PKI Certificate Management - Security Identity Engineer

lseg; Bengaluru; On-site; INR 2,400,000 - 4,800,000; Full time

Job summary

LSEG is seeking a Security PKI Engineer to design, operate, and continuously improve its PKI and CLM capabilities across enterprise and cloud environments. You will work with architects, security teams, and owners to deliver reliable identity, authentication, and encryption services while driving automation and operational excellence.

Responsibilities include managing PKI components, certificate validation, and end-to-end lifecycle processes, with a focus on availability, performance, and secure

Qualifications

• Bachelor's degree in Computer Science, Cyber Security, Engineering, or a related technical discipline.
• 7+ years of experience in PKI, Cyber Security, Identity & Access Management, or security engineering.
• Expert understanding of PKI, X.509 certificates, certificate chains, trust models, and certificate validation.

Responsibilities

• Engineer, administer, and maintain PKI components including Root, Intermediate, and Issuing Certificate Authorities.
• Operating and supporting certificate validation and distribution services including CRLs, OCSP, AIA, and CDP.
• Executing end-to-end certificate lifecycle processes: request validation, issuance, renewal, revocation, and retirement.
• Ensuring essential PKI and CLM processes meet high-quality standards through strong operational controls, documentation, and repeatable runbooks.
• Maintaining certificate inventory hygiene and reduce operational risk by proactively addressing expirations and crypto compliance gaps.

Skills

PKI expertise

X.509 certs

Automation

Python

PowerShell

Bash

Cloud PKI

SRE mindset

AD Entra ID

Education

B.Tech in CS

Tools

DigiCert

Keyfactor

Venafi

Entrust

Sectigo

EJBCA

AD CS

Kubernetes

Job description

Role Summary

The Security PKI Engineer will be responsible for engineering, operating, and continuously improving LSEG's Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) capabilities. This role ensures trusted identity, authentication, and encryption services are reliable, scalable, and secure across enterprise and cloud environments. You will contribute to designs and production improvements that increase availability, performance, and operational efficiency, partnering closely with architects, security teams, infrastructure, and application owners to deliver measurable outcomes on agreed priorities and timelines.

Key Responsibilities

• Engineer, administer, and maintain PKI components including Root, Intermediate, and Issuing Certificate Authorities.
• Operating and supporting certificate validation and distribution services including CRLs, OCSP, AIA, and CDP.
• Executing end-to-end certificate lifecycle processes: request validation, issuance, renewal, revocation, and retirement.
• Ensuring essential PKI and CLM processes meet high-quality standards through strong operational controls, documentation, and repeatable runbooks.
• Maintaining certificate inventory hygiene and reduce operational risk by proactively addressing expirations and crypto compliance gaps.
• Driving project priorities, deadlines, and outcomes for PKI and CLM engineering deliverables.
• Applying deep knowledge of site reliability, software engineering, tooling, frameworks, infrastructure, and systems to deliver each task effectively.
• Contributing to designs of software components, systems, and features that improve availability, scalability, latency, and efficiency of LSEG services.
• Participating in sustainable incident response and production improvements, including root cause analysis and preventive remediation.
• Building automation to prevent problem recurrence and implementing automated responses for non-exceptional service conditions.
• Writing and reviewing optimized and accurate automation code and scripts to improve certificate operations and reliability.
• Providing feedback and suggested improvements through peer code reviews, focusing on quality, performance, and maintainability.
• Improving monitoring and alerting for certificate expiry, CA health, OCSP and CRL availability, and CLM workflow performance.
• Supporting integration of CLM workflows with enterprise tooling and APIs to reduce manual effort and improve governance.
• Partnering with architects to decompose solutions for technology systems and products, aligning PKI and CLM designs to platform standards.
• Acting as a point of contact within the PKI domain by demonstrating strong depth of knowledge and building awareness of adjacent domains to manage dependencies.
• Proactively building and applying relevant domain knowledge related to workflows, data pipelines, business policies, configurations, and constraints.
• Providing mentorship and advice to team members on improving availability and performance of critical services.

Qualifications

• Bachelor's degree in Computer Science, Cyber Security, Engineering, or a related technical discipline.
• 7+ years of experience in PKI, Cyber Security, Identity & Access Management, or security engineering.
• Expert understanding of PKI, X.509 certificates, certificate chains, trust models, and certificate validation.
• Strong experience with Certificate Authorities and supporting services, including Root, Intermediate, and Issuing CAs, CRLs, OCSP, AIA, and CDP.
• Hands-on experience with enterprise PKI and CLM platforms such as Microsoft AD CS, CyberArk Certificate Manager (Venafi), DigiCert, Keyfactor, Entrust, Sectigo, or EJBCA.
• Strong understanding of key management, HSMs, KSPs, CSPs, certificate lifecycle management, and cryptographic controls.
• Experience designing and implementing PKI automation using APIs, PowerShell, Python, or Bash.
• Strong knowledge of Active Directory, Entra ID, Kerberos, NTLM, SAML, OAuth, OIDC, and identity federation.
• Experience operating PKI services across Azure, AWS, and/or GCP, including cloud-native certificate management patterns.
• Strong understanding of networking and security protocols, including TCP/IP, DNS, TLS, mTLS, firewalls, and load balancing.
• Experience operating security-critical services with an SRE mindset, including monitoring, alerting, incident response, and service resilience.
• Experience supporting crypto agility and Post-Quantum Cryptography (PQC) readiness initiatives, including certificate discovery, cryptographic inventory, automation, migration planning, and adoption of emerging NIST PQC standards.
• Experience with code signing, software supply chain security, Kubernetes certificate automation, and PKI architecture design.

Certifications (Nice to have)

• Security Certifications (SSCP, CompTIA Security+)
• Azure/AWS/GCP cloud security certifications
• PKI/CLM platform training and/or public CA program familiarity

Career Stage

Manage