Principal IT Technologist - PKI

Role & responsibilities

PKI & Certificate Management

• Design and manage enterprise PKI solutions, including:
• Internal Certificate Authorities (CAs)
• Integration with public CAs
• Oversee full certificate lifecycle:
• Request, issuance, renewal, revocation, and retirement
• Implement and maintain automation for certificate lifecycle management (e.g., ACME, APIs)
• Integrate catalog items within ITSM platforms
• Understand certificate renewal process/auto renewal
• Deploy and manage:
• SSL/TLS certificates for web apps, APIs, and infrastructure
• Mutual TLS (mTLS) where applicable
• Ensure compliance with organizational security policies and industry standards

Cloudflare Integration

• Administer and optimize Cloudflare services, including:
• DNS hosting and record management
• SSL/TLS configuration (Full/Strict modes, edge certificates)
• CDN and performance tuning
• Configure and maintain:
• Web Application Firewall (WAF)
• Zero Trust / access controls (where applicable)
• Support hybrid DNS architectures across on-prem and Cloudflare edge

Automation & Engineering

• Develop automation for DNS and certificate management:
• Infrastructure as Code (IaC) (e.g., Terraform, ARM, etc.)
• API-based integrations (Infoblox, Cloudflare, DigiCert)
• Build monitoring and alerting for:
• DNS resolution health
• Certificate expiration
• Security anomalies
• Standardize deployment patterns and operational runbooks

Preferred candidate profile

• 8+ years of hands-on experience in:
• DNS engineering (enterprise-scale)
• PKI / certificate lifecycle management
• Strong experience with:
• Infoblox (DDI platform administration, NIOS-X)
• DigiCert (certificate issuance, automation, APIs)
• Cloudflare (DNS, CDN, SSL/TLS, WAF)
• Domain registrar management experience
• Deep understanding of:
• DNS protocols and architecture
• TCP/IP networking fundamentals
• SSL/TLS handshake and certificate chains
• Experience troubleshooting:
• DNS resolution failures
• Certificate trust and validation issues
• Scripting/automation experience (PowerShell, Python, or similar)

Preferred Qualifications

• Experience with:
• Hybrid cloud environments (Azure/AWS)
• Microsoft Entra ID / Active Directory integration
• Familiarity with:
• Certificate automation tooling
• Zero Trust architecture
• Experience implementing DNS security controls (DNSSEC, RPZ)
• Infrastructure-as-Code experience (Terraform preferred)