Architecture / architect

We are seeking an experienced PKI / Venafi Architect with 10+ years of experience in Public Key Infrastructure (PKI), certificate lifecycle management (CLM), security architecture, and certificate automation. The ideal candidate will lead the design, implementation, governance, and optimization of enterprise PKI and Venafi solutions across hybrid, cloud, and on-premises environments.

The candidate should have strong expertise in enterprise PKI architecture, machine identity management, cryptographic controls, certificate automation, and Venafi Trust Protection Platform (TPP). This role requires close collaboration with Security, Infrastructure, Cloud, DevOps, Identity and Access Management (IAM), and Application teams to deliver scalable, resilient, and secure enterprise trust services.

PKI and Security Architecture

Design, implement, and maintain enterprise PKI architecture, including Root Certificate Authorities (Root CA), Issuing Certificate Authorities (Issuing CA), Certificate Revocation Lists (CRL), Online Certificate Status Protocol (OCSP), Hardware Security Modules (HSM), and enterprise trust frameworks.

Develop and maintain certificate governance standards, security policies, cryptographic controls, and certificate management frameworks.

Architect highly available, scalable, and resilient PKI and Certificate Lifecycle Management (CLM) platforms.

Ensure secure certificate issuance, distribution, renewal, revocation, and retirement processes across enterprise environments.

Venafi Platform Architecture and Engineering

Design, implement, configure, and administer the Venafi Trust Protection Platform (TPP).

Define certificate onboarding standards, workflows, policies, reporting mechanisms, discovery jobs, and role-based access models.

Architect and implement integrations between Venafi and enterprise applications, cloud services, infrastructure platforms, and security solutions.

Lead Venafi platform upgrades, enhancements, troubleshooting, performance optimization, and continuous improvement initiatives.

Establish platform governance, operational standards, and best practices for enterprise-wide certificate management.

Design and implement automated certificate provisioning, renewal, rotation, revocation, and replacement solutions.

Develop certificate automation frameworks using Venafi APIs, vCert, PowerShell, Python, and Ansible.

Integrate certificate lifecycle automation into GitHub Actions, Azure DevOps, and CI/CD pipelines.

Drive adoption of certificate automation across enterprise application portfolios to reduce manual effort and prevent certificate expiration-related outages.

Develop reusable automation scripts, workflows, and integration patterns for application and infrastructure teams.

Collaborate with DevOps and cloud engineering teams to embed certificate management into application deployment and infrastructure provisioning processes.

Work closely with Security, Infrastructure, Cloud, DevOps, IAM, and Application teams to define and implement enterprise certificate management solutions.

Establish secure machine identity practices and cryptographic control standards across hybrid, cloud, and on-premises environments.

Provide architecture guidance, technical leadership, and recommendations for PKI modernization and certificate management initiatives.

Support the implementation of scalable, secure, and highly available trust services aligned with enterprise security requirements.

10+ years of experience in PKI, security architecture, certificate management, or related security engineering domains.

• Strong expertise in enterprise PKI architecture, including Root CA, Issuing CA, CRL, OCSP, HSM, and trust frameworks.
• Hands-on experience with Venafi Trust Protection Platform (TPP) architecture, administration, integration, and optimization.
• Experience designing and implementing automated certificate provisioning, renewal, rotation, and revocation workflows.
• Hands-on experience with Venafi APIs and automation technologies such as vCert, PowerShell, Python, and Ansible.
• Experience integrating certificate automation with GitHub Actions, Azure DevOps, and CI/CD pipelines.
• Ability to architect Venafi integrations with enterprise applications, cloud services, infrastructure, and security platforms.
• Experience supporting PKI and certificate management solutions across hybrid, cloud, and on-premises environments.
• Strong understanding of security best practices, access controls, high availability, resilience, and enterprise platform governance.
• Excellent architecture, troubleshooting, technical leadership, communication, and cross-functional collaboration skills.

Knowledge of cloud-native certificate management and machine identity security.

Ability to work effectively with security architects, infrastructure engineers, application teams, and DevOps stakeholders.

We consider qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable federal, state, or local law.