If you are motivated and believe in the credit union philosophy of "People Helping People," join our team!
Position Overview:
North Carolina State Employees Credit Union is seeking a Lead Cryptographic Engineer to join its Data Protection team. This role owns the design, operation, and continuous improvement of the credit union's cryptographic infrastructure, ensuring the confidentiality, integrity, and availability of cryptographic services that protect member and enterprise data. The Lead Cryptographic Engineer will serve as a subject matter expert on certificate lifecycle management, key management, and emerging cryptographic standards, partnering closely with Security, Infrastructure, and Compliance teams.
Essential Responsibilities:
- Design and operate key management services across cloud KMS platforms and on-premises HSMs, including key hierarchies, rotation schedules, separation of duties, and BYOK/HYOK arrangements where customer commitments require them.
- Plan and execute key generation and signing ceremonies under split knowledge and dual control, with auditable evidence and witnessed procedures.
- Design, operate, and maintain enterprise Cryptographic infrastructure, including Microsoft Active Directory Certificate Services (ADCS) and integrated certificate lifecycle management platforms such as Venafi and DigiCert.
- Own the enterprise PKI end to end: offline root, issuing CA hierarchy, HSM-backed key material, CP/CPS documentation, and the operational runbooks that support them.
- Lead certificate lifecycle automation efforts, reducing manual issuance, renewal, and revocation processes across the enterprise.
- Ensure PKI operations and certificate issuance practices remain compliant with CA/Browser Forum baseline requirements and applicable industry standards.
- Evaluate, plan, and support the organization's transition to post-quantum cryptography (PQC), including algorithm agility and migration roadmaps.
- Develop and maintain cryptographic policies, standards, certificate practice statements, and operational runbooks. Set standards for envelope encryption, tokenization, field-level encryption, and data-at-rest and in-transit protection.
- Build and maintain a cryptographic bill of materials (CBOM) covering algorithms, libraries, and dependencies across the estate.
- Partner with Security Engineering, Infrastructure, and Compliance teams to support audits, risk assessments, and incident response involving cryptographic assets.
- Mentor junior engineers and contribute to the Data Protection team's technical roadmap.
Required Education & Experience (Knowledge, Skills, & Abilities):
- 7+ years of experience in information security, with a focus on public key infrastructure and cryptographic systems.
- Demonstrated ownership of a production PKI, including CA hierarchy design and HSM operations (Thales, Entrust nShield, AWS CloudHSM, or equivalent).
- Hands-on experience with Venafi, Cyberark, DigiCert, Microsoft ADCS or other Cryptographic related tooling in a production enterprise environment.
- Working knowledge of HSMs, certificate lifecycle automation tooling, and CA/Browser Forum compliance requirements.
- Practical automation skills in Python, Go, or a comparable language, and comfort working with APIs, infrastructure as code, and CI/CD systems.
- Familiarity with post-quantum cryptography concepts and emerging NIST standards.
- Strong understanding of cryptographic protocols (TLS, S/MIME, code signing) and key management best practices.
- Experience operating cryptographic services in a major cloud environment (AWS, Azure, or GCP) at scale.
- Excellent written and verbal communication skills, with the ability to advise technical and non-technical stakeholders.
Preferred Education & Experience (Knowledge, Skills, & Abilities):
- Associates, Bachelors, or advanced degree in IT Security or related field
- Experience in financial services or another highly regulated industry
- Security certifications such as Security+, GIAC, or CISSP
- Familiarity with building dashboards or metrics reporting for security programs
SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
Disclaimer
State Employees' Credit Union reserves the right to fill this role at a higher/lower level based on business need.
Skills Required
- 7+ years of information security experience focused on public key infrastructure and cryptographic systems
- Production PKI ownership, including certificate authority hierarchy design and HSM operations
- Hands-on production experience with Venafi, CyberArk, DigiCert, Microsoft ADCS, or equivalent cryptographic tooling
- Knowledge of HSMs, certificate lifecycle automation, and CA/Browser Forum compliance requirements
- Automation skills in Python, Go, or a comparable language
- Experience with APIs, infrastructure as code, and CI/CD systems
- Familiarity with post-quantum cryptography concepts and emerging NIST standards
- Strong understanding of TLS, S/MIME, code signing, and key management best practices
- Experience operating cryptographic services in AWS, Azure, or GCP at scale
- Excellent written and verbal communication skills
- Associate, bachelor's, or advanced degree in IT Security or a related field
- Experience in financial services or another highly regulated industry
- Security certification such as Security+, GIAC, or CISSP
- Familiarity with security program dashboards or metrics reporting
SECU Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about SECU and has not been reviewed or approved by SECU.
-
Retirement Support — Immediate 100% vesting and a 200% employer match on employee 401(k) contributions from 1–5% of pay (up to a 10% employer match) stand out. This level of support is described as unusually rich among financial‑services employers.
-
Leave & Time Off Breadth — 11 paid holidays plus 16 floating‑holiday hours, paid parental and caregiver leave, bereavement and volunteer time, and PTO that can reach 32 days per year with carryover up to 280 hours. These provisions provide predictable time off and flexibility across life events.
-
Healthcare Strength — Medical (PPO or HDHP) with HSA/FSA options, dental including a minor‑child orthodontia option, and vision are available for employees and eligible dependents. Employer‑paid basic life/AD&D and short‑term disability, with subsidized long‑term disability, add robust income protection.
SECU Insights
What We Do
Even though we're North Carolina's largest credit union, we're still just "people helping people." We currently serve over 2.6 million members through more than 270 branch offices - and growing! Members have 24/7 access to account services from over 1,100 ATMs, as well as via phone, our website, and the SECU Mobile App. Since 1937, we've provided financial services to employees of the State of North Carolina, public boards of education, and employees of associations formed for the benefit of State employees, as well as their immediate family members. We are the trusted provider of financial services for millions of members. And, according to Forbes Magazine, we're the best credit union in North Carolina. State Employees' Credit Union (SECU) is an Equal Housing Opportunity lender and federally insured by NCUA. SECU provides equal employment opportunity to all qualified persons regardless of race, color, religion, age, sex, sexual orientation, gender identity, national origin, genetic information, disability, veteran status, or other classification protected by law.
