PKI & Certificate Management Engineer

Tasks

• Manage the end-to-end SSL/TLS certificate lifecycle, including issuance, renewal, revocation, and automation.
• Administer PKI platforms such as Microsoft CA, Venafi, DigiCert, Entrust, and Sectigo.
• Manage Enterprise Key Management (EKM), encryption keys, HSMs, and key rotation.
• Implement certificate discovery, monitoring, and expiration alerts.
• Support cloud key management services such as Azure Key Vault, AWS KMS, and Google Cloud KMS.
• Troubleshoot certificate issues affecting applications, servers, APIs, and network devices.
• Automate certificate and key management using PowerShell, Python, Bash, or REST APIs.
• Ensure compliance with security standards and regulatory requirements.
• Collaborate with Security, Infrastructure, Application, and DevOps teams.

Requirements

• PKI architecture and administration.
• SSL/TLS protocols, X.509 certificates, CSRs, and Certificate Authorities (CA).
• Certificate lifecycle management and automation.
• Venafi, DigiCert, Entrust, Sectigo, or Microsoft PKI.
• Enterprise Key Management and HSM technologies such as Thales, SafeNet, or Luna HSM.
• Cryptographic algorithms: RSA, ECC, AES, and SHA-256.
• Scripting with PowerShell, Python, or Bash.
• Experience with Azure, AWS, or GCP hybrid cloud environments (preferred).
• Knowledge of DevSecOps and CI/CD integration (preferred).
• Experience managing Kubernetes secrets and certificates (preferred).
• Relevant certifications such as CISSP, Azure Security Engineer (AZ-500), or Certified PKI Professional (preferred).

How to apply

• Share your updated resume by email.

Location

• Denver, CO