Photo: CMoAGeorgia (CC BY-SA 4.0)
Job description
The work splits between building new encryption protocols and probing existing ones for weaknesses, often by actively trying to break or exploit them before someone else does. Cryptographers also collaborate closely with software engineers to make sure a protocol that works in theory actually holds up when implemented in real systems, and they track emerging threats, like advances in computing that could someday undermine current encryption standards. It's research-heavy work, usually requiring a Master's or PhD in mathematics or computer science, and can lead to positions at tech companies, security firms, or government agencies with a codebreaking mission, like the NSA.
Pros
- Strong pay even at entry level, with a ceiling reaching $200k
- Standard 40-50 hour week, lighter than many other high-paying technical fields
- Deeply intellectual work solving abstract problems with real-world security stakes
Cons
- A master's or PhD in mathematics or computer science is typically required, a long credentialing path
- Sustained, deep concentration on abstract problems for long stretches isn't for everyone
- Flawed work can compromise security at massive scale, a heavy weight of responsibility
A typical day
The morning's work lives on a whiteboard: a proposed authentication protocol drawn as message flows, and the cryptographer's job is to attack it on paper — what happens if an adversary replays this message, or controls the clock, or has a quantum computer in ten years? A proof that resisted all week finally yields to a reframing borrowed from a 2019 paper. Afternoons ground the math in reality: reviewing an engineering team's implementation, where the algorithm is fine but the random number generation isn't — the kind of gap between theory and code where real systems break. A reading-group session on lattice-based schemes closes the day, because the field's frontier (post-quantum migration especially) moves fast enough that standing still means falling behind.
Tasks at the job
- Design and analyze algorithms for encrypting, decrypting, or securing data and communications.
- Test cryptographic systems for vulnerabilities by attempting to break or exploit them.
- Collaborate with software engineers to implement cryptographic protocols correctly in real systems.
- Research emerging threats, such as advances in computing that could undermine current encryption standards.
- Write technical papers or documentation describing new algorithms or findings.
- Advise organizations on cryptographic standards and compliance requirements.
Workplace & working conditions
Work happens almost entirely at a computer in an office or research lab setting, involving long stretches of mathematical and computational analysis with minimal physical activity.
The work is intellectually demanding and requires sustained, deep concentration on abstract problems, with real-world stakes since flawed cryptography can compromise security at massive scale.
Education necessary or common
Master's or PhD in mathematics, computer science, or a related field is typical, especially for research roles
Common college majors
Career path
Related fields
Courses to take
- AP Calculus BC — the entry fee to serious mathematics
- AP Computer Science A — implementations matter as much as proofs
- AP Statistics — probability is cryptography's native language
- Number theory/discrete math electives — the actual subject, take any available
- AP Physics — helpful context for quantum computing threats
Clubs, activities & competitions
- Math team and AMC/AIME competitions — the field's traditional pipeline
- USACO or CyberPatriot
- Capture-the-flag (CTF) competitions — picoCTF is built for high schoolers and includes crypto challenges
- Science fair with a mathematics project
First steps you can take now
- Do picoCTF's cryptography challenges this month — free and genuinely instructive
- Implement a classical cipher (Caesar, Vigenère) in code, then break it
- Learn modular arithmetic — it underlies almost everything in the field
- Read about how RSA works end-to-end and explain it to a friend
