Sr Platform Engineer, Identity and Security

Pennymac • Westlake Village, CA

2d • Onsite

About The Position

Pennymac is seeking an experienced Platform Engineer to strengthen platform engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services, and encryption. The role designs and automates identity and cryptographic services used by infrastructure and application systems, including enterprise-scale certificate lifecycle automation, directory services, authentication, and key management. The engineer partners with technology teams to streamline delivery, apply security best practices, and promote infrastructure as code, while making critical services resilient.

The role involves building and operating scalable AWS infrastructure and identity services, supporting Windows and Linux workloads, and improving service visibility and reliability. It also includes collaboration with development teams, troubleshooting, documentation of platform standards, and mentorship of junior team members.

Requirements

• Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent experience.
• 7+ years of experience in a Platform Engineering, DevOps, or Site Reliability Engineering (SRE) role.
• Extensive hands-on AWS experience, including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda, and S3.
• Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies, and KMS key policies.
• Strong PKI and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation, and revocation.
• Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers.
• Strong Active Directory experience, including replication, FSMO roles, trust relationships, and AD-integrated DNS.
• Strong understanding of Windows authentication protocols, specifically Kerberos and NTLM, including service principal names, delegation, supported encryption types, and service account models.
• Practical experience with encryption at rest and in transit and key management services.
• Solid understanding of Windows Server administration and integration with cloud environments.
• Proven experience with infrastructure-as-code tools, specifically Terraform (OpenTofu) and AWS CDK.
• Strong experience designing and implementing CI/CD pipelines using GitLab CI/CD.
• Deep understanding of security best practices and their implementation in cloud infrastructure and CI/CD pipelines.
• Solid understanding of networking principles, including TCP/IP, DNS, load balancing, and firewalls, in cloud environments.
• Experience with monitoring and logging tools such as NewRelic, CloudWatch, Cloud Logging, or Prometheus.
• Strong scripting skills, with advanced PowerShell plus Python or Bash.
• Experience with configuration management tools such as Chef, AWS SSM, or Ansible.
• Excellent problem-solving and troubleshooting skills.
• Strong communication and collaboration skills.

Nice To Haves

• AWS Certified Security – Specialty or other relevant AWS certifications.
• Experience with certificate automation protocols and tooling such as ACME, cert-manager, or equivalent.
• Experience operating a private certificate authority.
• Experience with multi-tenant platforms and namespace isolation.
• Experience hardening Active Directory against credential attacks.
• Experience with Microsoft Entra ID and hybrid identity integration.
• Experience with disaster recovery design for critical services, including defined RTO and RPO targets.
• Strong background with AWS EC2 features and services, including Autoscaling and WarmPools.
• Understanding of Windows Server build processes using tools such as Chocolatey for packages and Packer for AMI/image generation.
• Solid experience with the Windows Server operating system and server tools such as IIS.
• Experience with containerization and orchestration technologies such as Docker and Kubernetes.

Responsibilities

• Design, implement, and manage scalable and resilient infrastructure on AWS.
• Design and automate enterprise-scale certificate lifecycle processes, including issuance, validation, renewal, revocation, and deployment to target workloads.
• Design, maintain, and improve the resilience of PKI, including certificate authority operation, certificate inventory, and expiry alerting.
• Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager, and S3.
• Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers.
• Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies, and KMS key policies.
• Administer, secure, and improve the resilience of Active Directory and DNS.
• Support and advance Windows authentication, including Kerberos, delegation, and service account models.
• Implement encryption for data at rest and in transit, and manage keys, rotation, and key access policy.
• Develop and maintain infrastructure as code using Terraform (OpenTofu) and AWS CloudFormation/CDK.
• Develop and maintain configuration management for Windows servers using Chef, AWS SSM, or Ansible.
• Design, build, and optimize CI/CD pipelines using GitLab CI/CD.
• Implement and enforce security best practices across infrastructure and deployment processes.
• Collaborate with development teams to understand their needs and provide Platform Engineering expertise.
• Troubleshoot and resolve infrastructure and application deployment issues.
• Implement and manage monitoring, logging, and alerting for system visibility and proactive issue detection.
• Contribute to the development and documentation of Platform standards and best practices.
• Provide mentorship and guidance to junior team members.

Benefits

• Comprehensive medical, dental, and vision.
• Paid time off programs including vacation, holidays, illness, and parental leave.
• Wellness programs, employee recognition programs, and onsite gyms and cafe-style dining at select locations.
• Retirement benefits, life insurance, 401(k) match, and tuition reimbursement.
• Philanthropy programs including matching gifts, volunteer grants, charitable grants, and corporate sponsorships.
• Competitive salary.
• Some roles may offer performance-based compensation and/or stock-based incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior