Identity Architect

Astellas; Bengaluru; Hybrid; INR 2,100,000 - 3,600,000; Full time

Job summary

Astellas is seeking an Identity Engineer in Bengaluru to design, administer, and modernize enterprise PKI services across on-premises, hybrid, and cloud environments. You will manage CA infrastructure, certificate lifecycles, and secure key management, driving automation with PowerShell and ensuring compliance.

Required are 8–12+ years in PKI, strong AD CS expertise, and experience with cloud PKI and Entra ID. The role offers hybrid work with balance for collaboration and remote work.

Qualifications

• 8 to 12+ years hands-on PKI management experience.
• Strong experience with AD CS, CA, templates, enrollment, and lifecycle processes.
• PKI design, trust chains, and cryptographic concepts.
• Automation via PowerShell for PKI administration.
• Experience with cloud/hybrid PKI, Entra ID, Intune, and Azure services.
• Knowledge of governance, compliance, cryptographic standards, and security best practices.
• Strong troubleshooting and stakeholder communication skills.

Responsibilities

• Administer and support enterprise PKI environments (AD CS, CA, RA, Online Responders).
• Manage certificate issuance, renewal, revocation, validation, and recovery for users and devices.
• Design PKI architectures, templates, policies, trust hierarchies, and cryptographic standards.
• Automate certificate enrollment, renewal, discovery, inventory, and compliance monitoring.
• Administer HSMs and cryptographic key management systems; ensure secure storage.
• Deploy certificate-based authentication across servers, apps, VPNs, and devices.
• Monitor PKI health, expiration risks, and security vulnerabilities; perform health checks.
• Support cloud PKI solutions such as Microsoft Cloud PKI, Entra ID integrations.
• Develop automation and maintain PKI documentation and governance evidence.

Skills

PKI design

PKI administration

Certificate lifecycle management

PowerShell scripting

Cloud PKI / Azure Key Vault

Security & cryptography basics

Certificate-based authentication

Troubleshooting

Stakeholder communication

Tools

Active Directory Certificate Services (AD CS)

Certificate Authorities (CA)

Azure Key Vault

HSMs

Intune

DigiCert

Keyfactor

Venafi

Job description

Astellas is a global life sciences company committed to turning innovative science into VALUE for patients. We provide transformative therapies in disease areas that include oncology, ophthalmology, urology, immunology and women's health. Through our research and development programs, we are pioneering new healthcare solutions for diseases with high unmet medical need. Learn more at Astellas.com .

Are you driven to make a real difference in the lives of patients?

We're seeking passionate individuals who thrive in dynamic environments, embrace new ideas, and aren't afraid to take intelligent risks. People who act with unwavering integrity and are deeply committed to making a tangible impact.

Purpose and Scope:
As an Identity Engineer, you will be responsible for designing, administering, supporting, and modernizing enterprise Public Key Infrastructure (PKI) services, including Certificate Authorities (CA), certificate lifecycle management, and cryptographic key management solutions. The role focuses on enhancing security, automating certificate operations, ensuring compliance, and delivering scalable certificate-based authentication and encryption services across on-premises, hybrid, and cloud environments.

Responsibilities and Accountabilities:

• Administer, maintain, and support enterprise Public Key Infrastructure (PKI) environments, including Microsoft Certificate Services (AD CS), Certificate Authorities (CA), Registration Authorities (RA), Online Responders, and certificate lifecycle management platforms.
• Manage certificate issuance, renewal, revocation, validation, and recovery processes for users, servers, applications, devices, and non-human identities.
• Design, implement, and maintain PKI architectures, certificate templates, certificate policies, trust hierarchies, and cryptographic standards aligned with business and security requirements.
• Support enterprise certificate lifecycle management solutions, automating certificate enrolment, renewal, discovery, inventory management, and compliance monitoring.
• Administer and maintain Hardware Security Modules (HSMs), cryptographic key management systems, key backup procedures, and secure key storage practices.
• Support digital certificate deployments across servers, applications, web services, databases, network devices, cloud services, VPNs, and authentication platforms.
• Implement and maintain certificate-based authentication solutions, including Smart Cards, FIDO, device certificates, Wi‑Fi authentication, VPN authentication, and mutual TLS (mTLS).
• Monitor PKI infrastructure health, certificate expiration risks, cryptographic compliance, and security vulnerabilities to ensure continuous service availability.
• Perform PKI assessments, health checks, audits, security reviews, remediation activities, and modernization initiatives aligned with industry best practices.
• Support cloud‑based PKI solutions, including Microsoft Cloud PKI, Azure Key Vault, and integrations with Microsoft Entra ID, Intune, and security platforms.
• Develop and maintain automation solutions using PowerShell and related scripting technologies to simplify certificate lifecycle management and operational activities.
• Maintain PKI documentation, operational procedures, governance standards, audit evidence, and compliance requirements supporting regulatory and security obligations.

Location(s)

Requirements

Required Qualifications:

• 8 to 12+ years of hands‑on experience managing enterprise Public Key Infrastructure (PKI) environments and certificate lifecycle management solutions.
  
• Strong practical experience with Microsoft Active Directory Certificate Services (AD CS), Certificate Authorities (CA), certificate templates, certificate enrollment, and certificate lifecycle processes.
  
• Demonstrated hands‑on expertise in:
  
  • Public Key Infrastructure (PKI) design and administration.
    
  • Certificate Authorities, Certificate Revocation Lists (CRLs), Online Certificate Status Protocol (OCSP), and certificate trust chains.
    
  • Cryptographic concepts including public/private keys, digital signatures, encryption, hashing algorithms, and key management.
    
  • Hardware Security Modules (HSMs), Azure Key Vault, and cryptographic key protection mechanisms.
    
  • Certificate‑based authentication, TLS/SSL, mutual TLS (mTLS), code signing, and secure communications.
    
• Experience implementing certificate lifecycle management solutions and certificate automation across enterprise environments.
  
• Experience supporting cloud and hybrid PKI environments integrated with Microsoft Entra ID, Intune, Azure services, and enterprise security platforms.
  
• Strong knowledge of certificate governance, compliance requirements, cryptographic standards, and security best practices.
  
• Experience with PowerShell scripting and automation for PKI administration, certificate management, and reporting.
  
• Strong troubleshooting, analytical, and problem‑solving skills within complex enterprise environments.
  
• Effective verbal and written communication skills, capable of working with technical and non‑technical stakeholders .

Preferred Qualifications:

• Experience with DigiCert, Keyfactor, AppViewX, Venafi, Microsoft Cloud PKI, or similar certificate lifecycle management platforms.
  
• Experience with Microsoft Intune certificate deployment (SCEP/PKCS), Azure Key Vault, HSM technologies, cryptographic key management, and enterprise PKI governance.
  
• Experience implementing certificate automation, non‑human identity (NHI) management, machine identity security, and PKI modernization initiatives.
  
• Knowledge of Zero Trust, modern identity security, certificate‑based authentication, quantum‑safe cryptography trends, and cloud security architectures.
  
• Microsoft certifications such as SC‑300, AZ‑500, AZ‑104, or relevant PKI/security certifications; healthcare or other regulated industry experience is a plus.

At Astellas we recognize the importance of work/life balance, and we are proud to offer a hybrid working solution allowing time to connect with colleagues at the office with the flexibility to also work from home. We believe this will optimize the most productive work environment for all employees to succeed and deliver. Hybrid work from certain locations may be permitted in accordance with Astellas’ Responsible Flexibility

What awaits you at Astellas?

• Global collaboration: Become part of a connected global business of like‑minded life science leaders, all dedicated to improving patients' lives worldwide.
• Real‑world patient impact: Contribute to transformative therapies that reach patients around the world, knowing your work makes a difference every day.
• Relentless Innovation: Join a company at the forefront of scientific breakthroughs,whereyou'llhave the opportunity to shape the future of healthcare.
• A Culture of Growth: Chart your own course within a supportive environment thatvalues your contributions, champions your development, and empowers you topursue your passions.

Our Organizational Values and Behaviors

Values: Innovation, Integrity and Impact sit at the heart of what we do.

Behaviors: We come together as ‘One Astellas’,working with courage and a sense ofurgency. We are outcome focused and consistently take accountability for our personalcontribution.

Our organization is committed to diversity, equal opportunity, and affirmative action. We are an equal opportunity employer. All applicants will be considered without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity, or any other protected characteristic.