Lead Security & Cryptography Engineer
Company: Aadhcode Solutions Pvt Ltd
Job Description: Lead Security & Cryptography Engineer
Experience: 8+ years
Location: Remote
About the role:
Aadhcode is building a transaction-authorization platform for banks, payment providers and government agencies. As the named security and cryptography lead from day one, you'll own the platform's cryptographic design and take it through a bank pilot and an independent third-party security review.
What you'll do:
Own the cryptographic architecture: signing, key hierarchy, algorithm choices and the decision records behind them.
Design and implement key management on AWS CloudHSM (PKCS#11), including key ceremonies, rotation, backup and disaster recovery.
Build signed approval receipts (JWS/COSE) and an offline verifier that auditors can run without our systems.
Verify device attestation on the server: Apple App Attest, Android Key Attestation/StrongBox and Play Integrity, plus FIDO2/WebAuthn for desktop.
Design the tamper-evident audit ledger with the backend team.
Set our post-quantum strategy (ML-DSA/Dilithium readiness) and the ability to swap algorithms without breaking stored records.
Lead threat modelling and the security gates in the pipeline (SAST/DAST/SBOM), and act as the main contact for the external security review.
Turn compliance requirements into concrete technical controls with our compliance engineer: PSD2 strong customer authentication, PCI DSS, SOC 2 and FedRAMP readiness.
Mentor backend engineers moving from Java to Go on secure coding practices.
What you'll bring
8+ years in security engineering, with at least 3 designing production cryptographic systems. Implementing protocols counts; only calling libraries doesn't.
Hands-on HSM experience with CloudHSM, Thales/Luna or similar, including PKCS#11 and real key ceremonies.
Deep working knowledge of ECDSA/EdDSA, JWS/COSE, X.509 and certificate chains, hashing and Merkle structures, and constant-time implementation concerns.
Experience with mobile secure hardware (Secure Enclave, StrongBox) and attestation flows.
Strong Go; Rust is a strong plus.
Experience taking systems through external penetration tests or security reviews in fintech, banking or government.
Nice to have: Post-quantum migration work (ML-DSA, hybrid signatures).
PSD2 dynamic linking, FFIEC or PCI DSS experience.
Standards contributions (IETF, FIDO Alliance, W3C) or open-source crypto work.
Application Question(s):
- Q1. What is your Total Experiece?
- Q2. What is your Relevant Experience?
- Q3. What is your Notice Period?
- Q4. What is your Current CTC?
- Q5. What is your Expected CTC?
Experience:
- lead Security & Cryptography: 8 years (Required)
Work Location: Remote