PKI Engineer

Position Summary

We are seeking a skilled and motivated PKI Engineer to join our Infrastructure and Security team. This individual will be responsible for designing, administering, securing, and maintaining Public Key Infrastructure (PKI) environments. The role includes managing the lifecycle of digital certificates, certificate authorities, cryptographic services, and related security controls to ensure the confidentiality, integrity, and availability of enterprise systems and applications.

Key Responsibilities

• Manage and maintain enterprise PKI platforms, including Certificate Authorities (CAs), Registration Authorities (RAs), Hardware Security Modules (HSMs), OCSP responders, and certificate enrollment services.
• Oversee certificate lifecycle management, including issuance, renewal, revocation, and replacement of digital certificates for users, devices, applications, servers, cloud services, and network infrastructure.
• Implement and enforce PKI security controls, certificate policies, certificate practice statements, and cryptographic standards.
• Design, deploy, and support automated certificate management solutions using tools and technologies such as Microsoft AD CS, Venafi, Keyfactor, DigiCert, ACME, and scripting/automation platforms.
• Manage cryptographic key generation, storage, rotation, escrow, and retirement processes.
• Troubleshoot and resolve certificate-related issues affecting applications, websites, VPNs, and authentication services.
• Develop and maintain PKI architecture documentation, operational procedures, governance standards, and technical diagrams.
• Participate in security assessments, incident investigations, vulnerability remediation efforts, and infrastructure modernization initiatives.

Required Qualifications

• 3-5+ years of experience in PKI engineering, information security, cybersecurity, or infrastructure security.
• Hands-on experience administering Microsoft Active Directory Certificate Services (AD CS) or similar enterprise PKI solutions.
• Strong understanding of PKI concepts, certificate lifecycle management, SSL/TLS, X.509 certificates, and cryptographic principles.
• Experience with certificate enrollment, issuance, renewal, revocation, and validation processes.
• Knowledge of Hardware Security Modules (HSMs) and cryptographic key management practices.
• Experience with PowerShell or other scripting and automation tools.
• Strong troubleshooting, analytical, and technical documentation skills.

Preferred Qualifications

• Experience with enterprise certificate management platforms such as Venafi, Keyfactor, or DigiCert.
• Familiarity with cloud-based certificate management services in Azure, AWS, or Google Cloud Platform.
• Knowledge of Zero Trust security principles and modern authentication technologies.
• Understanding of security compliance frameworks and risk management practices.
• Experience supporting large-scale enterprise infrastructure environments.

Education & Certifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent professional experience.
• Security certifications such as Security+, CISSP, GSEC, or equivalent preferred.
• Microsoft security, identity, or cloud certifications are a plus.

Key Skills

• Public Key Infrastructure (PKI) Administration
• Certificate Lifecycle Management
• Cryptography & Key Management
• SSL/TLS Security
• Certificate Automation & Governance
• Security Compliance & Risk Management
• Technical Documentation
• Incident Analysis & Troubleshooting
• PowerShell Scripting & Automation

Additional Information

• Ability to participate in planned maintenance windows, certificate renewals, and incident response activities as needed.
• Occasional after-hours support may be required.
• Experience working in complex enterprise environments is highly preferred.