Senior Associate Cryptography Researcher

Key Responsibilities: • Understand system architecture and data flows, and identify where encryption, signing, authentication, and key management are needed. • Design and implement cryptographic solutions: encryption, digital signatures, hashing, key derivation, secure key storage, and secure transport. • Build and maintain Java SDKs and libraries with clean APIs, versioning, documentation, and backward compatibility. • Implement and troubleshoot PKI components: X.509 certificates, chain validation, CSRs, CRL/OCSP, and TLS/mTLS configuration. • Integrate with HSMs and key management systems (PKCS#11), and design key lifecycle processes: generation, rotation, backup, and destruction. • Take part in threat modelling and design reviews, and recommend algorithms, key sizes, and parameters with clear reasoning. • Remediate findings from code reviews, static and dynamic analysis, penetration tests, and audits. • Write unit, integration, and negative tests, including known-answer tests with standard test vectors. • Support teams that integrate the SDK, and produce technical documentation and compliance evidence. • Follow developments in post-quantum cryptography (ML-KEM, ML-DSA, hybrid key exchange or Newer PQC algorithm) and help assess their impact on our systems. Required Skills Cryptography (must be able to explain the reasoning, not only the usage) • Symmetric encryption (AES; GCM, CBC, CTR modes) and the consequences of nonce/IV misuse. • Asymmetric cryptography: RSA (OAEP, PSS), ECC (ECDSA, ECDH, Ed25519, X25519). • Hashing, HMAC, key derivation (HKDF, PBKDF2), and secure random generation. • Authenticated encryption and key management principles. PKI and protocols • X.509, certificate lifecycle, trust chain validation. • TLS 1.2/1.3 and mTLS: handshake, cipher suites, session resumption. • JWT/JWS/JWE, OAuth2, and signature formats such as CMS/PKCS#7. Development • Strong Java (Java 8 or later): collections, concurrency, exception handling, JVM basics. • Hands-on experience with JCA/JCE and Bouncy Castle. Use of vetted libraries only, no custom algorithms. • Experience building reusable libraries or SDKs with Maven or Gradle. • Git, CI/CD, JUnit, and Mockito. Security engineering • Secure coding practices (OWASP Top 10): constant-time comparison, safe error handling, no secrets in logs. • Understanding of threat modelling and trust boundaries. Education: B.E./B.Tech/MCA or equivalent in Computer Science, IT, Electronics, or a related field. Good to Have • Android development: Android Keystore, secure storage, AAR packaging. • HSM experience (PKCS#11) and key management systems. • Experience in payments, banking, or fintech security (PCI DSS, RBI guidelines, ISO 27001). • Knowledge of TLS stacks and gateways (OpenSSL, Tomcat, Bouncy Castle JSSE). • Familiarity with SAST/DAST tools, Kotlin, Spring Boot, or Docker. • Security certifications or open-source contributions.