PKI / Certificate Management Engineer

Job Responsibilities

• Design, implement, and maintain enterprise Public Key Infrastructure (PKI) supporting internal and external certificate requirements.
• Manage the full certificate lifecycle, including request, issuance, validation, distribution, renewal, revocation, expiration, and retirement.
• Implement and maintain ACME-based certificate automation and other automated enrollment and renewal workflows.
• Manage certificates across Windows, Linux, cloud platforms, containers, applications, load balancers, network devices, and other enterprise systems.
• Design and operate integrations with AWS Private Certificate Authority (AWS Private CA), AWS Certificate Manager (ACM), and related AWS services.
• Implement and administer Hardware Security Module (HSM) capabilities, including AWS CloudHSM, for secure protection of private keys and cryptographic operations.
• Support Federal PKI (FPKI) and DoD PKI trust relationships, certificate chains, and interoperability requirements.
• Integrate CAC/PIV authentication with enterprise applications, identity platforms, operating systems, and secure access workflows.
• Implement and maintain mutual TLS (mTLS) for workload identity, service-to-service authentication, and Zero Trust communications.
• Ensure cryptographic implementations use FIPS-validated cryptographic modules and approved algorithms where required.
• Establish certificate discovery, inventory, monitoring, and alerting capabilities to identify unmanaged certificates and prevent expiration-related outages.
• Develop governance standards for certificate ownership, issuance, naming, key length, cryptographic algorithms, renewal periods, revocation, and retention.
• Integrate certificate management with Identity and Access Management (IAM) platforms and authentication workflows.
• Support secure networking and communications through TLS, mTLS, certificate-based authentication, and encryption standards.
• Monitor PKI platform health, certificate status, revocation services, HSM operations, and certificate expiration events.
• Troubleshoot complex certificate-chain, trust-store, TLS, cryptographic, enrollment, renewal, and authentication issues.
• Partner with cybersecurity, identity, cloud, platform, network, and application teams to integrate PKI services into enterprise architectures and deployment workflows.
• Maintain PKI architecture documentation, certificate policies, operational procedures, runbooks, governance standards, and audit evidence.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Demonstrated experience designing, implementing, or administering enterprise Public Key Infrastructure (PKI).
• Strong knowledge of X.509 certificates, certificate authorities, trust chains, cryptographic algorithms, key management, revocation, and certificate lifecycle management.
• Experience implementing automated certificate issuance and renewal using ACME or comparable certificate automation technologies.
• Experience managing certificates across Windows, Linux, cloud, containerized, network, and application environments.
• Hands-on experience with AWS Private CA, AWS Certificate Manager, AWS CloudHSM, or comparable cloud PKI and HSM technologies.
• Strong understanding of cryptography, encryption, digital signatures, hashing, key exchange, and secure communications.
• Experience integrating PKI with IAM, directory services, applications, network infrastructure, and cloud services.
• Familiarity with Federal PKI, DoD PKI, CAC/PIV authentication, and government certificate trust models.
• Experience implementing mTLS and certificate-based workload identity in Zero Trust architectures.
• Familiarity with FIPS-validated cryptography and cryptographic requirements for government or regulated environments.
• Experience with certificate discovery, inventory management, expiration monitoring, and proactive renewal processes.
• Strong understanding of TLS configuration, secure networking, trust stores, certificate validation, and PKI troubleshooting.
• Experience supporting AWS GovCloud, government, defense, or other regulated environments is preferred.
• Strong governance, risk management, documentation, troubleshooting, and cross-functional collaboration skills.
Preferred Certifications:
• AWS Certified Security – Specialty
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Red Hat Certified Engineer (RHCE)
• Microsoft Certified: Windows Server Hybrid Administrator Associate
• Entrust or DigiCert PKI certifications, where applicable