Certificate Lifecycle Management (CLM) / PKI Automation Engineer to support the design and implementation of an enterprise certificate lifecycle management program utilizing Akeyless.
The contractor will help establish scalable processes for discovering, managing, issuing, renewing, rotating, provisioning, and validating TLS certificates across a diverse enterprise technology environment.
A critical focus of this engagement is last-mile certificate deployment.
The ideal candidate will have practical experience not only with PKI and certificate management platforms, but with the infrastructure that actually terminates TLS and presents certificates to clients. This includes web servers, application servers, reverse proxies, load balancers, application delivery controllers, network appliances, Windows and Linux systems, cloud services, containers, and other certificate-consuming endpoints.
The successful candidate should be capable of taking a certificate lifecycle from:
Discovery → Inventory → Issuance → Renewal → Deployment → Service activation/reload → Validation → Monitoring
The objective is to reduce manual certificate management and establish repeatable, secure automation for certificate rotation across heterogeneous infrastructure.
Primary Responsibilities
Akeyless CLM Implementation
Assist with architecture, configuration, testing, and implementation of Akeyless Certificate Lifecycle Management.
- Develop certificate issuance, renewal, rotation, provisioning, and revocation workflows.
- Work with Akeyless Gateway components deployed within on-premises environments.
- Configure and troubleshoot certificate targets and provisioning workflows.
- Help establish policies and controls supporting certificate lifecycle automation.
- Integrate Akeyless CLM with existing public and private certificate authorities.
Last-Mile Certificate Deployment
This is a core requirement of the role, not an ancillary responsibility.
The contractor will analyze how certificates are currently deployed and consumed across the enterprise and develop standardized approaches for delivering renewed certificates to their actual termination points.
Responsibilities include:
- Identify where TLS is actually terminated for discovered services.
- Determine the server, service, appliance, proxy, load balancer, ADC, ingress controller, or application responsible for presenting each certificate.
- Determine the certificate/key format and installation requirements of each platform.
- Design automated certificate deployment patterns appropriate to each technology.
- Automate installation of certificate, private key, and certificate chain where appropriate.
- Automate service reload/restart or equivalent activation mechanisms when required.
- Validate successful certificate replacement after deployment.
- Develop rollback and failure-handling approaches for certificate rotation.
- Troubleshoot certificate chains, SAN/CN mismatches, trust issues, permissions, TLS configuration, and failed deployments.
- Minimize or eliminate application downtime during certificate rotation.
Required Technical Skills
Certificate / PKI
Required:
- Strong understanding of PKI architecture and X.509 certificates
- TLS/SSL certificate lifecycle management
- Public and private Certificate Authorities
- Certificate signing requests (CSRs)
- Certificate chains and intermediate CAs
- Root and intermediate CA trust
- PEM, DER, PKCS#12/PFX and related certificate/key formats
- Certificate CN and Subject Alternative Names
- Private-key handling and security
- Certificate renewal, rotation and revocation
- TLS troubleshooting
- Certificate discovery and inventory
Akeyless
Strongly Preferred / Required:
Hands-on experience with Akeyless, particularly:
Akeyless Certificate Lifecycle Management
- Akeyless Gateway
- PKI Certificate Issuers
- Targets
- Certificate provisioning
- Certificate renewal/rotation
- Public/private CA integrations
- Akeyless CLI and/or APIs
- RBAC and authentication methods
- Events/audit logging
Akeyless describes its CLM architecture as supporting automatic issuance, renewal and endpoint provisioning, along with integrations including ACME, SCEP and EST.
Critical Last-Mile Infrastructure Skills
Candidates should have strong hands-on experience with multiple technologies commonly responsible for TLS termination.
Web / Application Servers
Experience with technologies such as:
Microsoft IIS
- NGINX
- Apache HTTP Server
- Tomcat / Java-based application servers
- Linux-hosted applications
- Windows-hosted applications
Load Balancers / ADC / Proxy Infrastructure
Experience with one or more:
- F5 BIG-IP
- NGINX / NGINX Plus
- HAProxy
- Reverse proxies
- Application Delivery Controllers
- Enterprise load balancers
- Cloud load balancing technologies
Desired experience includes:
- Kubernetes
- Ingress controllers
- Docker / containerized applications
- Cloud-native workloads
- API gateways
- Secrets management
- ACME-based certificate automation
Automation / Engineering Skills
Strong scripting and automation capability is required.
Preferred technologies:
- PowerShell
- Python
- Bash / shell scripting
- REST APIs
- JSON / YAML
- Infrastructure-as-Code concepts
- CI/CD pipelines
- API-driven infrastructure automation
The contractor should be comfortable developing automation that can:
1. Retrieve or receive issued certificates.
2. Securely deliver certificate and private-key material.
3. Convert certificate formats when necessary.
4. Install certificates into the destination technology.
5. Update bindings/configuration.
6. Reload or activate the service safely.
7. Validate the newly presented certificate.
8. Detect failure.
9. Generate useful logging/audit evidence.
10. Support appropriate recovery or rollback behavior.
Discovery and TLS Fingerprinting Skills
Given the state of the project, I would specifically include this requirement.
The contractor should be capable of determining where certificates are actually terminating across a large heterogeneous environment.
Desired experience with:
- Nmap
- OpenSSL
- PowerShell
- curl
- TLS handshake analysis
- DNS investigation
- HTTP header analysis
- Certificate CN/SAN analysis
- Network/service fingerprinting
- Load-balancer / reverse-proxy identification
- Certificate endpoint discovery
Preferred Experience
Ideal candidates will have:
- 7+ years of infrastructure/security engineering experience
- 5+ years working with PKI, certificates, TLS, or certificate management platforms
- Experience implementing enterprise CLM automation
- Direct production experience with Akeyless highly preferred
- Experience migrating organizations from manual certificate renewal to automated certificate lifecycle management
- Experience supporting large heterogeneous enterprise environments
- Experience integrating certificate automation with existing infrastructure rather than requiring applications to be redesigned
- Experience developing reusable deployment patterns across multiple application/server technologies
