AWS Cryptography Architect

Must Have

Design the end‑to‑end encryption solution for sensitive workloads on AWS (technical architecture, operating model, governance framework).

Integrate AWS KMS, XKS, CloudHSM with Thales HSMs and SG’s security ecosystem.

Ensure solution alignment with SG’s cloud, cybersecurity, and compliance standards.

Define dependency mapping, lifecycle management, and disaster recovery/BCP for key‑management services.

Good To have

Validation & Cross‑Team Alignment

Present and validate the solution with Architecture teams, Security teams, and Cloud Governance.

Facilitate design reviews, architecture boards, risk assessments, and cryptographic compliance checks.

Ensure full traceability of decisions, risks, and technical controls.

Roles And Responsibility

 Deployment, Automation & Documentation

 Deploy and configure AWS KMS, XKS, CloudHSM environments and Thales integrations.

 Automate deployment pipelines using CI/CD, infrastructure-as-code, and DevOps tooling.

 Produce complete documentation (HLD, LLD, runbooks, standard operating procedures, security controls).

 Build dashboards and monitoring for service health, key usage, and compliance adherence.

 Proof of Concept (POC) & Scalability Validation

 Execute a POC using a real-use case.

 Evaluate performance, scalability, operational flows, and integration reliability.

 Provide recommendations for optimization, security hardening, and operational efficiency.

 Production Rollout & Service Enablement

 Lead the service transition from POC to production-ready state.

 Ensure the solution meets internal cloud platform criteria:

 operational readiness

 monitoring/alerting

 secure CI/CD pipelines

 service governance requirements

 Build operational workflows with OSM, Operations, Cloud, and Security teams.