PKI Engineer

Job Summary

We are looking for a skilled PKI Engineer to design, implement, manage, and maintain Public Key Infrastructure solutions. The ideal candidate will have experience managing digital certificates, Certificate Authorities (CA), certificate lifecycle management, encryption, and authentication services to ensure secure communication and compliance with organizational security standards.

Key Responsibilities

• Design, implement, configure, and maintain PKI infrastructure.
• Manage Certificate Authorities (CA), including Root CA and Intermediate/Subordinate CA.
• Handle digital certificate issuance, renewal, revocation, and expiration management.
• Manage certificate lifecycle processes and troubleshoot certificate-related issues.
• Work with SSL/TLS certificates, code-signing certificates, and client authentication certificates.
• Administer Microsoft Active Directory Certificate Services (AD CS) and enterprise PKI environments.
• Manage certificate enrollment, auto-enrollment, and certificate templates.
• Support certificate management platforms such as Venafi, DigiCert, or other enterprise certificate management tools.
• Implement and maintain cryptographic standards, encryption protocols, and key management procedures.
• Manage Hardware Security Modules (HSMs), where applicable.
• Monitor certificate expiry, security alerts, and PKI infrastructure availability.
• Troubleshoot SSL/TLS handshake failures, certificate chain issues, and trust-related problems.
• Collaborate with security, infrastructure, application, and network teams.
• Maintain PKI documentation, operational procedures, and audit records.
• Support security audits, compliance requirements, and PKI policy enforcement.
• Manage and support AWS Certificate Manager (ACM) and AWS Private Certificate Authority (AWS Private CA).
• Integrate and manage certificates across AWS services such as Amazon CloudFront, Elastic Load Balancing, and Amazon API Gateway.
• Work with AWS Key Management Service (AWS KMS) for encryption and key management.

Required Technical Skills

• Strong understanding of Public Key Infrastructure (PKI) concepts.
• Knowledge of X.509 certificates, certificate chains, and certificate validation.
• Experience with Certificate Authorities, Root CA, and Intermediate CA.
• Hands-on experience with SSL/TLS certificates and certificate lifecycle management.
• Knowledge of cryptographic algorithms such as RSA, ECC, and SHA-256.
• Understanding of encryption, hashing, digital signatures, and key management.
• Experience with Microsoft AD CS or other enterprise PKI solutions.
• Familiarity with OpenSSL and certificate troubleshooting.
• Knowledge of DNS, TCP/IP, LDAP, Active Directory, and Windows Server.
• Understanding of certificate revocation mechanisms, including CRL and OCSP.
• Knowledge of AWS Certificate Manager (ACM) and AWS Private Certificate Authority (AWS Private CA).
• Familiarity with AWS KMS, AWS IAM, and AWS security best practices.
• Understanding of AWS certificate deployment, monitoring, and lifecycle management.