Sr. PKI Engineer
About The Position
We are seeking a Senior PKI Engineer to design, implement, and operate enterprise-grade Public Key Infrastructure (PKI) services. This role requires a strong focus on Microsoft Active Directory Certificate Services (AD CS) and Active Directory (AD) integration. You will be responsible for hands-on implementation and integration of certificate lifecycle management, CA hierarchy governance, enrollment automation, HSM-backed key protection, CA backup/restore, and integration with various platforms including Windows Server, Linux, network/security devices, cloud providers, MDM/EPP, and zero-trust tooling. As a subject matter expert, you will advise on cryptographic standards, certificate-based authentication, and PKI security controls across the organization.
Requirements
- 8+ years in Security Engineering/Identity Infrastructure, including 5+ years hands-on with Microsoft AD CS and enterprise Active Directory with managing CA infra.
- Proven experience designing, deploying, and operating multi-tier Microsoft PKI (offline root, issuing CAs) in large/complex environments.
- Deep knowledge of X.509, CRL/OCSP, EKU/KU, SANs, key algorithms and sizes (RSA/ECC), hashing (SHA-2), and certificate validation paths.
- Strong PowerShell and Windows Server administration; GPOs, autoenrollment, templates, AIA/CDP configuration.
- Experience with 802.1X/EAP-TLS, TLS/mTLS, VPN auth, and device/user certificate issuance at scale.
- HSM experience (e.g., nCipher/Entrust/Thales) for CA key management.
Nice To Haves
- Pki
- ADCS
- Certificate Management
- Vault Management
- Security
Responsibilities
- Design and maintain enterprise PKI architectures (Root CA, Policy CA, Issuing CA) with offline/air gapped roots, secure key ceremonies, key usage, and issuance workflows and robust CRL/OCSP distribution.
- Engineer solutions for mutual TLS, 802.1X (wired/wireless/VPN), device identity, code signing, S/MIME, BitLocker, and disk/volume encryption certs.
- Manage key sizes, algorithms (RSA, ECC and PQC) encryption and hashing.
- Implement HSM-backed key storage for CAs and code signing; lead key ceremonies, disaster recovery designs.
- Own certificate lifecycle management (issuance, renewal, revocation) including automation via Intune, GPO/Autoenrollment, SCEP/NDES, ACME, or MDM connectors.
- Manage CRL/OCSP publication, monitoring, and availability, design highly available, geo-distributed revocation endpoints.
- Implement scripting/automation (PowerShell, APIs) for bulk issuance, inventory, renewal, and drift detection.
- Enable separation of duties for secure operation of PKI infrastructure.
- Manage CA backup, restore, renewal, and migration strategy.
- Apply strong key management practices (FIPS 140-2/140-3), certificate assurance levels, and secure CA hardening baselines.
- Regularly perform PKI risk assessments, access reviews, and control testing (e.g., template permissions, EKU misuse, issuance constraints).
- Lead root cause analysis and incident response for certificate/PKI-related outages or security events.
- Maintain alignment with NIST, CAB Forum, Microsoft Security Baselines, and internal compliance frameworks (e.g., SOX, PCI, HIPAA, ISO 27001) as applicable.
Benefits
- Medical, dental & vision
- Critical Illness, Accident, and Hospital
- 401(k) Retirement Plan – Pre-tax and Roth post-tax contributions available
- Life Insurance (Voluntary Life & AD&D for the employee and dependents)
- Short and long-term disability
- Health Spending Account (HSA)
- Transportation benefits
- Employee Assistance Program
- Time Off/Leave (PTO, Vacation or Sick Leave)
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
