HSM & Key Management Engineer (all genders)

You integrate hardware security modules and secure key processes into customer applications and infrastructure. This includes technical interfaces, high availability and controlled operational processes. You combine cryptographic foundations with responsibility for particularly sensitive keys.

An HSM becomes part of a solution through appropriate roles, applications and operational processes. You test PKCS#11 integrations, key attributes and session or connection errors. The generation, use, backup and retirement of important keys are documented. HA and failover must be tested with the connected application. Administrative procedures clarify who may perform which action and how sensitive changes are controlled.

• Select, integrate and commission HSMs and key-management solutions according to requirements.
• Connect applications through suitable interfaces such as PKCS#11 and test compatibility and failure cases.
• Translate the key lifecycle, separation of roles, backup and recovery into documented processes.
• Test HA, failover and maintenance scenarios and handle technical support cases together with customers and vendors.
• Test PKCS#11 integrations for session behaviour, key attributes and compatibility.
• Test HA, backup and recovery with defined roles and traceable approvals.

What matters is demonstrable experience that is relevant to the role. It may come from appropriate vocational training, a degree, professional practice or a well-founded career change. We will align the specific level of responsibility with your knowledge and experience.

• Experience with security, infrastructure or software integration and a solid understanding of cryptographic principles.
• Knowledge of key lifecycles, permissions and controlled administrative procedures.
• Ability to document sensitive work steps transparently and test them carefully.

This knowledge is helpful, but you do not need to have all of it at once. In your application, describe where you have already gained practical experience and which areas you would like to explore in greater depth.

• Experience with HSM products, PKCS#11, KMIP or cryptographic application integrations.
• Knowledge of high availability, PKI or regulated deployment environments.

You deliver reliable key processes and tested operating procedures. A working API call is not enough: responsibilities, key recovery and controlled changes must also be clarified.

This role can be based in Cologne or performed remotely. We will agree the specific form of collaboration, project requirements and any necessary customer appointments before you start.

This role is offered as permanent employment on a full-time or part-time basis. We will agree the responsibilities, working hours, start date and compensation to suit the role and your level of experience.

Show us in your application which experience or interests you bring to this role. A CV and relevant project examples, certificates or work samples will help us assess your professional background. Please do not send confidential customer data, credentials or protected source code.

Tell us your preferred working model, your possible start date and whether you would like to work full-time or part-time.

If you have questions about the role, contact our recruitment team at hr@otoko.com. Inclusion in the applicant pool is voluntary and takes place only with separate consent; it is not a prerequisite for reviewing your application.