Purpose of the role

Our client has built a new centralised cryptographic services API. Application teams across the estate now need to move off their own local cryptographic implementations and consume the central service instead. That migration will not happen on its own.

This role exists to make it happen. You will own the adoption pipeline end to end: knowing every application in scope, what it does today, what it has to change, when it will change, and who is accountable. You will then drive each team through it.

It is deliberately a hybrid role. The project management half owns the plan, the pipeline and the reporting. The business analysis half gets close enough to the API and to each application to be genuinely useful advising on integration patterns, unpicking why a team is stuck, and feeding real gaps back to the platform team.

Key responsibilities

Own the adoption pipeline

- Build and maintain the inventory of in-scope applications, their current cryptographic usage, target state and sequencing.
- Track every application through defined stages assessment, integration, test, live — with clear entry and exit criteria at each gate.
- Hold a single credible view of adoption progress that governance and senior stakeholders can rely on.
- Forecast adoption against the plan, and flag applications at risk of missing their date early enough to act.

Drive adoption

- Own the relationship with each application team: engage them, agree a realistic plan, then hold them to it.
- Chase, escalate and unblock. Most application teams have competing priorities, and this role is the reason adoption stays on their list.
- Run onboarding sessions and clinics for teams integrating with the API for the first time.
- Identify recurring blockers — documentation gaps, environment or non-production availability, access, unclear patterns — and get them fixed once rather than team by team.

Analysis and enablement





- Understand the API in enough depth to advise application teams on integration patterns and answer first-line questions without escalating everything.
- Work with application teams to assess how they use cryptography today and map it to the service’s capabilities.
- Identify use cases the API does not yet cover, and feed them back to the platform team as prioritised, well-evidenced requirements.
- Write integration guidance, migration playbooks and reusable patterns so each team is not starting from a blank page.
- Support integration and non-functional testing, including latency, throughput and failover behaviour where cryptographic calls sit in a transaction path.

Governance and reporting

- Report adoption metrics and progress into programme governance, with commentary rather than raw numbers.
- Manage risks, assumptions, issues and dependencies across a large set of application stakeholders.
- Work with control and compliance owners to evidence that adopted applications meet the required standard.

Cryptography experience

You are not expected to implement cryptography, but you cannot drive its adoption without understanding it.

- Practical understanding of applied cryptography from a consumer’s point of view: encryption and decryption, signing and verification, key management, and where each is used in an application.
- Familiarity with cryptographic APIs, libraries or SDKs, and enough grasp of the concepts to hold a credible integration conversation with an application developer.
- Understanding of why enterprises centralise cryptography — consistency of implementation, key custody and control, auditability,



and crypto-agility when algorithms or keys must change.
- Awareness of the operational trade-offs when cryptographic operations move out of process to a service call, particularly latency, availability and failure handling.
- Working knowledge of cryptographic control standards, and how adoption is evidenced against them.

Wider essential experience

- Proven delivery as a hybrid Project Manager and Business Analyst, comfortable owning both the plan and the detail beneath it.
- Driving adoption of an API, platform or shared service across many application teams in a large enterprise. This is the core of the role and the main thing we will test at interview.
- A track record of influencing and moving teams you do not manage, whose priorities sit elsewhere.
- Building and owning a migration or adoption pipeline with stage gates and reporting that stood up to scrutiny.
- Credible with both engineers and senior stakeholders, and able to change register between them.
- Experience in a large regulated enterprise, working within formal governance and change processes.

Desirable experience

- API integration or platform migration programmes, and familiarity with REST or gRPC service patterns.
- Hardware security modules, or cloud key management and secrets management services.
- Cryptographic standards and frameworks, such as the NIST key management guidance, FIPS validation levels, or the cryptographic requirements of PCI DSS.
- Awareness of crypto-agility and post-quantum readiness as drivers for centralising cryptographic services.
- A developer-experience mindset, and the technical writing ability to produce guidance teams actually use.
- Agile delivery in a scaled environment, and the associated tooling.
- A relevant certification, such as CISSP, PMP, PRINCE2 or a recognised business analysis qualification.
- Financial services, or another setting governed by formal cryptographic control standards

📌 Project Manager or Business Analyst API Adoption (Hyderabad)
🏢 Norwin Technologies
📍 Hyderabad