PKI Engineer

Job Description

Job Title: PKI & Venafi Certificate Lifecycle Management Engineer

\n

Location: Chicago, IL

\n

Work Model: Hybrid – Onsite

\n

Experience: 8+ Years in PKI / Certificate Lifecycle Management

\n

Venafi Experience: 5+ Years of Hands-on Administration and Engineering

\n

Job Summary

\n

We are seeking an experienced PKI & Venafi Certificate Lifecycle Management Engineer to administer, engineer, and automate enterprise certificate lifecycle management solutions. The ideal candidate will have strong hands-on experience with Venafi, Public Key Infrastructure (PKI), TLS/SSL certificates, certificate automation, and enterprise security integrations.

\n

This role involves managing the end-to-end certificate lifecycle, onboarding applications into the Certificate Lifecycle Management (CLM) platform, developing automation solutions, supporting PKI infrastructure, and ensuring compliance with enterprise security standards.

\n

Key Responsibilities

\n

1. Certificate Lifecycle Management

\n

\n
• Administer and support enterprise Certificate Lifecycle Management (CLM) services.
\n
• Manage the complete certificate lifecycle, including discovery, request, issuance, renewal, revocation, deployment, monitoring, and retirement.
\n
• Maintain certificate inventory, visibility, ownership, and compliance.
\n
• Identify and remediate expired, expiring, unmanaged, self-signed, and non-compliant certificates.
\n
• Ensure adherence to enterprise certificate policies and industry standards.
\n

\n

2. Venafi Platform Administration

\n

\n
• Administer, configure, and maintain the Venafi Trust Protection Platform (TPP) and Venafi SaaS solutions.
\n
• Configure certificate policies, workflows, Certificate Authorities (CAs), integrations, discovery jobs, notifications, reporting, and access controls.
\n
• Support platform upgrades, maintenance, enhancements, and technology refresh initiatives.
\n
• Troubleshoot platform issues and collaborate with Venafi support teams and vendors to implement solutions.
\n
• Maintain platform stability, security, availability, and operational efficiency.
\n

\n

3. Application Onboarding & Solution Engineering

\n

\n
• Lead application onboarding into the enterprise Certificate Lifecycle Management platform.
\n
• Assess application certificate requirements and define appropriate onboarding and deployment strategies.
\n
• Partner with application, infrastructure, cloud, and security teams to understand application architectures, certificate formats, trust requirements, and operational processes.
\n
• Design scalable and reusable certificate onboarding and automation patterns.
\n
• Support certificate integrations across Windows, Linux/Unix, Azure, Kubernetes, WebLogic, IIS, F5, Kafka, Solace, PingFederate, and cloud-native platforms.
\n
• Provide technical guidance and recommendations to application teams.
\n

\n

4. Certificate Automation & DevSecOps Integration

\n

\n
• Design, implement, and maintain automated certificate provisioning, renewal, deployment, and validation solutions.
\n
• Develop automation using Venafi Native Drivers, Venafi APIs, vCert utilities, PowerShell, Python, Ansible, and REST APIs.
\n
• Integrate certificate lifecycle processes with CI/CD pipelines, GitHub Actions, and Azure DevOps.
\n
• Automate certificate deployment validation and application restart activities where required.
\n
• Develop reusable automation frameworks to reduce manual effort, minimize operational risk, and improve service reliability.
\n
• Collaborate with DevOps and application teams to integrate certificate management into software delivery workflows.
\n

\n

5. PKI Operations & Resiliency

\n

\n
• Support enterprise PKI infrastructure, Certificate Authority services, and certificate issuance processes.
\n
• Manage and support root and intermediate Certificate Authorities, Certificate Revocation Lists (CRLs), and related certificate infrastructure.
\n
• Participate in backup and recovery testing, disaster recovery exercises, and resiliency improvements.
\n
• Monitor certificate ecosystem health, availability, and performance.
\n
• Troubleshoot certificate infrastructure issues and participate in major incident response activities.
\n
• Support cryptographic key management and Hardware Security Module (HSM) integrations, where applicable.
\n

\n

6. Security, Governance & Compliance

\n

\n
• Support certificate governance, security controls, and compliance initiatives.
\n
• Ensure adherence to TLS/SSL security standards, certificate issuance policies, cryptographic key management practices, and CA controls.
\n
• Maintain certificate ownership, metadata, accountability, and audit records.
\n
• Participate in security audits, control assessments, evidence collection, and remediation activities.
\n
• Apply security best practices related to authentication, authorization, secrets management, cloud security, and Zero Trust principles.
\n

\n

7. Operational Support & Documentation

\n

\n
• Provide L2/L3 support for PKI, certificate lifecycle, TLS/SSL, and Venafi-related incidents.
\n
• Troubleshoot certificate provisioning, renewal failures, trust chain issues, and application integration problems.
\n
• Support service requests, incident management, problem management, change implementation, and production releases.
\n
• Participate in maintenance windows, platform upgrades, and release activities.
\n
• Develop and maintain architecture documents, implementation guides, runbooks, operational procedures, troubleshooting guides, and application onboarding documentation.
\n
• Deliver knowledge transfer and technical guidance to support teams and application owners.
\n
• Ensure operational SLAs and service availability targets are met.
\n

\n

Required Technical Skills

\n

PKI & Cryptography

\n

\n
• Public Key Infrastructure (PKI)
\n
• X.509 Certificates and TLS/SSL
\n
• Certificate Authorities (CA)
\n
• Certificate Revocation Lists (CRL) and OCSP
\n
• Cryptographic Key Management
\n
• Root and Intermediate CA Management
\n
• Hardware Security Modules (HSM)
\n
• Code-Signing Certificates
\n

\n

Venafi Platform

\n

\n
• Venafi Trust Protection Platform (TPP)
\n
• Venafi SaaS
\n
• Certificate Discovery and Automation
\n
• Venafi APIs and vCert Utilities
\n
• Venafi Native Drivers and Adaptable Apps
\n
• Certificate Lifecycle Workflows
\n
• Policy Configuration, Reporting, and Governance
\n

\n

Platforms & Integrations

\n

\n
• Windows Server and IIS
\n
• Linux/Unix
\n
• Microsoft Azure and Azure Key Vault
\n
• Kubernetes and cloud-native environments
\n
• F5 Load Balancers
\n
• Apache, Tomcat, and WebLogic
\n
• Kafka and Solace
\n
• PingFederate
\n
• ServiceNow Integrations
\n

\n

DevOps & Automation

\n

\n
• PowerShell and Python
\n
• REST APIs
\n
• Ansible
\n
• GitHub Actions
\n
• Azure DevOps
\n
• CI/CD Pipeline Integration
\n
• Infrastructure and Certificate Automation
\n

\n

Security Domains

\n

\n
• Authentication and Authorization
\n
• Identity and Access Management (IAM)
\n
• Secrets Management
\n
• Zero Trust Principles
\n
• Cloud Security
\n
• Security Monitoring and Compliance
\n

\n

Qualifications & Experience

\n

\n
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field.
\n
• 8+ years of experience supporting PKI, TLS certificates, or Certificate Lifecycle Management.
\n
• 5+ years of hands-on experience administering and engineering the Venafi platform.
\n
• Strong understanding of PKI architecture, certificate lifecycle processes, and enterprise certificate management.
\n
• Proven experience implementing certificate automation solutions and DevSecOps integrations.
\n
• Experience supporting enterprise-scale certificate environments and application onboarding.
\n
• Strong troubleshooting, analytical, and problem-solving skills.
\n
• Excellent communication, documentation, and stakeholder management skills.
\n

\n

Preferred Candidate Profile

\n

The ideal candidate is a hands-on PKI and Venafi engineer who can manage enterprise certificate environments, lead application onboarding, implement scalable automation solutions, troubleshoot complex certificate issues, and collaborate effectively with application, infrastructure, cloud, and security teams.