Sr. PKI Engineer

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Sr. PKI Engineer based in the United States (Remote). As a Senior PKI Engineer, you will play a critical role in maintaining and strengthening enterprise-wide public key infrastructure and certificate management services. You will ensure the security, availability, and reliability of certificate lifecycle operations across a complex technology environment. Working with Microsoft Active Directory Certificate Services, enterprise certificate management platforms, and hardware security module solutions, you will troubleshoot issues and maintain essential cryptographic services. You will also contribute to automation initiatives, operational improvements, and the continued development of enterprise cryptographic capabilities. Collaborating with infrastructure, application, networking, and key management teams, you will help protect sensitive systems and ensure secure digital communications. This high-impact role offers the opportunity to apply deep technical expertise in a remote environment while supporting critical security operations and strengthening enterprise resilience.

PKI Infrastructure Administration: Operate, maintain, and support Microsoft Active Directory Certificate Services (AD CS), including issuing certificate authorities, certificate templates, enrollment services, automatic enrollment, Network Device Enrollment Service (NDES), and certificate revocation list (CRL) publication. Certificate Lifecycle Management: Administer enterprise certificate lifecycle management platforms, such as Venafi Trust Protection Platform or Keyfactor Command, managing certificate inventories, processing requests, coordinating renewals, and troubleshooting platform integrations. Cryptographic Services Support: Work with Fortanix Data Security Manager and other hardware security module (HSM)-backed services to resolve access, connectivity, and cryptographic key usage issues in collaboration with the teams responsible for those platforms. Certificate Troubleshooting: Investigate and resolve issues involving certificate issuance, renewals, trust chains, revocation, NDES enrollment, private key access, and certificate validation. Infrastructure Health and Maintenance: Perform routine PKI health checks, patching, maintenance, backup operations, and recovery testing to maintain service availability, security, and operational reliability. Certificate Expiration Management: Monitor certificate expiration alerts and coordinate timely renewals with application owners, infrastructure teams, and other relevant stakeholders to prevent service disruptions. Automation and Scripting: Maintain and improve PowerShell scripts, scheduled tasks, reporting tools, and existing automation processes to streamline certificate management and reduce manual operational effort. Certificate Management Infrastructure: Maintain certificate lifecycle management (CLM) and Certificate Lifecycle Management as a Service (CLaaS) infrastructure, ensuring consistent and reliable service delivery. Cloud Cryptographic Services: Support cryptographic management capabilities in Microsoft Azure and Amazon Web Services (AWS), helping maintain secure certificate and key management across cloud environments. Network and Application Integration: Support certificate configuration and management across content delivery networks (CDNs), web application firewalls (WAFs), network load balancers, and Azure Application Gateways. Operational Documentation and Compliance: Maintain accurate certificate records, technical documentation, operational runbooks, and maintenance procedures. Support audits, change management activities, and incident response. Root Certificate Authority Operations: Support offline root certificate authority ceremonies, maintenance activities, and associated operational controls to preserve the integrity of the certificate hierarchy. Service Reliability and Security: Ensure established PKI services remain secure, available, well-documented, and operationally stable while identifying opportunities for continuous improvement. Requirements Enterprise PKI Experience: Strong hands-on experience administering Microsoft Active Directory Certificate Services (AD CS) in an enterprise environment, including practical knowledge of NDES. Certificate Lifecycle Management: Experience administering enterprise certificate lifecycle management platforms such as Venafi Trust Protection Platform or Keyfactor Command. HSM and Key Management Knowledge: Working knowledge of Fortanix Data Security Manager or comparable hardware security module solutions, including how PKI services interact with protected cryptographic keys. Direct responsibility for administering the HSM platform is not required. Cryptographic Fundamentals: Strong understanding of X.509 certificates, certificate chains, enrollment processes, revocation, Transport Layer Security (TLS), and private key protection. PowerShell Scripting: Practical PowerShell scripting and troubleshooting skills, with the ability to maintain operational automation, scheduled tasks, and reporting processes. Infrastructure Troubleshooting: Ability to collaborate with Active Directory, DNS, networking, application, and key management teams to diagnose and resolve complex certificate-related issues. Cloud Security Knowledge: Understanding of cryptographic management and certificate services within Microsoft Azure or AWS environments. Network Security Technologies: Experience configuring and managing certificates across CDNs, WAFs, network load balancers, and Azure Application Gateways. Production Operations: Experience supporting production environments, following change control procedures, maintaining operational documentation, and responding to service incidents. Offline Root CA Operations: Knowledge and experience with offline root certificate authority ceremonies and associated maintenance procedures. Preferred Qualifications: Experience supporting code-signing certificates or publicly trusted TLS certificates. Preferred Operational Knowledge: Familiarity with PKI backup and recovery procedures, certificate authority resilience, and audit requirements. Communication and Collaboration: Strong analytical and problem-solving skills, attention to detail, and the ability to communicate effectively with technical stakeholders across multiple infrastructure and security disciplines. Security Mindset: A proactive approach to risk management, operational reliability, documentation accuracy, and the protection of enterprise cryptographic assets. Benefits Competitive Base Salary: Annual starting salary ranging from $101,900 to $132,800 , depending on qualifications, experience, market conditions, and other business considerations. Medical, Dental, and Vision Insurance: Access to healthcare coverage supporting employees' overall well-being. Remote Flexibility: A remote-friendly work environment offering flexibility in where you work within the United States. Retirement Savings: A 401(k) program with employer matching. Flexible Paid Time Off: Flexible PTO to support work-life balance and personal needs. Paid Parental Leave: Generous parental leave benefits to support employees and their families. Wellness Programs: Resources and initiatives designed to promote physical and mental well-being. Pet Insurance: Access to insurance options for eligible pets. Legal and Identity Protection: Benefits designed to support personal legal needs and identity security. Tuition Reimbursement: Financial assistance for eligible educational and professional development opportunities. Charitable Giving Support: A Donations for Doers program supporting employees' charitable and community involvement. Meaningful Technical Impact: The opportunity to maintain and improve enterprise security infrastructure that protects critical systems and digital communications. Professional Development: Opportunities to deepen expertise in PKI, certificate lifecycle management, cloud cryptography, and enterprise security operations.