Forward Deployed PKI Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead the implementation of ITVA's certificate lifecycle management capabilities in intricate enterprise customer environments.

• Integrate ITVA with enterprise certificate authorities, such as Microsoft Active Directory Certificate Services (AD CS) and commercial CA platforms.

• Deploy AI-driven certificate discovery, monitoring, troubleshooting, and lifecycle automation workflows.

• Automate the issuance, renewal, revocation, and deployment of certificates across various enterprise systems.

• Collaborate directly with customer security, infrastructure, and PKI teams to address operational challenges.

• Resolve complex PKI issues related to certificate chains, trust stores, TLS, mutual TLS, and enrollment protocols.

• Assist enterprises in assessing cryptographic risks and adapting to evolving security standards, including post-quantum cryptography.

• Work alongside ITVA's software engineering team to design and build product features, integrations, and automation capabilities.

• Convert intricate customer requirements into scalable product enhancements.

• Act as a trusted technical advisor for enterprise PKI modernization projects.

⛳️ Requirements

• Over 7 years of practical experience in enterprise PKI, certificate services, cryptographic infrastructure, or certificate lifecycle management.

• Profound knowledge of X.509 certificates, certificate chains, trust models, TLS, and mutual TLS.

• Extensive experience in managing Microsoft Active Directory Certificate Services (AD CS) or similar enterprise PKI systems.

• Strong understanding of certificate issuance, renewal, revocation, CRLs, OCSP, CSRs, and certificate templates.

• Experience overseeing certificates across Windows and Linux servers, enterprise applications, and networking infrastructures.

• Proven capability to independently troubleshoot complex PKI and cryptographic challenges.

• Familiarity with PowerShell, Python, Bash, or comparable scripting languages for automation purposes.

• Excellent communication skills with experience collaborating with enterprise customers or cross-functional teams.

• Interest in AI-driven security automation and emerging cryptographic technologies.

• Nice-to-have: Experience with certificate lifecycle management platforms like DigiCert, Venafi, Keyfactor, or Sectigo.

• Nice-to-have: Knowledge of ACME, SCEP, EST, and CMP enrollment protocols.

• Nice-to-have: Experience with HSMs, enterprise key management, and cloud PKI services.

• Nice-to-have: Experience managing certificates on systems such as F5 BIG-IP, Fortinet, NGINX, Apache, IIS, or similar.

• Nice-to-have: Familiarity with post-quantum cryptography, NIST standards, and cryptographic migration planning.

• Nice-to-have: Experience with Microsoft Intune, NDES, Active Directory, or enterprise device identity management.

• Nice-to-have: Experience providing support for critical infrastructure, government, utilities, or highly regulated sectors.

• Nice-to-have: Experience in developing API integrations or PKI automation tools.

🏝️ Benefits

• Contribute to bringing AI solutions to critical infrastructure.

• Acquire hands-on experience addressing post-quantum security challenges.

• Have a direct impact on the future of enterprise certificate management.

• Collaborate with software engineers to enhance new product capabilities.

• Tackle complex enterprise-scale issues related to security, reliability, and automation.

• Join an engineering-focused company.