Information Security - PKI & Certs - Senior Manager

The Senior Manager for Certificates and Public Key Infrastructure leads the team and the service that runs enterprise PKI and certificate lifecycle management for the firm. The role owns the internal certificate authority hierarchy, the operation of root and issuing authorities, the hardware security modules that protect private keys, and the automation that issues, renews, and revokes certificates across the estate. It is accountable for discovery and inventory of certificates wherever they are deployed, and for preventing the expiries that cause service outages. The role also owns code signing and device and user certificate services, relationships with external certificate authorities and platform vendors, and the cryptographic standards that govern approved algorithms and key lengths, including the roadmap for post-quantum migration. Success is measured on service availability, automated renewal coverage, elimination of expiry-driven incidents, and the quality of audit evidence produced for certificate authority operations.
Key Responsibilities
-
Lead the certificate and PKI engineering team, setting priorities, on-call coverage, hiring plans, and development paths for

engineers across multiple locations.
-Own the internal certificate authority hierarchy and the operation of root and issuing authorities, including hardware security module key protection, documented key ceremonies, and segregation of duties.
-
Drive automation of certificate issuance, renewal, and revocation across applications, infrastructure, and devices, and extend discovery and inventory so that every certificate in the estate is known and monitored before it expires.
-
Run the code signing and the device and user certificate services as a managed offering, with clear onboarding, approval, and usage controls for the teams that consume them.
-
Set cryptographic standards and algorithm policy, manage external certificate authority and platform vendor relationships and budget, and produce the evidence that internal audit, external assessors, and client assurance teams require.

Required Qualifications
-
Ten or more years in infrastructure or security engineering, including at least three years leading engineers as a manager or team lead.
-
Deep knowledge of public key infrastructure, X.509 certificate structure and validation, TLS, and applied cryptography, including certificate revocation and trust store management.
-
Hands-on experience with certificate platforms such as Microsoft Active Directory Certificate Services, Venafi, Keyfactor, DigiCert, Entrust, or HashiCorp Vault, and with ACME automation including Lets Encrypt.
-
Practical experience operating hardware security modules such as Thales or Entrust nShield, and accountability for vendor management, budget, and audit outcomes for a production service.

Preferred Qualifications
-
Certification such as CISSP, CISM, or a vendor PKI credential on a deployed certificate management platform.
-
Experience planning cryptographic agility and post-quantum migration, including inventory of algorithm usage and phased replacement across applications and infrastructure.

Working Arrangements and Team Expectations
This role sits within the Information Security function and shares a common operating model with the wider team. Engineers and analysts own the security platforms they run end to end: design, deployment, day-to-day operation, tuning, and lifecycle management. Work is delivered against agreed service levels and measured on control coverage, platform availability, and the quality of detection and prevention outcomes. Because the teams.

are distributed across INDUS, LATAM, EMEA, and North America, all roles require reliable overlap with United States business hours and fluent written and spoken English.
-
Operate assigned security platforms as a service, including capacity planning, patching, upgrades, health monitoring, and vendor case management.
-
Automate repetitive configuration and operational tasks, and treat platform configuration as code wherever the tooling supports it.
-
Support incident response and forensic investigations with platform expertise, evidence, and rapid containment actions.
-
Maintain runbooks, architecture diagrams, and control documentation to a standard that satisfies internal audit and external assessment.
-
Participate in an on-call rotation and in scheduled change windows, including occasional work outside standard business hours.