Senior PKI / API Digital Signature Engineer — X.509, XMLDSig / WS-Security / JWS

BPM Advisors, LLC is assembling a U.S.-based technical team for an enterprise public-sector modernization engagement. The successful consultant will design and implement a digital-signature security model for an existing enterprise API-management/proxy service.

Responsibilities:

• Design and implement a digital-signature security model for an existing enterprise API-management/proxy service
• Evaluate technically appropriate approaches—such as XML Digital Signature, WS-Security, JWS, signed JWT, X.509-based request/message signing, or an equivalent standard
• Designing, implementing, testing, documenting, and supporting the selected solution

Requirements:

• At least 12 full months during the last 24 months personally designing, developing, and implementing a data-integration or API solution using PKI asymmetric cryptography for digital signatures
• Production implementation of message-level or transaction-level signing and signature validation. TLS/SSL transport encryption by itself does not qualify
• Use of cryptographic keys/certificates issued by a trusted Certificate Authority or validated identity provider
• Hands-on implementation of at least one relevant signing approach, such as: XML Digital Signature / XMLDSig, WS-Security / SOAP message signing, JWS, Signed JWT, X.509 request or payload signing, Equivalent enterprise transaction-signing implementation
• Experience implementing signature generation, verification, certificate-chain validation, error/failure handling, and security logging
• Experience integrating security controls into an API, SOAP/XML service, middleware layer, proxy, or other application-to-application data exchange
• Ability to provide exact client/project dates and a client or manager who can verify the qualifying experience
• Java-based enterprise applications
• SOAP/XML services
• API gateways or API proxy/controller services
• WebSphere or comparable enterprise application servers
• X.509 certificate lifecycle management
• Secure private-key storage
• HSMs, enterprise vaults, Azure Key Vault, HashiCorp Vault, or equivalent
• Key rotation, backup, recovery, revocation, and certificate renewal
• HTTP/API security testing tools
• Audit logging and transaction traceability
• Regulated government, criminal-justice, financial, healthcare, or similarly sensitive environments
• CJIS requirements