Security Solution Architect – Cryptography - #2196621

We are a $13+ billion global technology company, home to more than 224,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud, and AI, powered by a broad portfolio of technology services and products.

HCLTech is a globally recognized leader in the Tech and IT industry, but we’ve never forgotten the startup mindset that got us here. We’ve always approached our work with an idea-first attitude because every one of our accomplishments —no matter how big or small —can be traced back to an idea’s single spark.

It’s that spark —that inner drive —that sets our people apart from our competitors. It enables us not just to pull off game-changing feat after game-changing feat but to better our world in the process. We want you to find your spark. Because that’s what drives you to be better, be more and ultimately, be more fulfilled.

To learn more about how we can supercharge progress for you, visit www.hcltech.com

Job Title: Security Solution Architect – Cryptography

Location: Leeds, UK (Hybrid - 2 days' work from Office)

About the job

Design the cryptographic solutions that protect the bank's keys, secrets and certificates, and make them ready for post-quantum cryptography. As our Security Solution Architect for Cryptography, you will work with engineering teams to understand what they need, turn it into solution designs for key management, certificate lifecycle and secrets management, and stay with those designs until they are running in production.

The bank has set crypto-agility and PQC readiness as objectives. Your job is to work out what those objectives mean in practice for each solution, and to help engineering teams build it that way.

Why this role matters

• Make crypto-agility real: Turn a group-level objective into specific design choices for key management, CLM and secrets, so algorithms and keys can be changed without rebuilding applications.

• Prepare for PQC early: Find where quantum-vulnerable cryptography sits in our solutions and design the path to replace it, ahead of the timelines set out in UK and EU guidance.

• Keep design and build aligned: Make sure what engineering builds and releases matches the design decisions agreed, from first design through every change on the route to live.

What you'll do - Understand the need

• Work with engineering and platform teams to understand their requirements: what they are building, the data involved, integration points, performance and resilience targets.

• Keep track of where the industry is heading on cryptography (NIST and NCSC publications, vendor PQC roadmaps, CA/Browser Forum changes) and bring that into designs before it becomes a deadline.

Design the solution

• Produce end-to-end solution designs for keys, secrets and certificates: system interactions, key and certificate flows, trust boundaries, integration points and technology choices.

• Define and compare design options (e.g. build vs. buy, HSM vs. cloud KMS, central vs. per-application CA) and document the trade-offs so decisions can be made quickly.

• Prove options in a lab before committing to a design.

• Identify whether a design needs to go to the Architecture Review Committee (e.g. new technology, regulatory scope, high-risk design) and prepare the inputs.

Stay with it through to live – and after

• Work with engineering teams as they build their patterns and configurations, and check those patterns reflect the solution design decisions.

• Review changes at each stage of the route to live, not just at first release, and flag deviations that need governance review.

• Confirm before each release that cryptographic dependencies, risks and constraints are addressed.

• Revisit designs as standards, products and threats change, and update them with engineering.

• Document and track cryptographic risks, exceptions and technical debt, with remediation plans.

• Support engineering and operations during incidents where key, certificate or HSM design is a factor, and update the design with the fix.

Projects you'll work on

You will produce and maintain the solution designs for these crypto-agility and PQC initiatives (indicative; scope and order to be agreed with the line manager):

• Cryptographic discovery and CBOM: solution design for deploying discovery tooling across code, network and infrastructure, and for feeding results into the CBOM.

• Hybrid TLS: solution design for hybrid post-quantum key exchange on selected channels, including the pilot, performance and interoperability testing.

• Crypto-agility patterns: solution designs that let applications use cryptography through approved services or libraries, with algorithms set by policy.

• PQC-capable PKI: solution design for introducing ML-DSA and hybrid certificates into the CA hierarchy, starting in the lab.

• CLM automation: solution designs for automated certificate issuance and renewal across in-scope platforms.

• HSM and KMS upgrade: solution design for the HSM firmware and cloud KMS changes needed to support PQC algorithms.

• Key and secrets remediation: solution designs for moving hard-coded keys and secrets in priority applications into Vault, KMS or HSM.

• PQC requirements in procurement: define the cryptographic and PQC requirements for products selected within these solutions.

What we're looking for Required experience

• Solution design experience in banking or financial services for secrets management, key management, digital certificates and PKI.

• Designing solutions that use HSMs (e.g. Thales Luna, Entrust nShield, Utimaco) and cloud key management (AWS KMS / CloudHSM, Azure Key Vault / Managed HSM, Google Cloud KMS), with enough hands-on depth to review engineering configurations.

• Designing solutions on PKI and CLM platforms (e.g. Microsoft AD CS, EJBCA , Keyfactor, DigiCert, AppViewX).

• Designing solutions on HashiCorp Vault or an equivalent secrets platform.

• Working knowledge of TLS 1.2/1.3, X.509, mTLS, SSH, ACME, PKCS#11 and KMIP, and comfort with tools such as OpenSSL to validate designs and investigate issues.

• Producing solution design documents (HLD/LLD), option papers and design decision records, and taking them through a design authority.

• A track record of working directly with engineering teams through build and release, not only producing designs.

Preferable experience

• Designing solutions with post-quantum cryptography and crypto-agility in mind: algorithm abstraction, hybrid deployments and the effect of larger PQC keys and signatures on systems.

• Cryptographic discovery tooling and the CycloneDX CBOM format.

• Automation of cryptographic infrastructure with Python, Go or PowerShell, and Terraform or Ansible; Kubernetes workloads.

• Experience in a group operating across more than one regulatory jurisdiction.

Working familiarity with

• NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA); NIST SP 800-57; NIST SP 800-131A; FIPS 140-3.

• NCSC guidance "Timelines for migration to post-quantum cryptography" (March 2025).

• CA/Browser Forum Baseline Requirements.

• Operational resilience and ICT risk requirements applicable to the firm, such as PRA SS1/21 and, for EU entities, the Digital Operational Resilience Act (Regulation (EU) 2022/2554).

Benefits

• A supportive, diverse, and global team with a brilliant culture.
• Competitive compensation and benefits that includes vacation per year, various insurances like Term life and Business Travel insurance. These are apart from the statutory benefits applicable in the country. Employee benefits are regulated by an internal policy that contains full details regarding the entitlement and conditions for the benefits as per the law of the land.
• Great opportunities to make the role your own, upskill yourself and get involved with exciting projects.
• Total Wellbeing is our focus. Alongside your professional excellence, you join the likeminded colleagues to create a larger impact within the company and society at large in your chosen area of passion - CSR Council, Diversity Council, Women Connect, Sparks – Engagement Champion to name a few.
• To know more about us visit – www.hcltech.com
• For more information on how we process your personal data, please refer to HCLTech’s Candidate Data Privacy Notice.