PKI & Certificate Management Architect

Cyber Security – PKI & Certificate Management Architect.

Role Overview

We are seeking a PKI & Certificate Management Architect to design, build, and govern our enterprise public key infrastructure across hybrid cloud and onprem. You will define trust models, policies (CP/CPS), crypto standards, and automate certificate lifecycle at scale for users, devices, workloads, APIs, and services. This role partners with IAM, Networking, Cloud, DevOps, and App teams to enable Zero Trust, mTLS, code signing, and TLS with measurable reduction in identity/crypto risk and zero certificaterelated outages

Required Skills & Qualifications:

• Enforce least privilege and segregation of duties for CA admins; manage privileged access to HSMs and CA hosts.
• Define incident response playbooks for key compromise, misissuance, or rogue endpoints; rehearse tabletop exercises.
• Provide evidence and control design for audits (SOX, PCIDSS, ISO 27001, HIPAA, GDPR); maintain artifacts for CP/CPS, key ceremonies, and lifecycle logs.
• Periodically assess trust stores, weak certs, shadow CAs, and thirdparty TLS exposures; drive remediation.

Technical Skills:

• PKI Platforms: Handson with at least two: Microsoft AD CS, EJBCA, Venafi TLS Protect/CodeSign, Keyfactor, DigiCert, AWS Private CA, Google CA Service, HashiCorp Vault PKI.
• HSM & Key Management: Thales/Entrust/SafeNet/AWS CloudHSM; key ceremonies, dual control, M of N, tamperevidence, backup & restore.
• Crypto Standards: Strong command of X.509, TLS 1.2/1.3, OCSP/CRL, EKU/SAN, RSA/ECC, SHA2; familiarity with PQC landscape and algorithm agility.
• Automation: ACME, certmanager, Istio/Linkerd, Kubernetes, GitOps; scripting with PowerShell, Bash, Python; REST APIs for certificate platforms.
• Enterprise Integrations: AD/Entra ID, Windows/Linux, NGINX/IIS/Apache, F5/Netscaler/ALB/NGINX+, API gateways (Apigee/Kong), secrets managers (Vault/AKV/Secrets Manager).
• Process & Governance: Authored CP/CPS, runbooks, and IR playbooks; demonstrated audit experience.
• Soft Skills: Architecture leadership, stakeholder communication, clear documentation, mentoring.