Join a team where you can play a crucial role in shaping the future of a world-renowned company and make a direct and meaningful impact in a space designed for top performers. Drive significant business impact and tackle cybersecurity challenges that span multiple technology domains.
As a Senior Lead Security Engineer at JPMorganChase within the Cybersecurity, Technology and Controls organization, you are an integral part of an agile team that works to deliver software solutions that satisfy pre-defined functional and user requirements with the added dimension of preventing misuse, circumvention, and malicious behavior. Drive significant business impact through your capabilities and contributions and apply deep technical expertise and problem-solving methodologies to tackle a diverse array of cybersecurity challenges that span multiple technology domains.
Job responsibilities - Own the cryptography and key management strategy and roadmap across platforms and applications, including standards, reference architectures, and secure-by-default patterns covering encryption, signing, and key lifecycle
- Lead the design and development of key management and data protection capabilities, including hardware security module and key management service integrations, envelope encryption patterns, key hierarchies, rotation, revocation, backup/restore, and access controls
- Design and deliver applied cryptography solutions for data-at-rest, in-transit, and in-use use cases, balancing security, reliability, latency, and cost
- Establish and operate cryptographic key lifecycle controls encompassing key generation, storage, distribution, usage restrictions, rotation schedules, decommissioning/destruction, and audit logging/monitoring
- Partner with engineering teams to embed cryptography safely via reusable libraries and software development kits, secure configuration baselines, and migration plans away from legacy algorithms or unsafe implementations
- Own certificate and identity-related cryptography, including public key infrastructure and transport layer security guidance, certificate issuance/rotation automation, and mutual transport layer security patterns, while driving reductions in certificate and key operational risk
- Drive algorithm agility and post-quantum readiness by maintaining an inventory of cryptographic usage, defining upgrade paths, running proof-of-concepts, and planning staged migrations
- Advise stakeholders and senior business leaders during vulnerability periods, including risk assessment, compensating controls, prioritization, and clear decision options and tradeoffs
- Build shift-left security into the software development lifecycle and toolchain through threat modeling, secure design reviews, static and dynamic analysis, secret scanning, cryptographic misuse checks, and policy-as-code where applicable
- Lead security testing and assurance for cryptographic and key systems, including design reviews, attack simulations, penetration test coordination, validation of controls, and remediation ownership
- Improve engineering practices across the team through mentoring, code review standards, documentation and runbooks, operational readiness reviews, and incident learning
Required qualifications, capabilities, and skills - Formal training or certification on security engineering concepts and 5+ years applied experience
- Strong foundation in system design and applied cryptography, with demonstrated experience building secure systems
- Hands-on experience with key management concepts and implementations, including envelope encryption, key hierarchies, rotation, least-privilege access, segregation of duties, audit logging, and break-glass controls
- Proven ability to translate security and control requirements into engineering deliverables that are testable, observable, and auditable
- Advanced, hands-on Java experience with strong testing discipline and secure coding practices
- Experience designing and operating enterprise-grade services with reliability practices including service-level objectives, monitoring and alerting, capacity planning, and disaster recovery considerations
- Extensive experience with threat modeling, vulnerability discovery, and coordinating results from penetration testing and security assessments, with the ability to drive remediations to closure
- Demonstrated ability to lead cross-functional initiatives, drive adoption across multiple teams, and communicate risk and tradeoffs clearly to senior stakeholders
- Ability to review and validate AI-assisted security recommendations before adoption, escalate uncertainty, and ensure outcomes align with security, resiliency, and auditability expectations
Preferred qualifications, capabilities, and skills - Deep experience with hardware security modules and key management service platforms, including operational controls such as quorum/M-of-N, partitioning, backup/restore, upgrades, and incident response
- Experience with public key infrastructure and transport layer security at scale, including certificate automation, mutual transport layer security, cipher policy, rotation, and certificate revocation considerations
- Experience with secrets management and service-to-service authentication patterns
- Familiarity with post-quantum cryptography concepts and practical migration planning, including inventory management, algorithm agility, and staged rollout
- Demonstrated security-first and shift-left mindset through building guardrails and paved roads rather than solely conducting reviews
#CTC
ABOUT USJPMorganChase, one of the oldest financial institutions, offers innovative financial solutions to millions of consumers, small businesses and many of the world's most prominent corporate, institutional and government clients under the J.P. Morgan and Chase brands. Our history spans over 200 years and today we are a leader in investment banking, consumer and small business banking, commercial banking, financial transaction processing and asset management.
We offer a competitive total rewards package including base salary determined based on the role, experience, skill set and location. Those in eligible roles may receive commission-based pay and/or discretionary incentive compensation, paid in the form of cash and/or forfeitable equity, awarded in recognition of individual achievements and contributions. We also offer a range of benefits and programs to meet employee needs, based on eligibility. These benefits include comprehensive health care coverage, on-site health and wellness centers, a retirement savings plan, backup childcare, tuition reimbursement, mental health support, financial coaching and more. Additional details about total compensation and benefits will be provided during the hiring process.
We recognize that our people are our strength and the diverse talents they bring to our global workforce are directly linked to our success. We are an equal opportunity employer and place a high value on diversity and inclusion at our company. We do not discriminate on the basis of any protected attribute, including race, religion, color, national origin, gender, sexual orientation, gender identity, gender expression, age, marital or veteran status, pregnancy or disability, or any other basis protected under applicable law. We also make reasonable accommodations for applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. Visit our FAQs for more information about requesting an accommodation.
JPMorgan Chase & Co. is an Equal Opportunity Employer, including Disability/Veterans
ABOUT THE TEAMOur professionals in our Corporate Functions cover a diverse range of areas from finance and risk to human resources and marketing. Our corporate teams are an essential part of our company, ensuring that we're setting our businesses, clients, customers and employees up for success.
