PKI & Certificate Engineer

Tata Consultancy Services; Taguig; On-site; PHP 1,000,000 - 2,000,000; Full time

Job summary

Tata Consultancy Services Limited seeks an experienced PKI Engineer to manage enterprise PKI, certificate lifecycle, and HSM operations across the Bank environment. You will administer, monitor, and improve digital certificate infrastructure, ensuring security, availability, and regulatory compliance.

The role requires hands-on experience with X.509, SSL/TLS, AD CS, and automation using PowerShell/Python, with strong problem-solving and documentation skills for ongoing operations and

Qualifications

• 5+ years hands-on PKI, cryptography, or certificate management.
• Strong troubleshooting of certificate, SSL/TLS, trust chains, and cryptographic services.
• Experience operating highly available security infrastructure.
• Analytical, documentation, stakeholder-management and RC/mcc skills.
• Willingness to support incidents outside standard hours when required.

Responsibilities

• Perform daily PKI, certificate, and health monitoring administration.
• Manage complete certificate lifecycle: discovery, enrollment, issuance, renewal, revocation, retirement.
• Administer X.509 certs, SSL/TLS, trust stores, CRLs, and OCSP services.
• Coordinate renewals to prevent service disruption.
• Operate Thales/UtliHSM platforms; manage key storage, rotation, backup.
• Develop automation for PKI/HSM operations using PowerShell/Python.
• Integrate PKI with apps via APIs and standard protocols.
• Monitor availability, capacity, security events, and audit logs; perform incident analysis.
• Maintain SOPs, runbooks, inventories, change records, and audit evidence.
• Support change control, DR testing, audits, and on-call PKI services.

Skills

Enterprise PKI operations

X.509/SSL/TLS expertise

AD CS / enterprise CA

HSM and key management

Automation scripting (PowerShell)

Automation scripting (Python)

Windows Server administration

Linux administration

Incident/problem/change management

Regulatory evidence management

Tools

PowerShell

Python

Windows Server

Linux

Job description

Responsible for the administration, engineering, operation, and continuous improvement of enterprise Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) services, ensuring certificates and cryptographic services remain secure, available, compliant, and effectively managed across the Bank environment.

Primary Responsibilities

• Perform daily administration, health monitoring, maintenance, and operational support of enterprise PKI and digital certificate infrastructure.
• Manage the complete certificate lifecycle: discovery, inventory, request, enrollment, issuance, installation, renewal, revocation, retirement, and expiry monitoring.
• Administer and troubleshoot X.509 certificates, SSL/TLS, certificate chains, trust stores, Certificate Revocation Lists (CRLs), and Online Certificate Status Protocol (OCSP) services.
• Manage integrations with private and public Certificate Authorities and provision certificates across servers, applications, network and security devices, cloud platforms, and workloads.
• Proactively monitor certificate expiration and coordinate renewals to prevent certificate-related service disruption.
• Operate Hardware Security Modules (HSMs), support cryptographic key management, key rotation, secure key storage, backup/restore, and controlled key ceremonies.
• Configure and administer Thales and/or Utimaco HSM platforms and associated management components.
• Develop and maintain PowerShell/Python automation for repeatable PKI, certificate, and HSM operations.
• Integrate PKI and certificate services with applications and enterprise platforms using APIs and standard certificate-management protocols.
• Monitor PKI/HSM availability, capacity, performance, security events, and audit logs; investigate alerts and implement corrective actions.
• Perform incident troubleshooting, root-cause analysis, problem management, and remediation for PKI and certificate-related issues.
• Maintain SOPs, operational runbooks, architecture/configuration records, certificate inventories, change records, and audit evidence.
• Participate in change management, vulnerability remediation, disaster recovery testing, audits, and on-call support for critical PKI services.

Required Technical Skills

• Enterprise PKI architecture, operations, and certificate trust models.
• X.509 certificates, SSL/TLS, certificate chain validation, CRL, and OCSP.
• Microsoft Active Directory Certificate Services (AD CS) or equivalent enterprise CA platform.
• Hardware Security Modules and cryptographic key-management principles.
• Certificate discovery, inventory, expiry monitoring, renewal, revocation, and policy enforcement.
• Windows Server and Linux administration for PKI/security components.
• PowerShell and/or Python scripting for automation and operational support.
• Incident, problem, change, release, and configuration management processes.
• Security hardening, privileged access control, audit logging, and regulatory evidence management.

Preferred Skills

• AppViewX CERT+ / PKI+ or another enterprise Certificate Lifecycle Management platform.
• Thales HSM, Utimaco HSM, Entrust, DigiCert, or comparable CA/HSM technologies.
• Azure and AWS certificate integration, including certificates used by cloud services and workloads.
• ACME, SCEP, EST, REST APIs, DevOps/CI-CD integrations, and automated certificate deployment.
• ServiceNow or equivalent ITSM integration; SIEM monitoring through Microsoft Sentinel or a comparable platform.
• Experience supporting certificate services in a banking or regulated financial-services environment.

Required Experience and Qualifications

• 5+ years of hands-on experience in PKI, cryptography, certificate management, data security, or a related security-engineering function.
• Strong hands-on experience troubleshooting certificate, SSL/TLS, trust-chain, and cryptographic service issues.
• Experience operating highly available and business-critical security infrastructure.
• Strong analytical, documentation, stakeholder-management, and root-cause-analysis skills.
• Ability to support scheduled changes and critical incidents outside standard business hours when required.

Secondary / Behavioral Skills

• Clear written and verbal communication with application, infrastructure, network, cloud, audit, and risk stakeholders.
• Strong ownership, attention to detail, and disciplined execution of controlled cryptographic processes.
• Ability to prioritize certificate-expiry, service-availability, security, and compliance risks.
• Good working knowledge of ITSM service-management tools and operational reporting.