Staff Cryptography Engineer

Employee Applicant Privacy Notice

Who we are:

Shape a brighter financial future with us.

Together with our members, we’re changing the way people think about and interact with personal finance.

We’re a next-generation financial services company and national bank using innovative, mobile-first technology to help our millions of members reach their goals. The industry is going through an unprecedented transformation, and we’re at the forefront. We’re proud to come to work every day knowing that what we do has a direct impact on people’s lives, with our core values guiding us every step of the way. Join us to invest in yourself, your career, and the financial world.

The role

We are looking for a Staff Cryptography Engineer to help lead SoFi’s enterprise readiness for post-quantum cryptography and long-term cryptographic resilience. This role sits within our Security Assurance organization and will partner closely with security, engineering, infrastructure, product, and business stakeholders to assess, modernize, and strengthen cryptographic controls across the enterprise.

This is a highly cross-functional and strategic role. The ideal candidate brings deep applied cryptography expertise, strong engineering and architecture judgment, and the ability to drive complex security initiatives in ambiguous environments. You will help build SoFi’s cryptographic inventory, identify where cryptographic keys, protocols, algorithms, certificates, and libraries are used, and guide teams through the implementation of quantum-resistant and crypto-agile solutions.

What you’ll do

• Lead efforts to assess and improve SoFi’s enterprise cryptographic posture, with a focus on post-quantum cryptography preparedness and crypto-agility.

• Build and maintain an inventory of cryptographic assets, including keys, certificates, algorithms, protocols, libraries, services, and business-critical systems.

• Partner with product, engineering, infrastructure, cloud, and security teams to identify cryptographic dependencies and prioritize remediation or migration needs.

• Provide deep technical guidance on SSL/TLS, PKI, certificates, key management, encryption, cryptographic algorithms, and secure protocol usage.

• Define and document cryptographic standards, design patterns, review gates, and implementation guidance for engineering and product teams.

• Evaluate current and future cryptographic risks, including quantum-resistant key migration, algorithm deprecation, certificate lifecycle management, and insecure implementation patterns.

• Review product and platform architecture designs to identify cryptographic risks and recommend practical, scalable security improvements.

• Translate complex cryptographic concepts into clear guidance, roadmaps, and decision points for technical and non-technical stakeholders.

• Drive cross-functional execution across teams without direct authority, ensuring ownership, timelines, and risk decisions are clearly documented.

• Support security assurance activities, including threat modeling, architecture reviews, control validation, and post-review follow-through.

• Stay current on post-quantum cryptography developments, industry standards, and emerging security guidance, and translate relevant changes into actionable plans for SoFi.

What you’ll need

• 8+ years of experience in security engineering, product security, applied cryptography, security architecture, infrastructure security, or a related technical security discipline.

• Experience with post-quantum cryptography, crypto-agility, or cryptographic migration planning.

• Deep hands-on expertise in applied cryptography, including cryptographic algorithms, secure protocol design (e.g., SSL/TLS, mTLS, M2M), and the practical implementation and lifecycle management of enterprise-grade solutions such as HSMs, KMS, secrets management, and PKI programs.

• Experience assessing or designing cryptographic controls in production engineering environments, including cloud, distributed systems, services, APIs, or enterprise platforms.

• Strong understanding of public cloud environments and how cryptographic controls are implemented across infrastructure, applications, services, and data flows.

• Ability to review technical architecture and identify practical cryptographic risks, implementation gaps, and secure design alternatives.

• Experience creating or driving security standards, technical guidance, inventories, roadmaps, or enterprise-wide security initiatives.

• Strong communication skills, with the ability to explain complex cryptographic concepts to engineering, product, security, risk, and business stakeholders.

• Demonstrated ability to operate independently in ambiguous problem spaces and drive cross-functional work from discovery through execution.

• Strong project ownership and prioritization skills, including the ability to identify stakeholders, define milestones, document decisions, and manage follow-through.

• Bachelor’s degree in computer science, cybersecurity, engineering, mathematics, or a related field, or equivalent practical experience.

Nice to have

• Experience in financial services, fintech, banking, payments, cloud, SaaS, or other highly regulated technical environments.

• Familiarity with NIST, FIPS, PCI, or other security and cryptographic standards relevant to financial services.

• Experience partnering with product security, application security, infrastructure, platform engineering, or enterprise architecture teams.

• Experience building or leading cryptographic inventories, key-management programs, or encryption modernization efforts.

• Advanced degree or specialized training in cryptography, computer science, mathematics, or information security.

• Experience mentoring security engineers or influencing security architecture practices across multiple teams.

Compensation and Benefits

The base pay range for this role is listed below. Final base pay offer will be determined based on individual factors such as the candidate’s experience, skills, and location.

To view all of our comprehensive and competitive benefits, visit our Benefits at SoFi page!

SoFi provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion (including religious dress and grooming practices), sex (including pregnancy, childbirth and related medical conditions, breastfeeding, and conditions related to breastfeeding), gender, gender identity, gender expression, national origin, ancestry, age (40 or over), physical or medical disability, medical condition, marital status, registered domestic partner status, sexual orientation, genetic information, military and/or veteran status, or any other basis prohibited by applicable state or federal law.

The Company hires the best qualified candidate for the job, without regard to protected characteristics.

Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

New York applicants: Notice of Employee Rights

SoFi is committed to an inclusive culture. As part of this commitment, SoFi offers reasonable accommodations to candidates with physical or mental disabilities. If you need accommodations to participate in the job application or interview process, please let your recruiter know or email accommodations@sofi.com.

Due to insurance coverage issues, we are unable to accommodate remote work from Hawaii or Alaska at this time.

Internal Employees

If you are a current employee, do not apply here - please navigate to our Internal Job Board in Greenhouse to apply to our open roles.