i'm not employed in the field, so this is mostly uninformed guessimation. a) there are companies working on products with tight security requirements. if this

i'm not employed in the field, so this is mostly uninformed guessimation. a) there are companies working on products with tight security requirements. if this is a respectable company, you'd probably spend most of your time examining and evaluating existing solutions and maybe review the use of said solutions by your own programmers. (i'd say this is usually more "security" than "cryptography" though) b) there are companies working on their own cryptography schemes. those are not per-se snake oil, but ... it's complicated. few have the resources and the structure to do this right. skype, for example, rolled their own closed source implementation. back then we've been told: "trade secret, but trust us, we've done it right and we had independent experts review this." c) security review: be the company/expert that skype hires to evaluate their cryptography while under an NDA (?) d) pen-testing: maybe? not sure if this is realistic. get paid to check company security (network, servers, general infrastructure) for weaknesses. they might employ cryptographers? e) research: probably the most likely area. crypto development usually has to happen in the open, otherwise it's not trustworthy. f) intelligence agencies. NSA and co.