PKI Engineer, Consultant

In this role, you will design, operate, and improve the company’s certificate services. You will bring deep public key infrastructure (PKI) expertise and use automation to make certificate issuance, renewal, and revocation reliable at scale. You will also integrate PKI with cloud services and development workflows, partnering closely with security, platform, and application teams on an identity platform engineering team.

NOTE:  *Must be eligible to work on W2 without sponsorship. Not eligible for C2C.

• Design and operate certificate authorities, registration authorities, HSM integrations, and certificate management services.


• Establish sound practices for key protection, access control, auditing, and recovery.

Certificate Lifecycle Management

• Own certificate lifecycle processes, including enrollment, issuance, renewal, revocation, monitoring, and incident response.


• Build automation that reduces manual certificate work and prevents outages caused by expired or misconfigured certificates.

Cloud Integration & Infrastructure as Code

• Integrate PKI with applications, devices, and services running on premises and in AWS or Azure.


• Define and maintain infrastructure as code for PKI services and supporting cloud infrastructure.

Collaboration & Innovation

• Partner with security, platform, and application teams to make certificate use secure and straightforward.


• Evaluate practical uses of AI to improve operational workflows while applying appropriate review and security controls.

• 7+ years of experience in PKI, certificate services, or security infrastructure engineering.


• Expert knowledge of CA architecture, certificate profiles and policies, key management, revocation, and the X.509 certificate lifecycle.


• Hands-on experience operating production PKI services and troubleshooting certificate, trust chain, and TLS issues.


• Experience with AWS or Azure and integrating certificate services with cloud workloads.


• Strong automation skills in Python, PowerShell, or Go, plus infrastructure as code experience with Terraform, Bicep, or CloudFormation.


• Familiarity with certificate enrollment and automation protocols such as ACME, SCEP, or EST.


• Ability to document designs clearly and work across security and engineering teams.