PKI Engineer

The PKI Engineer, designs, implements, and operates enterprise Public Key Infrastructure services that underpin secure authentication, encryption, and digital signatures across mission ‑ critical systems. The role serves as the primary technical authority for certificate lifecycle management, key management, and trust architectures spanning on ‑ premises and cloud environments. The engineer defines PKI standards, policies, and integration patterns for applications, devices, and identities, and leads troubleshooting, modernization, and automation initiatives to keep cryptographic services resilient, scalable, and audit ‑ ready in a highly regulated federal IT environment. Key Responsibilities Architect and maintain enterprise PKI solutions, including certificate authorities, registration authorities, OCSP/CRL distribution, and hardware security modules, ensuring high availability and crypto ‑ agility. Oversee end ‑ to ‑ end certificate lifecycle management for users, services, devices, and workloads, including automated issuance, renewal, revocation, and inventory across hybrid and multi ‑ cloud environments. Design PKI trust models and integration patterns for TLS/SSL, S/MIME, code signing, VPN, Wi ‑ Fi, and device authentication in support of zero ‑ trust access and strong identity assurance. Implement and enforce PKI security policies, certificate policies, and certification practice statements, aligning configurations with applicable government and industry cryptographic standards. Build PowerShell or Python automation, APIs, and tooling to streamline PKI operations, monitoring, key rotation, and compliance reporting at enterprise scale. Lead incident response for certificate ‑ related outages or compromises, including rapid revocation, re ‑ issuance, key rotation, and coordination with security operations and incident response teams. Collaborate with identity, network, and application security architects to embed PKI requirements into new platforms and remediate legacy or non ‑ compliant cryptographic implementations. Guide risk assessments and audits focused on cryptographic controls, producing remediation roadmaps to address algorithm deprecation, weak ciphers, and end ‑ of ‑ life PKI components. Required Qualifications Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent relevant experience. 8+ years of experience in cybersecurity engineering or closely related roles, including at least 5 years focused on PKI architecture and operations. Strong background in cybersecurity, network security, and information systems, with deep understanding of standards ‑ based security architectures, identity services, and device profiling. Demonstrated expertise with enterprise PKI platforms, certificate lifecycle management, hardware security modules, and related tooling across on ‑ prem and cloud environments. Proficiency with automation and scripting (such as PowerShell or Python) to manage PKI operations, monitoring, and reporting at scale. Excellent problem ‑ solving, analytical, communication, and interpersonal skills, with the ability to manage multiple initiatives and incident responses effectively. Secret Clearance Required U.S. citizenship required. Less than 10% travel required. Preferred Qualifications Experience engineering PKI for large federal or defense environments, including integration with smart cards, PIV/CAC, and enterprise identity governance platforms. Professional certifications such as CISSP, CCSP, or vendor PKI/cryptography credentials demonstrating advanced knowledge of applied cryptography and key management. Experience leading cryptographic modernization programs (for example, algorithm migrations, key ‑ length upgrades, or post ‑ quantum ‑ readiness initiatives). Familiarity with zero ‑ trust architectures and how PKI enables strong device, user, and service identity within those models. - Hands-on experience designing and managing PKI environments (CA/RA, OCSP/CRL, HSMs, key management), not just supporting them - Proven ownership of end-to-end certificate processes (issuance, renewal, revocation, inventory) across users, devices, and systems - Experience integrating PKI with IAM and security systems (TLS/SSL, VPN, SSO, device authentication, Zero Trust environments) - Strong scripting/automation skills (PowerShell/Python/APIs) to manage PKI operations, key rotation, monitoring, and reporting at scale - Background in regulated environments (NIST, FISMA, FedRAMP, DoD) with experience in audits, crypto policies, and incident response