Senior PKI Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Manage and oversee the Microsoft Active Directory Certificate Services (AD CS), which includes issuing Certificate Authorities (CAs), creating certificate templates, providing enrollment services, facilitating autoenrollment, NDES, and publishing Certificate Revocation Lists (CRLs).

• Operate the certificate lifecycle management platform, such as Venafi Trust Protection Platform or Keyfactor Command.

• Monitor the certificate inventory, handle requests, assist with renewals, and troubleshoot integrations.

• Utilize Fortanix Data Security Manager and other Hardware Security Module (HSM)-backed services in Public Key Infrastructure (PKI) operations.

• Investigate and resolve issues related to certificate issuance, renewal, trust chains, revocation, NDES enrollment, and key access.

• Conduct health checks for PKI, including patching, maintenance, backups, and recovery testing.

• Respond to alerts regarding certificate expiration and coordinate renewals with application and infrastructure stakeholders.

• Maintain PowerShell scripts, scheduled tasks, reports, and automate PKI processes.

• Oversee the CLM/CLaaS infrastructure.

• Ensure accuracy in documentation, runbooks, and certificate records.

• Assist with audits, change management, and incident response efforts.

• Ensure that established PKI services remain secure, available, well-documented, and efficiently operational.

⛳️ Requirements

• Extensive hands-on experience with Microsoft AD CS in an enterprise setting, including NDES.

• Proficiency in administering Venafi Trust Protection Platform or Keyfactor Command.

• Familiarity with Fortanix Data Security Manager or similar HSM solutions, particularly in relation to how PKI services utilize protected keys.

• Strong knowledge of X.509 certificates, the structure of certificate chains, enrollment processes, revocation, TLS, and safeguarding private keys.

• Skills in PowerShell scripting and troubleshooting.

• Ability to collaborate with Active Directory, DNS, networking, application, and key management teams to resolve certificate-related issues.

• Understanding of cryptographic management within Microsoft Azure or Amazon AWS.

• Knowledge and experience in certificate configuration and management on content delivery networks, web application firewalls, network load balancers, and Azure application gateways.

• Experience with change control, operational documentation, and production support.

• Knowledge of offline root CA ceremonies and the maintenance processes associated with an Offline Root Certificate Authority (ORCA).

• Experience in supporting code signing or publicly trusted TLS certificates.

• Familiarity with PKI backup, recovery, and audit requirements.

🏝️ Benefits

• Medical, dental, and vision insurance.

• Remote-flexible workforce options.

• Wellness programs.

• 401(k) program with employer matching contributions.

• Flexible paid time off policy.

• Generous parental leave.

• Donations for Doers program.

• Pet insurance, along with legal and identity protection services.

• Tuition reimbursement program.