Cybersecurity Analyst to support cryptographic operations using HashiCorp Vault, PKI, and TLS/SSL certificate management - 2927

Duration: Until 30 Sep 2027 (possibility of extension)

Location: Markham - Hybrid (3 days a week)

Role Overview The Cryptography Analyst is responsible for delivering business-as-usual (BAU) cryptographic operations across key and secrets management, TLS/SSL certificate lifecycle, PKI services, and post-quantum cryptography (PQC) readiness. This role ensures secure, compliant, and resilient cryptographic services supporting enterprise platforms and applications.

Top Required Skills:

- Cryptography and Hashi Vault experience
- Information security incident handling

Required Skills & Experience Technical Skills

- HashiCorp Vault (administration and operations)
- Hardware Security Modules (Thales LUNA preferred)
- TLS/SSL certificate management and PKI Aviva: Internal
- Automation (APIs, scripting, CI/CD integration)
- Monitoring tools (Dynatrace, Rapid7, Power BI) Core Competencies
- Solid understanding of cryptographic principles and lifecycle
- Knowledge of RBAC, least privilege, and access control
- Experience with compliance and audit frameworks
- Problem-solving and troubleshooting skills
- Ability to operate in a 24/7 BAU environment

Nice-to-Have

- Experience with Kubernetes and cert-manager
- Exposure to Post-Quantum Cryptography (PQC)
- Experience in regulated industries (e.g., insurance, financial services)

Key Responsibilities

Cryptography Services & Operations
- Provide operational support for: o HashiCorp Vault–based secrets and key management o HSM-integrated root of trust operations o TLS/SSL certificate lifecycle using platforms such as Sectigo o Cryptographic monitoring, reporting, and governance o PQC readiness, risk management, and enablement

HashiCorp Vault & Secrets Management
- Administer and support Vault environments across production and non-production
- Manage: Secrets, keys, tokens, leases, and service accounts lifecycle o Authentication mechanisms and RBAC enforcement o Access Control Lists (ACLs) aligned with least privilege principles
- Perform: o Tenant onboarding/offboarding o Vault troubleshooting and performance tuning Aviva: Internal
- Support integrations with AWS KMS and external secret

Platform Operations & Maintenance
- Conduct proactive monitoring and health checks
- Manage Vault upgrades, testing, and currency roadmap
- Support configuration changes and change management processes
- Coordinate off-hours support and cloud transformation

HSM & Root of Trust Operations

- Support Vault-HSM integration (Thales LUNA HSM)
- Manage: o Auto-unseal functionality o Key rotation and secure handling practices • Coordinate firmware upgrades and DR processes

Certificate & PKI Lifecycle Management

- Perform end-to-end certificate lifecycle operations: o Creation, renewal, revocation, replacement o Installation validation and incident troubleshooting
- Ensure SLA adherence (24-hour turnaround)
- Maintain certificate inventory and ownership records
- Support PKI documentation, audits, and compliance

Certificate Automation & Governance Aviva: Internal

- Design and operate certificate lifecycle automation
- Implement automation using: o ACME protocols o Vault PKI engine o Kubernetes cert-manager and cloud-native tools
- Maintain:



o Certificate inventory (including automation status) o Monitoring systems for renewal failures and expiry risks
- Enforce: o Certificate standards (CAs, algorithms, key sizes) o Security best practices (least privilege, segregation of duties)

Cryptographic Inventory & Risk Management

- Maintain a comprehensive cryptographic inventory: o Keys, secrets, certificates, and algorithms
- Identify: o Deprecated or weak cryptographic implementations
- Support audit, compliance, and risk assessments
- Conduct PQC readiness assessments
- Support: o Cryptographic transition strategies o Risk identification and mitigation
- Enable future-proof cryptographic capabilities

Monitoring, Reporting & Governance

- Deliver KPIs and service metrics across: o Vault operations o PKI and certificate automation o Cryptographic risk and PQC
- Use tools such as Dynatrace, SiteScope, Rapid7, Power BI, and Excel for reporting

Security, Compliance & Resilience

- Ensure compliance with security and regulatory requirements
- Support: o Backup and disaster recovery processes o Security investigations and audits
- Maintain high availability and resilience of cryptographic services

Knowledge Transfer & Enablement

- Develop and maintain documentation and runbooks
- Enable knowledge sharing across teams
- Drive continuous improvement and operational maturity

Summary

- This role is critical in ensuring secure, automated, and compliant cryptographic operations, with a focus on operational excellence, risk reduction, and future cryptographic readiness.

Duration: Until 30 Sep 2027 (possibility of extension)

Location: Markham - Hybrid (3 days a week)

Role Overview The Cryptography Analyst is responsible for delivering business-as-usual (BAU) cryptographic operations across key and secrets management, TLS/SSL certificate lifecycle, PKI services, and post-quantum cryptography (PQC) readiness. This role ensures secure, compliant, and resilient cryptographic services supporting enterprise platforms and applications.

Top Required Skills:

- Ticket management skills
- Cryptography and Hashi Vault experience
- Information security incident handling

Required Skills & Experience Technical Skills

- HashiCorp Vault (administration and operations)
- Hardware Security Modules (Thales LUNA preferred)
- TLS/SSL certificate management and PKI Aviva: Internal
- Secrets management platforms (AWS Secrets Manager, etc.)
- Cloud platforms (AWS preferred)
- Automation (APIs, scripting, CI/CD integration)
- Monitoring tools (Dynatrace, Rapid7, Power BI) Core Competencies
- Strong understanding of cryptographic principles and lifecycle
- Knowledge of RBAC, least privilege, and access control
- Experience with compliance and audit frameworks
- Problem-solving and troubleshooting skills
- Ability to operate in a 24/7 BAU environment

Nice-to-Have

- Experience with Kubernetes and cert-manager
- Exposure to Post-Quantum Cryptography (PQC)
- Experience in regulated industries (e.g., insurance, financial services)





Key Responsibilities

Cryptography Services & Operations
- Provide operational support for: o HashiCorp Vault–based secrets and key management o HSM-integrated root of trust operations o TLS/SSL certificate lifecycle using platforms such as Sectigo o Cryptographic monitoring, reporting, and governance o PQC readiness, risk management, and enablement

HashiCorp Vault & Secrets Management
- Administer and support Vault environments across production and non-production
- Manage: Secrets, keys, tokens, leases, and service accounts lifecycle o Authentication mechanisms and RBAC enforcement o Access Control Lists (ACLs) aligned with least privilege principles
- Perform: o Tenant onboarding/offboarding o Vault troubleshooting and performance tuning Aviva: Internal
- Support integrations with AWS KMS and external secret

Platform Operations & Maintenance
- Conduct proactive monitoring and health checks
- Manage Vault upgrades, testing, and currency roadmap
- Support configuration changes and change management processes
- Coordinate off-hours support and cloud transformation

HSM & Root of Trust Operations

- Support Vault-HSM integration (Thales LUNA HSM)
- Manage: o Auto-unseal functionality o Key rotation and secure handling practices • Coordinate firmware upgrades and DR processes

Certificate & PKI Lifecycle Management

- Perform end-to-end certificate lifecycle operations: o Creation, renewal, revocation, replacement o Installation validation and incident troubleshooting
- Ensure SLA adherence (24-hour turnaround)
- Maintain certificate inventory and ownership records
- Support PKI documentation, audits, and compliance

Certificate Automation & Governance Aviva: Internal

- Design and operate certificate lifecycle automation
- Implement automation using: o ACME protocols o Vault PKI engine o Kubernetes cert-manager and cloud-native tools
- Maintain: o Certificate inventory (including automation status) o Monitoring systems for renewal failures and expiry risks
- Enforce: o Certificate standards (CAs, algorithms, key sizes) o Security best practices (least privilege, segregation of duties)

Post-Quantum Cryptography (PQC)

- Conduct PQC readiness assessments
- Support: o Cryptographic transition strategies o Risk identification and mitigation
- Enable future-proof cryptographic capabilities

Monitoring, Reporting & Governance

- Deliver KPIs and service metrics across: o Vault operations o PKI and certificate automation o Cryptographic risk and PQC
- Use tools such as Dynatrace, SiteScope, Rapid7, Power BI, and Excel for reporting

Security, Compliance & Resilience

- Ensure compliance with security and regulatory requirements
- Support: o Backup and disaster recovery processes o Security investigations and audits
- Maintain high availability and resilience of cryptographic services

Knowledge Transfer & Enablement

- Develop and maintain documentation and runbooks
- Enable knowledge sharing across teams
- Drive continuous improvement and operational maturity

Summary

- This role is critical in ensuring secure, automated, and compliant cryptographic operations, with a focus on operational excellence, risk reduction, and future cryptographic readiness.

Disclaimer:

AI may be used in evaluating candidates.

This posting is for an existing vacancy.

📌 Cybersecurity Analyst to support cryptographic operations using HashiCorp Vault, PKI, and TLS/SSL certificate management - 2927 (Toronto)
🏢 S.i. Systems
📍 Toronto