Sr. PKI Engineer

Role overview

Operate and maintain enterprise public key infrastructure and certificate management services, keeping them secure, available, documented, and reliable. The role supports a Microsoft certificate authority environment, certificate lifecycle tooling, trusted certificate authorities, and integrations with hardware-backed key services, while also improving operational automation.

Responsibilities

- Administer Microsoft Active Directory Certificate Services, including issuing CAs, templates, enrollment services, NDES, and CRL publication. - Operate certificate lifecycle management tooling, monitor inventory, handle requests and renewals, and troubleshoot integrations. - Investigate certificate issuance, renewal, trust chain, revocation, enrollment, and key access problems. - Perform health checks, patching, maintenance, backups, and recovery testing; respond to expiry alerts and coordinate renewals. - Maintain PowerShell scripts, scheduled tasks, reports, lifecycle infrastructure, runbooks, and certificate records. - Support audits, change management, and incident response in coordination with application, infrastructure, network, and key management teams.

Requirements

- Hands-on enterprise experience operating Microsoft AD CS, including NDES. - Experience administering Venafi Trust Protection Platform or Keyfactor Command. - Working knowledge of Fortanix Data Security Manager or a comparable HSM solution and how PKI uses protected keys. - Strong understanding of X.509 certificates, trust chains, enrollment, revocation, TLS, and private key protection. - PowerShell scripting and troubleshooting skills, plus experience with change control, documentation, and production support. - Familiarity with Active Directory, DNS, networking, and cryptographic management in Azure or AWS. - Experience managing certificates on content delivery networks, web application firewalls, load balancers, or Azure Application Gateways. - Knowledge of offline root CA ceremonies and maintenance processes.

Nice to have

- Experience supporting code signing or publicly trusted TLS certificates. - Familiarity with PKI backup, recovery, and audit requirements.

Benefits and work setup

- Remote-flexible work, medical, dental, and vision coverage, and wellness programs. - 401(k) with employer match, flexible paid time off, and parental leave. - Tuition reimbursement, pet insurance, and legal and identity protection benefits.