Senior PKI Engineer / SME

Vervic•Washington, DC

1d•Onsite

About The Position

The Senior PKI Engineer / SME owns the architecture and implementation of public key infrastructure, from policy design through operational support. The work focuses on designing and maintaining trust models on which other systems depend, while accounting for vendor constraints, security requirements, and interoperability edge cases. The position operates at a high tempo and calls for precision, persistence, and disciplined follow-through. The role designs and manages PKI architectures and segmented trust models; supports certificates for varied use cases and vendor-specific requirements; troubleshoots validation across systems, applications, and network boundaries; and collaborates with technical teams to ensure certificate integration works correctly. It also defines certificate policies, revocation strategies, and security controls, and mentors engineers on PKI fundamentals and implementation practices. The position is on-site in Washington, DC.

Requirements

At least 8 years of experience in PKI, security engineering, or related systems roles in secure/cleared environments.
Active TS clearance and ability to obtain TS/SCI.
Professional certification required.
Demonstrated ability to design and troubleshoot PKI systems across multiple platforms and vendors.
Experience with complex trust models and real-world certificate interoperability challenges.
DoD 8140 compliance required.
Knowledge of PKI fundamentals, including X.509, certificate chains, trust stores, and key management.
Knowledge of Microsoft CA, OpenSSL, and other PKI tooling.
Knowledge of TLS/SSL, mutual authentication, and certificate-based access control.
Knowledge of CRL, OCSP, revocation, and certificate lifecycle management.
Knowledge of hardware security modules.
Knowledge of integration points including web servers, load balancers, applications, and network devices.

Nice To Haves

Expert-level capability is preferred.

Responsibilities

Design and manage PKI architectures, including root and intermediate hierarchies, chains of trust, and certificate lifecycle processes.
Create and maintain segmented trust models, including organizational partitions, cross-domain trust, and constrained intermediates.
Generate and support certificates for diverse use cases, accommodating vendor constraints and non-standard requirements such as wildcard usage, SAN configurations, and custom extensions.
Troubleshoot certificate validation issues across systems, applications, and network boundaries.
Collaborate with systems, network, and application teams to ensure certificates function correctly in their environments.
Define and enforce certificate policies, revocation strategies (CRL/OCSP), and security controls.
Mentor engineers on PKI fundamentals and correct implementation practices.