PKI & Certificate Management Architect

At Experient, we provide experience, technology, and transformation support to our clients, creating a dynamic work environment. We value collaboration, prioritize effective communication, and focus on delivering results quickly and practically. Whether you’re looking to deepen your expertise or take on new challenges, we’re here to support your journey every step of the way.

This role is responsible for leading the design and integration of a centralized certificate management system across a broad estate of systems. This role will own the technical direction for bringing tools like Zero Touch PKI and CyberArk Certificate Manager together into a single platform for issuing, renewing, and revoking certificates at scale. This includes leading the technical migration off multiple certificate providers and platforms as well as operating as an embedded technical partner working alongside the platform vendor’s professional services team.

What you'll do

• Design the target-state architecture for centralized certificate lifecycle management (issuance, renewal, revocation, discovery, inventory).
• Lead the technical migration from multiple Certificate Authorities onto Zero Touch PKI, including certificate migration/creation and transitioning critical infrastructure services to the new SaaS-backed CA.
• Build enterprise-grade automations for certificate provisioning and renewal to remove manual touchpoints.
• Establish certificate discovery and inventory with CyberArk Certificate Manager across multiple cloud providers, servers, load balancers, app services, and network devices.
• Work with stakeholders to define standards for certificate policy, key types, validity periods, and rotation.
• Work with platform, security, and application teams to onboard their systems onto the central platform.
• Set up monitoring and alerting for expirations, policy violations, and integration failures.

What you’ll bring

• Strong working knowledge of PKI and the X.509 certificate standard: certificate lifecycle, CAs, chains of trust, key management, and revocation.
• Experience automating certificate inventorying and provisioning across heterogeneous systems (Linux, Windows, AWS, GCP, Entra, IoT devices, Kubernetes, Cloudflare).
• Proficiency with at least one scripting or programming language for automation and integration work (Python, Go, or similar).
• Experience leading technical delivery: setting architecture, reviewing work, and bringing a team along.

Nice to have

• Experience with ACME/SCEP/EST enrollment protocols and CRL/OCSP revocation processes.
• Knowledge of mTLS and service-to-service certificate use in microservice environments.
• Cloud-native certificate services (AWS ACM, Azure Key Vault & Cloud HSM, or GCP KMS).
• Hands-on integration experience with certificate management or PKI tooling. Direct experience with Zero Touch PKI and CyberArk Certificate Manager (formerly Venafi) is a strong plus.
• Experience designing API or ServiceNow integrations for developer self-service.
• Prior hands-on experience migrating off Microsoft ADCS at enterprise scale.
• Experience integrating certificate/expiration events with SIEM tooling for security visibility.
• Prior experience in large-scale, multi-team enterprise environments (thousands of certificates, dozens of stakeholder teams).
• Background in a regulated or audited environment.

Experient Group is an Equal Employment Opportunity (EEO) employer and welcomes all qualified applicants. Applicants will receive fair and impartial consideration without regard to race, sex, religion, national origin, age, sexual orientation, disability, veteran status, genetic data, or other legally protected status.

#LI - HYBRID