Senior PKI & Certificate Management Engineer

Job Title: Senior PKI & Certificate Management Engineer

Job Category: Cybersecurity

Position Overview

We are seeking an experienced Senior PKI & Certificate Management Engineer to manage enterprise Public Key Infrastructure (PKI), SSL/TLS certificates, encryption keys, and certificate lifecycle automation. The ideal candidate will have hands-on experience with enterprise certificate management platforms, Hardware Security Modules (HSMs), cloud key management services, and security automation.

The role involves ensuring secure certificate issuance, renewal, revocation, monitoring, and compliance across enterprise infrastructure, applications, and cloud environments.

Key Responsibilities

• Manage the end-to-end SSL/TLS certificate lifecycle, including certificate issuance, renewal, revocation, installation, and automation.

• Administer PKI platforms and Certificate Authorities (CAs), including Microsoft CA, Venafi, DigiCert, Entrust, and Sectigo.

• Manage Enterprise Key Management (EKM), cryptographic keys, HSMs, and key rotation processes.

• Implement certificate discovery, inventory, monitoring, expiration alerts, and renewal automation.

• Support cloud-based key management services such as Azure Key Vault, AWS Key Management Service (KMS), and Google Cloud KMS.

• Troubleshoot certificate-related issues affecting applications, servers, APIs, network devices, and enterprise services.

• Automate certificate and key management processes using PowerShell, Python, Bash, or REST APIs.

• Ensure compliance with security policies, cryptographic standards, and applicable regulatory requirements.

• Collaborate with Security, Infrastructure, Application, and DevOps teams to integrate certificate management into enterprise environments.

• Support certificate and key management within hybrid cloud and on-premises environments.

• Integrate certificate management practices into DevSecOps and CI/CD pipelines where applicable.

• Support certificate and secret management for Kubernetes environments.

Required Qualifications

• 5+ years of hands-on experience in certificate management and PKI administration, with 6-8 years of overall relevant experience preferred.

• Strong understanding of PKI architecture, SSL/TLS protocols, X.509 certificates, Certificate Signing Requests (CSRs), and Certificate Authorities.

• Practical experience managing the certificate lifecycle, including issuance, renewal, revocation, deployment, and troubleshooting.

• Hands-on experience with one or more enterprise PKI or certificate management platforms, such as Venafi, DigiCert, Entrust, Sectigo, or Microsoft PKI.

• Experience with Enterprise Key Management solutions, including Azure Key Vault, AWS KMS, or equivalent platforms.

• Knowledge of HSM technologies such as Thales, SafeNet, or Luna HSM.

• Understanding of cryptographic algorithms and standards, including RSA, ECC, AES, and SHA-256.

• Scripting experience using PowerShell, Python, or Bash for automation.

• Knowledge of certificate discovery, expiration monitoring, alerting, and automated renewal processes.

Preferred Qualifications

• Experience supporting hybrid cloud environments across Azure, AWS, or Google Cloud Platform.

• Knowledge of DevSecOps practices and CI/CD integration.

• Experience managing certificates and secrets in Kubernetes environments.

• Familiarity with enterprise security governance, cryptographic key rotation, and security compliance requirements.

• Relevant certifications, such as CISSP, AZ-500 (Microsoft Azure Security Engineer), or a recognized PKI professional certification.