrid (50% on site, 50% homeworking)

Experience required: 5+ years relevant experience

Context

Our client is a major financial institution operating a dedicated Key, Certificate and Key Management team of approximately 15 specialists in Belgium, sitting within a wider production security function.

The team owns the lifecycle management of cryptographic keys, digital certificates (internal, group and public) and application secrets managed through HashiCorp Vault. Its mission is to secure electronic transactions, authentication flows and cloud-hosted applications while maintaining full compliance with EU and internal regulatory requirements, including PSD2 and PCI.

The team also operates and supports the organisation's Hardware Security Module (HSM) estate, providing a trusted environment for both internal and external consumers. It acts as the go-to partner for stakeholders across the business, delivering cost-efficient and reliable security solutions.

Responsibilities

Operations

- Manage the lifecycle of cryptographic keys, digital certificates and application secrets, including rotation, revocation and access control.
- Monitor and maintain HSM infrastructure; including enterprise HSM appliances and mainframe TKE; to ensure high availability and compliance.
- Troubleshoot incidents and work with delivery teams to close security gaps across authentication, encryption and secret storage.

Expertise & Projects





- Act as a Crypto Design Authority, advising on cryptographic standards, algorithms and best practice (NIST, PCI-DSS, PSD2).
- Lead or contribute to strategic initiatives, including:
- Post-quantum cryptography; risk assessment and migration towards quantum-resistant solutions.
- EKU readiness; preparing systems for Extended Key Usage compliance.
- HSM lifecycle management; support, configuration and key ceremonies.
- Crypto agility; improving certificate and key lifecycle management processes.
- Platform integration; aligning local platforms with central group tooling.
- Partner with central security functions, IT architects and application owners to translate regulatory and business requirements into technical solutions.

Must-have skills

- Deep IT security expertise, with technical mastery of HSMs, PKI, HashiCorp Vault and cryptographic standards (NIST).
- Proven operational oversight of high-availability infrastructure.
- Ability to translate abstract security requirements into feasible IT solutions, balancing cost efficiency, compliance and developer practicality.
- Comfortable working in an agile environment — anticipating change and prioritising flexibly without compromising production stability.
- Microsoft Office (Word, Excel, PowerPoint).

Preferred

- Hands-on experience with Entrust nShield / nCipher or equivalent enterprise HSM platforms.
- Scripting (Python, Bash or similar).
- ServiceNow, Rally.
- Formal agile methodology adoption.

Languages: French & English

📌 Cryptography engineer (España)
🏢 Stott and May
📍 España