How do i manage encryption keys with a cloud provider?
One approach to doing this is using end-to-end encryption, where the provider never has access to the keys. A system that uses proxy re-encryption (PRE) can allow each user to have her own keys, but admins can manage a group that represents the users for your company, so it is not necessary to re-encrypt all the files the company can access every time a new user is added or a user is removed.

A paper that describes this in detail is available here (this directs through my company's website to the ACM digital library - sorry for the extra hop, but it avoids the need to have ACM Digital Library access to get the paper). In summary, proxy re-encryption is a scheme originally designed to allow the delegation of encryption from one person to another. PRE schemes are based on public key cryptography, and they allow someone (the delegator) who has her own private key plus the public key of another person (the delegatee) to compute a re-encryption key. This key will allow ciphertexts encrypted to the delegator to be re-encrypted or transformed so that they can be decrypted using the delegatee's private key. This process does not allow the proxy or individual doing the transformation to decrypt the ciphertext.

If the delegator is an abstract entity that represents your company, and system administrators control access to that entity's private key, they can generate re-encryption keys to different users within the company. Revoking access is achieved by removing the re-encryption key between the company and an individual user.