Microsoft TDE Permissions For Changing Keys
ALTER DATABASE ENCRYPTION KEY

Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key.

You must also add view definition according to MSDN.

https://msdn.microsoft.com/en-us/library/bb630389%28v=sql.110%29.aspx