PKI, HSM & Certificate Services Sr. Engineer

3mcompany; Bengaluru; Hybrid; INR 3,000,000 - 4,200,000; Full time

Job summary

Solventum is seeking a hands-on PKI/HSM Crypto Sr. Security Engineer to design, administer, automate, and support enterprise PKI and certificate services globally.

You will manage Thales Luna HSM, Keyfactor automation, and Sectigo integrations, ensuring policy enforcement and secure key management across cloud and on-premises environments. The role requires strong cryptography expertise, ADCS experience, and the ability to operate in a hybrid setup with on-call rotations for high-severity

Qualifications

• Bachelor’s degree or higher with 7+ years of PKI, certificate management, HSM, or related security experience.
• Experience with ADCS, Windows Server environments, and enterprise templates.
• Experience with certificate lifecycle automation platforms such as Keyfactor.

Responsibilities

• Design, implement, administer, and support enterprise PKI and certificate lifecycle automation.
• Manage Thales Luna HSM platforms, including backups, partition management, and firmware upgrades.
• Handle external public certificate services via Sectigo and domain validation.
• Troubleshoot PKI, TLS/SSL, code signing, and cryptographic issues across apps and infra.
• Develop PKI architectures and key management procedures aligned with security standards.
• Collaborate with security, infra, and cloud teams to deploy secure cryptographic solutions.

Skills

Enterprise PKI

Certificate management

HSM administration

Cryptography

ADCS

Keyfactor

TLS/SSL

Policy & compliance

Scripting (PowerShell/Python)

API & automation

Education

Bachelor’s degree or higher in relevant field

Tools

Thales Luna HSM

Keyfactor

Sectigo Certificate Manager

Job description

## PKI, HSM & Certificate Services Sr. EngineerApply: Hybrid: IN, Bangalore Kar: Full time: Posted Today: R01133008At Solventum, we improve lives by helping healthcare professionals do their best work. Join a team using innovation and insight to make a real impact on the future of healthcare. All roles listed are with Solventum, and we’re committed to protecting your personal information—learn more in our Privacy Policy: https://www.solventum.com/en-us/home/legal/website-privacy-statement/applicant-privacy/**Job Description:****3M Health Care is now Solventum****At Solventum, we enable better, smarter, safer healthcare to improve lives. As a new company with a long legacy of creating breakthrough solutions for our customers’ toughest challenges, we pioneer game-changing innovations at the intersection of health, material and data science that change patients' lives for the better while enabling healthcare professionals to perform at their best. Because people, and their wellbeing, are at the heart of every scientific advancement we pursue.****We partner closely with the brightest minds in healthcare to ensure that every solution we create melds the latest technology with compassion and empathy. Because at Solventum, we never stop solving for you.****The Impact You’ll Make in this Role***You are a hands-on cryptography and certificate services engineer supporting a next-generation Identity and Access Management team. You will help design, administer, automate, and support enterprise Public Key Infrastructure (PKI), Hardware Security Module (HSM), certificate lifecycle management, and cryptographic services across Solventum’s global environment.**You are excited about strengthening cryptographic foundations in a large global company by supporting secure certificate issuance, lifecycle automation, key protection, and platform resiliency across cloud, on-premises, third-party hosted, and co-location environments.**You are a self-driven, hands-on individual who enjoys solving complex PKI, HSM, certificate, TLS/SSL, code-signing, and key management challenges. You bring strong technical depth, operational discipline, and a continuous improvement mindset to critical security services.*As a PKI/HSM Crypto Sr. Security Engineer you will have the opportunity to tap into your curiosity and collaborate with some of the most innovative and diverse people around the world. Here, you will make an impact by:* Designing, implementing, administering, and supporting enterprise PKI solutions, including Microsoft ADCS and Keyfactor certificate lifecycle automation platforms.* Managing the full certificate lifecycle, including issuance, renewal, revocation, inventory management, policy enforcement, and automation for internal and external certificates.* Administering and maintaining Thales Luna HSM platforms, including key generation, backup, recovery, partition management, firmware upgrades, and security compliance activities.* Managing external public certificate services through Sectigo, including certificate provisioning, domain validation, organization validation, and integrations with enterprise applications and services.* Developing and maintaining PKI architectures, cryptographic standards, and key management procedures aligned with security and regulatory requirements.* Troubleshooting complex PKI, certificate, TLS/SSL, code-signing, and cryptographic issues across enterprise applications, network devices, cloud services, and security platforms.* Implementing and supporting certificate automation and integrations with web servers, load balancers, network appliances, cloud platforms, DevOps pipelines, and identity solutions.* Ensuring compliance with industry standards and security frameworks, including NIST, PCI-DSS, SOX, ISO 27001, and CA/Browser Forum requirements where applicable.* Performing PKI risk assessments, security reviews, disaster recovery testing, key ceremonies, and operational readiness activities for critical cryptographic infrastructure.* Collaborating with security, infrastructure, application, and cloud engineering teams to design secure cryptographic solutions and support enterprise security initiatives. To set you up for success in this role from day one, Solventum requires (at a minimum) the following qualifications:* Bachelor’s Degree or higher AND 7 years of enterprise PKI, certificate management, HSM, cryptography, infrastructure security, or related experience* In addition to the above requirements, the following are also required:5+ years of hands-on experience administering enterprise PKI or certificate management environments, including certificate issuance, renewal, revocation, inventory, and lifecycle operations.* Experience supporting Microsoft Active Directory Certificate Services (ADCS), Windows Server environments, and enterprise certificate templates or enrollment workflows.* Experience with certificate lifecycle automation platforms such as Keyfactor, including certificate discovery, enrollment, renewal, workflow, and integration support.* Experience administering HSM platforms or secure key management technologies, including key generation, backup, recovery, partition management, and operational controls.Strong understanding of X.509 certificates, CRL, OCSP, PKCS standards, TLS/SSL, code signing, encryption, and cryptographic key management concepts.* Experience troubleshooting PKI, certificate chain, TLS/SSL, certificate deployment, code-signing, and cryptographic issues across enterprise applications and infrastructure.* Willingness to participate in an on-call rotation as an escalation point for high-severity PKI, HSM, certificate, and cryptographic service issues.* Additional qualifications that could help you succeed even further in this role include: 10+ years of experience administering enterprise PKI and certificate management environments.* Hands-on experience with Keyfactor, Sectigo Certificate Manager, and Thales Luna HSM platforms* Experience managing public certificate services, including certificate provisioning, domain validation, organization validation, and externally trusted certificate operations.* Experience supporting certificate automation through APIs, scripting, ACME, SCEP, ServiceNow workflows, cloud platforms, DevOps pipelines, or enterprise application integrations.* Experience performing PKI risk assessments, disaster recovery testing, key ceremonies, operational readiness reviews, and audit or compliance support.* Advanced scripting or automation skills, including PowerShell, Python, REST APIs, or other automation frameworks.