Data Security and Encryption Engineer

Location: Praha, CzechiaThales people architect identity management and data protection solutions at the heart of digital security. Business and governments rely on us to bring trust to the billions of digital interactions they have with people. Our technologies and services help banks exchange funds, people cross borders, energy become smarter and much more. More than 30,000 organizations already rely on us to verify the identities of people and things, grant access to digital services, analyze vast quantities of information and encrypt data to make the connected world more secure.Thales in the Czech Republic employs over 400 people from 45 different nationalities. A total of 15 teams work on projects for government agencies, banking, mobile services and the Internet Of Things (IoT) technology. At the core of our business is the development of software which we configure and embed in a multitude of different devices and form factors. These include many kinds of payment cards, SIM cards, travel passes, secure eBanking devices, authentication tokens, machine identification modules (MIM), and secure ID documents including ePassports, eID and eHealth cards, as well as eDriving licenses. Because of the international environment surrounding us every day, it comes as no surprise that English is our official corporate language.

We are looking for an experienced Encryption, Key Management and HSM Engineer responsible for designing, implementing, integrating, and supporting enterprise security solutions involving encryption, cryptographic key management, databases, and network infrastructure. The ideal candidate should have strong hands-on experience with cryptographic technologies and the ability to troubleshoot complex integrations across applications, databases, HSMs, and networks.

Must-Have Skills

• 5+ years of experience in cybersecurity, infrastructure security, cryptography, key management or related technologies.
• Relevant security certifications such as CISSP, CCSP, Security+, vendor-specific HSM/KMS certifications, etc
• Experience in customer-facing consulting, implementation or technical support.
• Travel 50% of time
• EU National mandatory

Encryption & Cryptography

• Strong understanding of encryption concepts and cryptographic fundamentals.
• Hands-on knowledge of symmetric and asymmetric encryption.
• Understanding digital signatures, certificates and PKI.
• Understanding of encryption at rest and encryption in transit.
• Knowledge of TLS/SSL and certificate lifecycle management.

Key Management

• Strong understanding of cryptographic key lifecycle management.
• Key generation, rotation, storage, backup/recovery, archival and destruction.
• Experience with Key Management Systems (KMS).
• Understanding of key hierarchies, key wrapping and separation of duties.
• Knowledge of KMIP is highly desirable.

Networking

• Good understanding of TCP/IP, DNS, routing, firewalls and load balancers.
• Experience troubleshooting connectivity between applications, databases, KMS and HSM infrastructure.
• Understanding of TLS, ports, certificates and network-level troubleshooting.
• Ability to use tools such as ping, telnet, nc, curl, openssl, tcpdump or Wireshark.

Operating Systems / Troubleshooting

• Strong troubleshooting experience across Linux, networking, databases and security infrastructure.

• Good Linux/Unix administration skills.
• Basic Windows Server administration.
• Strong troubleshooting and log-analysis capabilities.
• Ability to analyze issues across application → network → database → KMS → HSM layers.
• Experience with AWS KMS, Azure Key Vault, OCI or Google Cloud KMS.

Nice-to-Have Skills

• Experience with Thales Luna HSM / Luna Network HSM.
• Experience with Thales CipherTrust Manager / Data Security Platform.
• Knowledge of PKCS#11, JCE, OpenSSL, CNG/CAPI.
• Experience with KMIP implementations.
• Experience with Oracle TDE / SQL Server TDE.
• Knowledge of cloud and hybrid-cloud encryption architectures.
• Experience with PKI, Certificate Authorities and certificate lifecycle automation.
• Experience working with enterprise customers and supporting production environments.

• Provide technical guidance on cryptographic key lifecycle and security best practices.

At Thales we provide CAREERS and not only jobs. With Thales employing 80,000 employees in 68 countries our mobility policy enables thousands of employees each year to develop their careers at home and abroad, in their existing areas of expertise or by branching out into new fields. Together we believe that embracing flexibility is a smarter way of working. Great journeys start here, apply now!