Senior Encryption Specialist

🏗 We're Hiring: Senior Encryption Specialist

📍 Location: United Arab Emirates (Remote)

🕒 Employment Type: Full-Time

💼 Experience Level: Mid-Level to Senior

🌐 Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through disciplined contract management, operational excellence, robust information security, and collaborative project delivery. Our distributed teams operate across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership.

Protecting sensitive information, intellectual property, financial records, engineering designs, commercial agreements, and project documentation is essential to maintaining business continuity and stakeholder trust. We are committed to implementing strong encryption controls, effective cryptographic governance, and secure data protection practices across our enterprise technology environment.

The Role

We are seeking an experienced Senior Encryption Specialist to design, implement, maintain, and improve enterprise encryption capabilities across on-premises infrastructure, cloud platforms, business applications, databases, endpoints, networks, and data storage environments.

The successful candidate will oversee encryption standards, cryptographic implementations, encryption key lifecycle management, data protection controls, certificate-related security requirements, and cryptographic risk assessments. The role will focus on protecting data at rest, in transit, and, where technically supported and appropriate, in use.

Working closely with Cybersecurity, Infrastructure, Cloud Engineering, Application Development, Database Administration, Network Engineering, Identity and Access Management (IAM), Compliance, Legal, and Risk Management teams, the specialist will ensure that encryption technologies are deployed securely, managed consistently, and aligned with organizational security policies and applicable United Arab Emirates requirements.

Key Responsibilities1. Enterprise Encryption Strategy and Architecture

• Develop, implement, and maintain enterprise encryption policies, standards, procedures, and technical guidelines.
• Design encryption architectures that protect sensitive information across enterprise applications, infrastructure, cloud environments, databases, endpoints, and network communications.
• Establish approved encryption requirements for data at rest, data in transit, backups, removable media, and other relevant storage and communication channels.
• Define cryptographic standards for symmetric encryption, asymmetric encryption, hashing, digital signatures, and secure key exchange.
• Recommend appropriate cryptographic algorithms, key sizes, operating modes, and protocol configurations based on established standards and organizational requirements.
• Ensure that encryption implementations use approved, well-maintained cryptographic libraries and supported security technologies.
• Review existing encryption architectures to identify weaknesses, inconsistent implementations, obsolete algorithms, and unnecessary cryptographic complexity.
• Develop reference architectures for application encryption, database encryption, storage encryption, file encryption, and secure communications.
• Establish requirements for cryptographic separation of duties, access restrictions, key ownership, and administrative oversight.
• Support encryption design reviews for new applications, infrastructure deployments, cloud migrations, and enterprise technology projects.
• Evaluate emerging cryptographic technologies and recommend improvements based on security effectiveness, compatibility, performance, and operational requirements.
• Maintain encryption architecture documentation, implementation standards, design decisions, and technology inventories.

2. Cryptographic Key Management

• Design and administer processes for the secure generation, distribution, storage, use, rotation, backup, recovery, revocation, and destruction of cryptographic keys.
• Implement key management controls using approved Key Management Systems (KMS), Hardware Security Modules (HSMs), and cloud-native key management services.
• Establish key ownership, classification, access permissions, permitted usage, rotation schedules, and lifecycle requirements.
• Ensure that cryptographic keys are protected from unauthorized disclosure, modification, replacement, or destruction.
• Enforce separation between encryption keys and the data they protect wherever required by the security architecture.
• Configure key access policies according to least-privilege principles and approved business requirements.
• Support envelope encryption and secure key hierarchy designs where appropriate.
• Maintain accurate inventories of cryptographic keys, their associated systems, key owners, expiration dates, and lifecycle status.
• Identify unmanaged, duplicated, obsolete, exposed, or inadequately protected cryptographic keys.
• Implement procedures for emergency key revocation and replacement following suspected compromise or security incidents.
• Support secure backup and recovery of critical key material in accordance with approved business continuity requirements.
• Ensure that key destruction processes prevent further use of retired keys and follow applicable retention and recovery requirements.
• Coordinate with system owners to assess the impact of key rotation, revocation, and recovery activities on dependent applications and services.
• Maintain audit trails for key management operations and investigate unauthorized or unusual key-related activity.

3. Hardware Security Modules and Key Protection

• Administer and support enterprise Hardware Security Modules used to protect cryptographic keys and perform sensitive cryptographic operations.
• Configure HSM security policies, administrative roles, access controls, cryptographic partitions, and approved integration mechanisms.
• Support HSM deployments across data centers and cloud environments where required.
• Ensure that HSM configurations follow approved security baselines and vendor recommendations.
• Manage cryptographic key generation and storage within approved hardware-backed security boundaries.
• Support integration between HSMs, enterprise KMS platforms, certificate services, databases, and security applications.
• Monitor HSM availability, capacity, performance, health, and security events.
• Coordinate firmware updates, configuration changes, maintenance, and security testing in accordance with approved change management procedures.
• Support HSM backup, replication, recovery, and high-availability arrangements where applicable.
• Maintain secure procedures for HSM administration, operator authorization, recovery operations, and emergency access.
• Investigate HSM errors, failed cryptographic operations, access issues, and integration problems.
• Coordinate with vendors and technical teams to resolve HSM-related security and operational issues.

4. Data-at-Rest Encryption

• Implement and maintain encryption controls for sensitive information stored in enterprise databases, file systems, storage platforms, endpoints, backups, and cloud services.
• Support database encryption mechanisms, including Transparent Data Encryption (TDE), where appropriate and supported.
• Configure disk, volume, file, and object storage encryption according to approved security requirements.
• Ensure that laptops, workstations, removable media, and other applicable endpoints use approved full-disk or file-level encryption.
• Validate encryption coverage for servers, virtual machines, cloud storage, backup repositories, and disaster recovery environments.
• Work with Infrastructure and Storage teams to protect data hosted on enterprise storage arrays, network-attached storage, and storage area networks.
• Ensure that encryption controls cover sensitive project drawings, engineering documents, contracts, financial records, employee information, and confidential commercial data.
• Assess encryption requirements for data archives, long-term storage, exported datasets, and transferred project documentation.
• Verify that encryption keys are appropriately protected and that access to encrypted data is restricted to authorized users and services.
• Identify unencrypted or inconsistently protected data repositories and coordinate remediation with relevant system owners.
• Evaluate the performance and operational impact of data-at-rest encryption before major deployments.
• Maintain records of encryption configurations, exceptions, coverage assessments, and remediation activities.

5. Data-in-Transit Encryption and Secure Communications

• Implement and maintain encryption controls for communications between users, applications, servers, databases, APIs, and cloud services.
• Configure and validate Transport Layer Security (TLS) for approved network communications.
• Review certificate chains, trust relationships, protocol versions, cipher suites, and server authentication configurations.
• Identify and remediate the use of deprecated protocols, weak cipher suites, insecure communication channels, and improperly configured certificates.
• Support secure communications between internal systems, external service providers, contractors, consultants, and business partners.
• Coordinate with Network and Infrastructure teams to secure administrative connections, remote access channels, service integrations, and inter-system communications.
• Support encrypted data transfer mechanisms for sensitive financial, commercial, engineering, and project information.