Senior PKI Security Engineer
About The Position
Schwab’s Security Analytics and Operations organization protects technology and trust services that enable secure enterprise connections. The Senior PKI Security Engineer will help modernize Schwab’s Public Key Infrastructure platform and strengthen the provisioning, renewal, monitoring, and protection of digital certificates. The role involves building automation, integrations, monitoring, and operational controls to improve certificate visibility, platform resilience, and secure application onboarding. The engineer will resolve complex certificate, authentication, cryptographic, and trust-related issues while reducing operational risk. Working with architecture, infrastructure, cloud, DevOps, application, and security teams, the engineer will establish scalable implementation patterns, support reliable PKI services, and advance future-state cryptography capabilities. The role is based on site at the specified location and participates in a rotating on-call schedule supporting a 24x7 environment. It is eligible for bonus or incentive opportunities in addition to the salary range.
Requirements
- At least 6 years of experience in security engineering, infrastructure engineering, PKI engineering, cryptography, software engineering, or a related technology role.
- Hands-on experience supporting Public Key Infrastructure, Certificate Authorities, certificate lifecycle management, TLS/SSL certificates, key management, certificate chains, and enterprise trust stores.
- Experience applying data encryption practices, including ciphers, certificate revocation, mutual TLS, key protection, secure certificate deployment, and troubleshooting.
- Experience using Python, PowerShell, Java, Bash, or a comparable programming or scripting language to automate operational work.
- Experience developing or supporting API integrations, automation, monitoring, and operational workflows in a large enterprise environment.
- Ability to troubleshoot complex certificate, authentication, cryptographic, and trust-related issues.
- Ability to communicate and collaborate with engineering, architecture, infrastructure, operations, and security stakeholders.
- Linux and Windows Server administration experience.
- Ability to participate in a rotating on-call schedule supporting a 24x7 environment.
Nice To Haves
- Experience with Venafi, CyberArk Certificate Manager, Trust Protection Platform, DigiCert, Microsoft Active Directory Certificate Services, EJBCA, or a comparable certificate management platform.
- Experience designing or supporting highly available security platforms within financial services, regulated industries, or large enterprise environments.
- Experience with authentication and federation technologies, including OAuth, OpenID Connect, SAML 2.0, multifactor authentication, and Active Directory.
- Experience using monitoring and observability tools for certificate discovery, expiration alerting, service health monitoring, metrics, log analysis, dashboards, and operational reporting.
- Familiarity with risk management, regulatory compliance, audit expectations, and security controls related to cryptography and certificate lifecycle management.
- Working knowledge of Windows and Linux operating systems.
- Ability to provide technical leadership, mentor team members, and influence implementation patterns that improve reliability and reduce operational risk.
- Adaptability when responding to evolving security requirements, technologies, priorities, and enterprise risks.
- Familiarity with post-quantum cryptography and the future direction of enterprise cryptographic services.
- Experience creating clear technical documentation and audience-focused reporting.
Responsibilities
- Help modernize the Public Key Infrastructure platform and strengthen digital certificate provisioning, renewal, monitoring, and protection.
- Build automation, integrations, monitoring, and operational controls to improve certificate visibility, platform resilience, and secure application onboarding.
- Resolve complex certificate, authentication, cryptographic, and trust-related issues while reducing operational risk.
- Work with architecture, infrastructure, cloud, DevOps, application, and security teams to establish scalable implementation patterns.
- Support reliable PKI services and advance future-state cryptography capabilities.
- Participate in a rotating on-call schedule supporting a 24x7 environment.
Benefits
- Bonus or incentive opportunities
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
