Role & responsibilities

About the Role

We are looking for an engineer who understands cryptography, not just how to call a library. You will study our systems, decide where and how cryptography should be applied, and implement secure, production-grade solutions and SDK. You will work across key management, PKI, secure communication, and application security for payment and banking-grade systems, where correctness and security matter as much as features.

Key Responsibilities

- Understand system architecture and data flows, and identify where encryption, signing, authentication, and key management are needed.
- Design and implement cryptographic solutions: encryption, digital signatures, hashing, key derivation, secure key storage, and secure transport.
- Build and maintain Java SDKs and libraries with clean APIs, versioning, documentation, and backward compatibility.
- Implement and troubleshoot PKI components: X.509 certificates, chain validation, CSRs, CRL/OCSP, and TLS/mTLS configuration.
- Integrate with HSMs and key management systems (PKCS#11), and design key lifecycle processes: generation, rotation, backup, and destruction.
- Take part in threat modelling and design reviews, and recommend algorithms, key sizes, and parameters with clear reasoning.
- Remediate findings from code reviews, static and dynamic analysis, penetration tests, and audits.
- Write unit, integration, and negative tests, including known-answer tests with standard test vectors.
- Support teams that integrate the SDK, and produce technical documentation and compliance evidence.
- Follow developments in post-quantum cryptography (ML-KEM, ML-DSA, hybrid key exchange or Newer PQC algorithm) and help assess their impact on our systems.

Required Skills Cryptography (must be able to explain the reasoning, not only the usage)

- Symmetric encryption (AES; GCM, CBC, CTR modes) and the consequences of nonce/IV misuse.
- Asymmetric cryptography: RSA (OAEP, PSS), ECC (ECDSA,



ECDH, Ed25519, X25519).
- Hashing, HMAC, key derivation (HKDF, PBKDF2), and secure random generation.
- Authenticated encryption and key management principles.

PKI and protocols

- X.509, certificate lifecycle, trust chain validation.
- TLS 1.2/1.3 and mTLS: handshake, cipher suites, session resumption.
- JWT/JWS/JWE, OAuth2, and signature formats such as CMS/PKCS#7.

Development

- Strong Java (Java 8 or later): collections, concurrency, exception handling, JVM basics.
- Hands-on experience with JCA/JCE and Bouncy Castle. Use of vetted libraries only, no custom algorithms.
- Experience building reusable libraries or SDKs with Maven or Gradle.
- Git, CI/CD, JUnit, and Mockito.

Security engineering

- Secure coding practices (OWASP Top 10): constant-time comparison, safe error handling, no secrets in logs.
- Understanding of threat modelling and trust boundaries.

Education: B.E./B.Tech/MCA or equivalent in Computer Science, IT, Electronics, or a related field.

Good to Have

- Android development: Android Keystore, secure storage, AAR packaging.
- HSM experience (PKCS#11) and key management systems.
- Experience in payments, banking, or fintech security (PCI DSS, RBI guidelines, ISO 27001).
- Knowledge of TLS stacks and gateways (OpenSSL, Tomcat, Bouncy Castle JSSE).
- Familiarity with SAST/DAST tools, Kotlin, Spring Boot, or Docker.
- Security certifications or open-source contributions.

Expectations by Experience 2-3 years

Implements cryptographic features correctly using vetted libraries under guidance; knows the common pitfalls.

4-6 years

Designs the solution, chooses algorithms and parameters, owns key management and PKI aspects, reviews others code, and explains trade-offs to non-specialists.

Soft Skills

Analytical, with attention to detail in security-critical code.

Explicit written and verbal communication.

Ownership and the ability to work independently.

Willingness to learn and to challenge insecure designs constructively.

📌 Cryptography Researcher (Hyderabad)
🏢 National Payments Corporation Of India (NPCI)
📍 Hyderabad