Duration: Until 30 Sep (possibility of extension) Location: Markham - Hybrid (3 days a week) Role Overview The Cryptography Analyst is responsible for delivering business-as-usual (BAU) cryptographic operations across key and secrets management, TLS/SSL certificate lifecycle, PKI services, and post-quantum cryptography (PQC) readiness.

This role ensures secure, compliant, and resilient cryptographic services supporting enterprise platforms and applications.

Top Required Skills: Ticket management skills Cryptography and Hashi Vault experience Information security incident handling Required Skills & Experience Technical Skills Hashi

Corp Vault (administration and operations) Hardware Security Modules (Thales LUNA preferred) TLS/SSL certificate management and PKI Secrets management platforms (AWS Secrets Manager, etc.) Cloud platforms (AWS preferred) Automation (APIs, scripting, CI/CD integration) Monitoring tools (Dynatrace, Rapid7, Power BI) Core Competencies Strong understanding of cryptographic principles and lifecycle Knowledge of RBAC, least privilege, and access control Experience with compliance and audit frameworks Problem-solving and troubleshooting skills Ability to operate in a 24/7 BAU setting Nice-to-Have Experience with Kubernetes and cert-manager Exposure to Post-Quantum Cryptography (PQC) Experience in regulated industries (e.g., insurance, financial services) Key Responsibilities Cryptography Services & Operations Provide operational support for: o Hashi

Corp Vault–based secrets and key management o HSM-integrated root of trust operations o TLS/SSL certificate lifecycle using platforms such as Sectigo o Cryptographic monitoring, reporting, and governance o PQC readiness, risk management, and enablement Hashi





Corp Vault & Secrets Management Administer and support Vault environments across production and non-production Manage: Secrets, keys, tokens, leases, and service accounts lifecycle o Authentication mechanisms and RBAC enforcement o Access Control Lists (ACLs) aligned with least privilege principles Perform: o Tenant onboarding/offboarding o Vault troubleshooting and performance tuning Aviva: Internal Support integrations with AWS KMS and external secret Platform Operations & Maintenance Conduct proactive monitoring and health checks Manage Vault upgrades, testing, and currency roadmap Support configuration changes and change management processes Coordinate off-hours support and cloud transformation HSM & Root of Trust Operations Support Vault-HSM integration (Thales LUNA HSM) Manage: o Auto-unseal functionality o Key rotation and secure handling practices • Coordinate firmware upgrades and DR processes Certificate & PKI Lifecycle Management Perform end-to-end certificate lifecycle operations: o Creation, renewal, revocation, replacement o Installation validation and incident troubleshooting Ensure SLA adherence (24-hour turnaround) Maintain certificate inventory and ownership records Support PKI documentation, audits, and compliance Certificate Automation & Governance Aviva:



Internal Design and operate certificate lifecycle automation Implement automation using: o ACME protocols o Vault PKI engine o Kubernetes cert-manager and cloud-native tools Maintain: o Certificate inventory (including automation status) o Monitoring systems for renewal failures and expiry risks Enforce: o Certificate standards (CAs, algorithms, key sizes) o Security best practices (least privilege, segregation of duties) Cryptographic Inventory & Risk Management Maintain a comprehensive cryptographic inventory: o Keys, secrets, certificates, and algorithms Identify: o Deprecated or weak cryptographic implementations Support audit, compliance, and risk assessments Post-Quantum Cryptography (PQC) Conduct PQC readiness assessments Support: o Cryptographic transition strategies o Risk identification and mitigation Enable future-proof cryptographic capabilities Monitoring, Reporting & Governance Deliver KPIs and service metrics across: o Vault operations o PKI and certificate automation o Cryptographic risk and PQC Use tools such as Dynatrace, Site

Scope, Rapid7, Power BI, and Excel for reporting Security, Compliance & Resilience Ensure compliance with security and regulatory requirements Support: o Backup and disaster recovery processes o Security investigations and audits Maintain high availability and resilience of cryptographic services Knowledge Transfer & Enablement Develop and maintain documentation and runbooks Enable knowledge sharing across teams Drive continuous improvement and operational maturity Summary This role is critical in ensuring secure, automated, and compliant cryptographic operations, with a focus on operational excellence, risk reduction, and future cryptographic readiness.

📌 Cybersecurity Analyst to support cryptographic operations using HashiCorp Vault, PKI, and TLS/SSL certificate management - 2927 (Toronto)
🏢 S.i. Systems
📍 Toronto