Cloud Engineer

Chevron•Houston, TX

About The Position

This is a senior hands-on engineering role within Chevron’s Digital Identity organization. The Cloud Engineer designs, operates, and modernizes enterprise-scale Public Key Infrastructure (PKI) and cryptographic services across cloud and hybrid environments. The role enables secure certificate lifecycle management, key protection, and identity-driven security controls, supporting Zero Trust adoption, phishing-resistant authentication, and protection of critical business workloads.

Requirements

Bachelor’s degree in computer science, Information Security, Engineering, or a related field, or equivalent experience.
3–5 years of experience in Identity & Access Management, PKI, or security infrastructure engineering.
Proven experience operating large-scale enterprise PKI environments.
Strong understanding of cryptography, authentication, and trust models.
Hands-on expertise with PKI platforms, HSM, key management, automation, Active Directory, and Microsoft Entra ID.

Nice To Haves

Industry certifications in security or cloud, such as CISSP or Azure Security.
Experience in regulated industries such as oil and gas or energy.
Knowledge of Zero Trust architecture, Conditional Access, and identity security engineering.
Familiarity with ITIL and operational processes in regulated environments.

Responsibilities

Design, deploy, and manage enterprise PKI platforms, including Microsoft ADCS, DigiCert, NDES, and cloud-integrated services.
Own certificate lifecycle management, including issuance, renewal, revocation, compliance, and automation.
Implement post-quantum cryptography capabilities aligned with business and regulatory requirements.
Manage HSM-backed key protection and integration with key management systems.
Integrate PKI with Active Directory and Microsoft Entra ID for hybrid identity scenarios.
Enable certificate-based authentication for workloads, APIs, devices, VPN, and service accounts.
Align PKI services with Azure and multi-cloud security architectures.
Implement phishing-resistant authentication using FIDO2, PIV, and certificate-based methods.
Support Conditional Access policies leveraging identity, device posture, and risk signals.
Advance Zero Trust maturity and continuous security posture improvement.
Integrate PKI with PAM solutions, such as Delinea, for secure service account authentication.
Support privileged access workstations and hardened admin environments.
Lead break-glass and recovery scenarios using secure access controls.
Drive automation using scripting, APIs, and orchestration to reduce manual processes.
Lead disaster recovery exercises, upgrades, and PKI platform modernization.
Provide advanced engineering support, incident response, and root cause analysis.
Serve as a PKI subject matter expert within Digital Identity – Protection.
Collaborate across security, cloud, and operations teams.
Mentor engineers and contribute to standards and operational excellence.