PKI Security Architect

Job Description:

* Lead the end-to-end architecture of enterprise PKI solutions including Root and Subordinate CA design, HSM integration, and secure CA lifecycle management.
* Architect and lead implementation of AD CS, offline Root CA operations, OCSP responders, CRL distribution, and template lifecycle. Experience in new PKi planning and implementation.
* Establish enterprise-wide cryptographic standards for TLS, code signing, device certs, and machine identity.
* Investigate, design and architect specific PKI cybersecurity controls as they are identified and required.
* Own and maintain PKI policies: Certificate Policy (P), Certification Practice Statement (CPS), and governance controls.
* Administer and manage the Microsoft PKI Certificate Authority.
* Integrate PKI with HSMs (Thales, SafeNet, Azure Key Vault HSM, AWS CloudHSM).
* Ensure strong algorithm standards (RSA/ECC), hashing policies, and deprecation of weak ciphers
* Lead troubleshooting of high-severity certificate outages across critical infrastructure.
* Perform root-cause analysis of cryptographic failures or expired certificate incidents.
* Develop enterprise incident-prevention strategies and certificate monitoring frameworks.
* Experience in planning and executing transition projects.
* Architect, deploy, and manage AppViewX CERT+ as the enterprise Certificate Lifecycle Management platform.
* Define enterprise standards for certificate discovery, issuance, renewal, revocation, and decommissioning.
* Implement strong governance for certificate ownership, tagging, expiry alerts, and compliance reporting.
* Enforce policies for key lengths, algorithms, validity periods, and security baselines.
* Integrate CLM with internal PKI (AD CS), external/public CAs, and cloud PKI
* Create and maintain operational runbooks, architecture diagrams, and process documentation for CLM tool
* Manage Incident and Problem Management activities based on ITIL guidelines.
* Provide guidance to technical teams, deliver training sessions, and establish comprehensive operational runbooks.
* Collaborate with security architects, compliance teams, and executive leadership.