Lead Identity Engineer - PKI / Venafi

Job Summary

The PKI / Venafi Engineer is responsible for the administration, support, and optimization of Public Key Infrastructure (PKI) services and certificate lifecycle management platforms. This role focuses on managing digital certificates, supporting cryptographic services, maintaining PKI environments, and ensuring secure certificate operations across enterprise systems. The engineer will work closely with internal teams and external partners to provide operational support, troubleshooting, automation, and continuous improvement of PKI and Venafi services.

Responsibilities

• Manage and support enterprise PKI environments, including Microsoft Active Directory Certificate Services (ADCS) and certificate lifecycle management platforms such as Venafi.
• Handle day-to-day certificate management operations, including certificate issuance, renewal, revocation, replacement, and expiration management.
• Monitor PKI systems, certificate inventories, and platform health to ensure service availability and compliance.
• Troubleshoot certificate-related issues across Windows, Linux, and application environments.
• Support certificate installation activities and provide guidance to application and infrastructure teams.
• Maintain and troubleshoot Venafi workflows, integrations, and ServiceNow-related certificate processes.
• Create, manage, and publish certificate templates within Microsoft ADCS environments.
• Monitor certificate expiration schedules and proactively coordinate renewals with stakeholders.
• Review PKI audit requirements, identify security risks, and implement remediation actions.
• Support and maintain HSM-integrated PKI environments and cryptographic infrastructure.
• Assist with external certificate management, S/MIME certificates, and code-signing certificate operations.
• Collaborate with internal teams and external vendors to ensure seamless integration and operation of PKI services.
• Develop and maintain operational procedures, technical documentation, and user guides related to PKI systems and certificate management.
• Participate in incident, problem, and change management activities while adhering to organizational standards and security policies.

Requirements

• 4-7 years of experience supporting Public Key Infrastructure (PKI) environments.
• Solid understanding of PKI concepts including digital certificates, digital signatures, certification authorities, CRLs, OCSP, NDES, certificate templates, and encryption technologies (symmetric, asymmetric, and hybrid encryption).
• Hands-on experience with Microsoft Active Directory Certificate Services (ADCS).
• Experience administering certificate lifecycle management platforms such as Venafi and/or AppViewX.
• Prior L1/L2 operational support experience in PKI and certificate management environments.
• Strong understanding of certificate lifecycle processes including issuance, renewal, revocation, expiration management, and deployment.
• Experience troubleshooting certificate installation and configuration issues across enterprise applications and servers.
• Hands-on experience with Windows and Linux server certificate configuration, deployment, and troubleshooting.
• Experience supporting enterprise cryptographic products and solutions.
• Familiarity with ServiceNow workflows and IT service management processes.
• Understanding of PKI auditing, risk assessment, security controls, and compliance requirements.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent verbal and written communication skills with the ability to engage technical and non-technical stakeholders.

Nice to Have

• Experience with Entrust HSM administration and support.
• Experience managing ADCS PKI clusters.
• Knowledge of S/MIME implementation and support.
• Experience with code-signing certificate management.
• Familiarity with external Certificate Authorities such as Entrust and Sectigo.
• Exposure to PKI automation and scripting using PowerShell.
• Relevant security, PKI, or Microsoft certifications.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.