Senior Security Engineer, PKI & Network Edge

Dentsply Sirona, Inc•Richardson, TX

2d•$187,000 - $198,000

About The Position

Dentsply Sirona is seeking a senior-level individual contributor to join its Security Architecture and Engineering organization. The role is the enterprise technical owner for the security of DNS, digital certificates and Public Key Infrastructure (PKI), and Web Application Firewall (WAF)—foundational services that protect the boundary between the company and the public internet. The engineer designs, selects, and establishes these capabilities and sets the standards and guardrails for their operation. Day-to-day operations transition to an Infrastructure run-and-maintain function, while the role retains design authority, standards ownership, and risk governance. The position owns the design, engineering, and continuous improvement of controls for DNS resolution and domain governance, certificate lifecycle and enterprise PKI, and web application and edge protection. It partners with Infrastructure and Operations, Network Engineering, Cloud Engineering, Product Security, Application Development, and Security Operations to reduce attack surface, prevent certificate-related outages, and protect web-facing assets from application-layer threats. It also ensures high-quality telemetry and detection coverage across DNS, certificate, and WAF data sources. Operating with minimal direction, the Senior Engineer leads complex initiatives end to end, serves as the senior escalation point for DNS, certificate, and WAF issues, and advises engineering teams and security leadership. The position leads security posture improvement, risk reduction, and operational maturity across internet-facing services, and defines an operating model for transitioning built capabilities to Infrastructure operations. Success measures include preventing unplanned outages caused by expired or misissued certificates, reducing exposed or unmanaged DNS records, domains, and certificates, improving WAF coverage while controlling false positives, and onboarding DNS, certificate, and WAF telemetry to the SIEM with high-fidelity detections. A stretch goal is to deliver a broadly adopted, unified edge and trust-services security blueprint with automated lifecycle management and standardized protection patterns.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field, or equivalent practical experience.
At least 7 years of progressive cybersecurity engineering experience, including hands-on experience securing internet-facing infrastructure.
At least 3 years of direct, hands-on experience across two or more of enterprise DNS security, certificate/PKI management, and WAF engineering.
Proven experience designing and operating enterprise-scale edge or perimeter security controls.
Experience integrating network and edge security platforms with SIEM/SOC operations.
Strong knowledge of DNS security, including DNSSEC, protective DNS, RPZ, and domain/registrar governance.
Deep understanding of certificate lifecycle management, PKI, TLS, cryptographic standards, certificate automation such as ACME, and discovery tooling.
Hands-on WAF engineering experience on an enterprise edge or WAF platform, including rule tuning and OWASP and API protection.
Experience with security automation and infrastructure-as-code, such as Terraform or equivalent, and scripting, such as Python or equivalent.
Ability to translate risk into pragmatic engineering requirements and communicate clearly with engineering teams and senior leadership.

Nice To Haves

CISSP and/or GIAC certifications relevant to web, network, or defensible architecture, such as GWEB, GCIA, or GDSA.
Vendor certifications relevant to edge security, WAF, DNS, or certificate and PKI management.
Familiarity with NIST CSF, NIST SP 800-53, or ISO 27001 control frameworks.

Responsibilities

Design and maintain secure DNS architecture for authoritative and recursive resolution, including segmentation, redundancy, and provider resilience.
Implement and operate DNSSEC, DNS firewalling, protective DNS, and response policy zones (RPZ) to block malicious resolution and DNS exfiltration.
Establish domain and registrar governance, including registrar locks, domain portfolio ownership, anti-hijacking controls, and standards for domain provisioning and retirement.
Partner with Security Operations to onboard DNS telemetry and develop detections for tunneling, fast-flux, and newly registered or look-alike domains.
Own the enterprise certificate program, including issuance, renewal, revocation, and automated lifecycle management such as ACME-based automation.
Maintain continuous certificate discovery and inventory across cloud, on-premises, and product environments, with ownership information and advance expiration alerting.
Define and enforce TLS and cryptographic standards, including protocol versions, cipher suites, key strength, and key protection, aligned with the internal encryption standard.
Design and establish enterprise private PKI, including root and issuing CA hierarchy, automated issuance using ACME, EST, or SCEP, and integration with directory and device-management systems.
Govern internal and external certificate authorities and trust stores; define hardware key protection for CA and code-signing keys, including root key ceremony and custody models.
Establish secure code-signing for software and device firmware, with signing keys protected in hardware.
Lead WAF policy design, deployment, and tuning across enterprise and product web applications while balancing protection with low false-positive rates.
Maintain OWASP Top 10 and API protection coverage; manage rule lifecycles and exceptions, and tune signatures using observed traffic and threat intelligence.
Coordinate CDN, DDoS mitigation, and bot management controls at the edge, and partner with application teams on safe onboarding and tuning.
Ensure WAF events feed Security Operations detection and response workflows with high-fidelity, actionable telemetry.
Define security standards, patterns, and guardrails so network, cloud, and application teams can securely consume DNS, certificate, and WAF services by default.
Automate control enforcement and configuration validation with scripting and infrastructure-as-code to reduce manual effort and configuration drift.
Lead threat modeling and architecture reviews for new internet-facing services and major migrations; document decisions and required controls.
Define the operating model and transition built capabilities to the Infrastructure run-and-maintain function.
Mentor engineers and act as a technical leader across Security Architecture and Engineering initiatives.
Lead complex initiatives end to end and serve as the senior escalation point for DNS, certificate, WAF, and other network or edge security issues.
Advise engineering teams and security leadership, and drive security posture improvement, risk reduction, and operational maturity across internet-facing services.