Senior PKI & IAM Security Engineer

Roles and Responsibilities: Assess existing PKI infrastructure, CA hierarchies, trust relationships, certificates, and cryptographic configurations. Design and implement modern, scalable, and automated PKI architectures, including offline root CA, intermediate/issuing CAs, and HSM-backed key protection. Lead enterprise PKI migrations, CA rebuilds, certificate re-issuance, trust store distribution, and legacy CA decommissioning with minimal production disruption. Administer Microsoft Active Directory Certificate Services (ADCS) in multi-tier and multi-forest environments. Implement and manage certificate lifecycle management platforms such as Venafi, Keyfactor, and AppViewX. Perform certificate discovery, onboarding, renewal, revocation, and lifecycle automation. Manage Hardware Security Modules (HSMs), including Thales Luna and Entrust nShield, and participate in cryptographic key ceremonies. Design, implement, and support IAM solutions, including SSO, MFA, user lifecycle management, and access certification. Develop automation using PowerShell, Python, REST APIs, and JSON. Support security assessments, compliance audits, and security policy development. Collaborate with security architects, infrastructure, cloud, and engineering teams to implement enterprise security solutions. Develop technical documentation, migration plans, security standards, and operational procedures. Required Skills & Qualifications Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field. 7+ years of cybersecurity or infrastructure engineering experience. 5+ years of hands-on enterprise PKI experience and 4+ years of IAM engineering experience. Proven experience leading enterprise PKI migrations, CA rebuilds, or cryptographic modernization initiatives. Strong expertise in Microsoft ADCS and multi-tier, multi-forest PKI environments. Hands-on experience with Venafi, Keyfactor, AppViewX, or similar certificate lifecycle management platforms. Experience administering HSM solutions such as Thales Luna or Entrust nShield. Strong knowledge of certificate management, OCSP, CRL, certificate authorities, and cryptographic key management. IAM experience with SSO, MFA, identity lifecycle automation, and access governance. Strong scripting and automation skills using PowerShell and Python. Experience with REST APIs, JSON, and enterprise security automation. Knowledge of security compliance frameworks such as SOX, PCI DSS, and HIPAA. Strong communication, documentation, and stakeholder management skills.

Preferred Qualifications: Cloud PKI and key management experience with Azure Key Vault, Azure Managed HSM, AWS Private CA, AWS ACM, AWS KMS, or Google Cloud Certificate Authority Service. Experience with workload identity solutions such as SPIFFE/SPIRE, Kubernetes cert-manager, and service mesh mTLS. Knowledge of HashiCorp Vault, CyberArk, or Delinea. Experience with cloud security architecture and enterprise cryptographic modernization.