PKI Venafi Architect

Job Title: PKI Venafi Architect

Location: Chicago, IL - Onsite

Experience: 10+ Years

Domain: PKI/Venafi, IAM, Security

Job Summary

We are seeking an experienced PKI / Venafi Architect with 10+ years of experience in Public Key Infrastructure (PKI), certificate lifecycle management (CLM), security architecture, and certificate automation. The ideal candidate will lead the design, implementation, governance, and optimization of enterprise PKI and Venafi solutions across hybrid, cloud, and on-premises environments.

The candidate should have strong expertise in enterprise PKI architecture, machine identity management, cryptographic controls, certificate automation, and Venafi Trust Protection Platform (TPP). This role requires close collaboration with Security, Infrastructure, Cloud, DevOps, Identity and Access Management (IAM), and Application teams to deliver scalable, resilient, and secure enterprise trust services.

Key Responsibilities

1. PKI and Security Architecture

• Design, implement, and maintain enterprise PKI architecture, including Root Certificate Authorities (Root CA), Issuing Certificate Authorities (Issuing CA), Certificate Revocation Lists (CRL), Online Certificate Status Protocol (OCSP), Hardware Security Modules (HSM), and enterprise trust frameworks.
• Develop and maintain certificate governance standards, security policies, cryptographic controls, and certificate management frameworks.
• Architect highly available, scalable, and resilient PKI and Certificate Lifecycle Management (CLM) platforms.
• Define and drive enterprise machine identity management and certificate lifecycle management strategies.
• Ensure secure certificate issuance, distribution, renewal, revocation, and retirement processes across enterprise environments.

2. Venafi Platform Architecture and Engineering

• Design, implement, configure, and administer the Venafi Trust Protection Platform (TPP).
• Define certificate onboarding standards, workflows, policies, reporting mechanisms, discovery jobs, and role-based access models.
• Architect and implement integrations between Venafi and enterprise applications, cloud services, infrastructure platforms, and security solutions.
• Lead Venafi platform upgrades, enhancements, troubleshooting, performance optimization, and continuous improvement initiatives.
• Establish platform governance, operational standards, and best practices for enterprise-wide certificate management.

3. Certificate Lifecycle Automation

• Design and implement automated certificate provisioning, renewal, rotation, revocation, and replacement solutions.
• Develop certificate automation frameworks using Venafi APIs, vCert, PowerShell, Python, and Ansible.
• Integrate certificate lifecycle automation into GitHub Actions, Azure DevOps, and CI/CD pipelines.
• Drive adoption of certificate automation across enterprise application portfolios to reduce manual effort and prevent certificate expiration-related outages.
• Develop reusable automation scripts, workflows, and integration patterns for application and infrastructure teams.
• Collaborate with DevOps and cloud engineering teams to embed certificate management into application deployment and infrastructure provisioning processes.

4. Enterprise Security and Cross-Functional Collaboration

• Work closely with Security, Infrastructure, Cloud, DevOps, IAM, and Application teams to define and implement enterprise certificate management solutions.
• Establish secure machine identity practices and cryptographic control standards across hybrid, cloud, and on-premises environments.
• Provide architecture guidance, technical leadership, and recommendations for PKI modernization and certificate management initiatives.
• Support the implementation of scalable, secure, and highly available trust services aligned with enterprise security requirements.

Essential Skills and Qualifications

• 10+ years of experience in PKI, security architecture, certificate management, or related security engineering domains.
• Strong expertise in enterprise PKI architecture, including Root CA, Issuing CA, CRL, OCSP, HSM, and trust frameworks.
• Hands-on experience with Venafi Trust Protection Platform (TPP) architecture, administration, integration, and optimization.
• Strong knowledge of Certificate Lifecycle Management (CLM), machine identity management, certificate governance, and cryptographic controls.
• Experience designing and implementing automated certificate provisioning, renewal, rotation, and revocation workflows.
• Hands-on experience with Venafi APIs and automation technologies such as vCert, PowerShell, Python, and Ansible.
• Experience integrating certificate automation with GitHub Actions, Azure DevOps, and CI/CD pipelines.
• Ability to architect Venafi integrations with enterprise applications, cloud services, infrastructure, and security platforms.
• Experience supporting PKI and certificate management solutions across hybrid, cloud, and on-premises environments.
• Strong understanding of security best practices, access controls, high availability, resilience, and enterprise platform governance.
• Excellent architecture, troubleshooting, technical leadership, communication, and cross-functional collaboration skills.

Preferred Qualifications

• Experience leading enterprise-wide PKI modernization and certificate automation initiatives.
• Knowledge of cloud-native certificate management and machine identity security.
• Experience developing reusable automation frameworks and enterprise certificate onboarding standards.
• Ability to work effectively with security architects, infrastructure engineers, application teams, and DevOps stakeholders.

Role Expectations

The PKI / Venafi Architect will provide technical and architectural leadership for enterprise PKI, machine identity management, and certificate lifecycle automation, ensuring secure, scalable, resilient, and automated certificate services across the organization.

Work Authorization

Applicants must be legally authorized to work in the United States.

Equal Employment Opportunity

Themesoft Inc is an Equal Employment Opportunity employer. We consider qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable federal, state, or local law.