Sr Cryptography Analyst - Secrets Management

Job description

Individually we are people, but together we are Aviva. Individually these are just words, but together they are our Values – Care, Commitment, Community, and Confidence. At Aviva Canada , we put people first, our employees, our customers, and our communities. We’re proud of a culture built on care, inclusion, and collaboration, where your voice matters and your growth is supported. We’re not just about insurance; we’re about making a real difference by protecting what matters most. The Senior Cryptography Analyst plays a critical security role responsible for safeguarding Aviva Canada's cryptographic assets, ensuring the secure management of keys, secrets, and certificates, driving Post-Quantum Cryptography readiness, and providing governance and operational oversight of two business-critical 24x7 cryptographic services. This role serves as a trusted advisor on cryptographic strategy, compliance, operational excellence, and future-state cryptographic transformation. What you'll do Cryptography Governance & Advisory Act as the enterprise SME for cryptography, encryption, PKI, and secrets management. Advise teams on encryption strategies, cryptographic controls, and approved solutions. Develop and maintain cryptographic standards, procedures, and guidelines. Review solution designs and provide guidance on encryption at rest/in transit, key and secrets management, certificates, and algorithms. Support security architecture reviews and risk assessments. Encryption Key & Secrets Lifecycle Management Own governance and lifecycle management of enterprise encryption keys and secrets. Oversee key generation, storage, rotation, archival, and destruction. Manage HashiCorp Vault services and protect privileged secrets and cryptographic assets. Ensure compliance with industry standards and regulatory requirements. Define and monitor key management benchmarks and the efficiency of operations. HashiCorp Vault Service Ownership Provide administration and operational oversight of HashiCorp Vault platforms. Manage authentication, RBAC, access governance, secrets lifecycle, and tenant onboarding/offboarding. Support integrations with AWS KMS, HSMs, cloud secret stores, and automation platforms. Lead efforts to fix issues, incident resolution, and platform modernization initiatives. TLS Certificate Lifecycle & Automation Own TLS/SSL certificate governance and lifecycle management. Oversee certificate issuance, renewal, replacement, revocation, and retirement. Drive automation using ACME, Sectigo, Vault PKI, Cert-Manager, Kubernetes, and cloud-native services. Establish certificate standards for CAs, key lengths, algorithms, and ownership. Reduce manual processes through automation and continuous improvement. Post-Quantum Cryptography (PQC) Assessment & Readiness Lead enterprise PQC readiness assessments. Maintain visibility of cryptographic assets across applications, certificates, keys, and secrets. Assess PQC risks and develop transition and remediation strategies. Partner with architecture and engineering teams on migration planning. Monitor industry and regulatory developments in quantum-resistant cryptography. Operational Leadership & Service Management Provide operational leadership for TLS Certificate Management and HashiCorp Vault services. Oversee contractor resources, service delivery, and operational priorities. Monitor service performance, availability, incidents, and improvement opportunities. Ensure resilience, availability, and continuous service enhancement. Incident, Change & Critical Issue Management Function as the main point of contact for major incidents, emergencies, and service outages related to customer concerns. Participate in after-hours support and incident response. Lead root cause analysis and remediation of cryptography-related issues. Support change management, CAB activities, and proactive risk mitigation. HSM & Root of Trust Management Support enterprise HSM infrastructure, including Thales Luna HSM platforms. Manage auto-unseal configurations, root key protection, key rotation, and disaster recovery. Coordinate platform upgrades and lifecycle management. Maintain secure root-of-trust controls across cryptographic services. Compliance, Risk & Audit Governance Serve as the authority for enterprise cryptographic compliance and governance. Ensure alignment with security policies, regulations, audit requirements, and governance frameworks. Support audits and maintain compliance evidence and reporting. Identify and remediate cryptographic risks and control gaps. Monitoring, Reporting & Service Metrics Develop executive and operational reporting for cryptographic services. Track critical metrics covering Vault health, certificate management, automation, compliance, and PQC readiness. Leverage monitoring and reporting tools including Dynatrace, Rapid7, SiteScope, Power BI, and Excel. Provide insights to improve service performance and governance. What you'll bring Technical Expertise Extensive experience with HashiCorp Vault administration and governance. Strong PKI and TLS certificate lifecycle management experience. Experience implementing and supporting TLS certificate automation solutions. Experience performing Post-Quantum Cryptography assessments and readiness planning. Solid understanding of encryption standards, cryptographic algorithms, and key management practices. Experience with Hardware Security Modules (Thales Luna preferred). Knowledge of AWS cloud services and KMS technologies. Experience integrating cryptographic services into enterprise platforms and applications. Scripting and automation experience using APIs and CI/CD pipelines. Leadership & Governance Experience leading vendors, consultants, or contract resources. Ability to influence security and technology decisions across multiple teams. Strong understanding of regulatory, audit, and compliance requirements. Experience operating critical production services within a 24x7 environment. Strong incident and problem management experience. What makes you stand out Experience in insurance or financial services. Kubernetes and Cert-Manager experience. Cloud security and DevSecOps experience. PQC frameworks, standards, and industry transition planning experience. What you’ll get The salary band for this position ranges from $100,000 to $125,000. Please note that individual salary is determined by factors such as job-related knowledge, skills and experience, as well as internal equity. Compelling rewards package including base compensation, eligibility for annual bonus, retirement savings, share plan, health benefits, personal wellness, and volunteer opportunities. Outstanding Career Development opportunities. We’ll support your professional development education. Competitive vacation package with the option to purchase 5 extra days off per year. Employee driven programs focused on gender, LGBTQ+, origins, diversity, and inclusion. Corporate wellness programs to support our employees’ physical and mental health. Employee discount on home and auto insurance (where applicable). Hybrid flexible work model. This job advertisement is for an existing vacancy which has been posted both internally & externally. Aviva Canada may use AI (Artificial Intelligence) tools to assist us throughout the recruitment process to screen, assess or select applicants for a position. Aviva Canada welcomes applications from all qualified individuals and has a process in place to provide accommodations for persons with disabilities at all stages of the hiring process and during employment. If you require an accommodation during the interview or hiring process, please contact your Aviva Talent Acquisition Partner so that an appropriate accommodation can be arranged. #LI-PS1 #LI-Hybrid