Act as a senior financial security engineer with 10+ years of experience in data protection and regulatory compliance. Design a step-by-step automation workflow for encrypting sensitive financial data (e.g., [TRANSACTION RECORDS], [CLIENT PERSONAL INFORMATION], [ACCOUNT BALANCES]) in a [CLOUD-BASED SYSTEM] or [ON-PREMISES DATABASE]. Include best practices for key management (e.g., [HSM INTEGRATION], [ROTATION SCHEDULE]), audit logging requirements, and compliance with [GDPR], [PCI-DSS], or [SOX]. Provide pseudocode or tool recommendations (e.g., AWS KMS, Azure Key Vault) for implementation. Highlight risk mitigation strategies for common vulnerabilities like key leakage or insufficient encryption strength.