PKI Engineer | Singapore

Global NTT; Singapore; On-site; SGD 180,000 - 240,000; Full time

Benefits offered by this job

1 Year Renewable Contract

Competitive compensation

Job summary

Global NTT in Singapore seeks an experienced PKI Engineer to own the enterprise Public Key Infrastructure, ensuring high availability, integrity, and security across certificate issuance workflows. You will manage Microsoft ADCS, cloud certificate platforms, and HSMs, and automate lifecycle pipelines with Python, PowerShell, or Shell scripting, supporting TLS 1.3 adoption and audits.

Collaborate with IT ops and development teams to integrate automated enrollment into CI/CD and strengthen

Qualifications

• Bachelor’s degree in CS, Cybersecurity, IT or related field.
• 10+ years in PKI, cybersecurity, or infra security.
• Deep knowledge of PKI, X.509, CA hierarchies, SSL/TLS, cryptographic standards.
• Hands-on with enterprise cert mgmt platforms: ADCS, DigiCert, Entrust, Keyfactor, Venafi, AppViewX.
• Experience in Windows and Linux, plus automation scripting.
• Experience in banking/regulated environments.

Responsibilities

• Own enterprise PKI, ensuring high availability and security.
• Manage CA/RA and certificate management platforms.
• Deploy SSL/TLS certificates across servers, apps, middleware, databases, APIs, and devices.
• Automate certificate lifecycle with PowerShell, Python, or Shell.
• Troubleshoot certificate and TLS issues across distributed environments.
• Support PKI governance, TLS 1.3 adoption, and audits.
• Collaborate with IT operations and development to CI/CD enrollment.

Skills

PKI expertise

X.509 certificates

Automation scripting

Windows

Linux

Regulated environments

Education

Bachelor’s degree in Computer Science

Tools

Microsoft ADCS

DigiCert

Entrust

Keyfactor

Venafi

AppViewX

Job description

Position Summary

Global NTT is seeking an experienced PKI Engineer to join our team in Singapore and drive certificate lifecycle management, cryptographic security, and PKI modernization initiatives. In this specialized security role, you will play a critical part in protecting enterprise infrastructure, managing complex public key infrastructures, and enforcing robust cryptographic controls across multi-platform environments. You will collaborate closely with cross-functional IT and cybersecurity teams to automate certificate provisioning, eliminate service outages caused by expired certificates, and ensure adherence to rigorous compliance frameworks. Ideal candidates bring deep expertise in X.509 standards, enterprise Certificate Authorities, hardware security modules, and scripting automation, coupled with a strong background in financial services or large-scale enterprise security operations.

Detailed Job Description

As a PKI Engineer at Global NTT, you will take full ownership of the enterprise Public Key Infrastructure, ensuring high availability, integrity, and security across all certificate issuance and validation workflows. Your day-to-day responsibilities encompass managing Microsoft ADCS, cloud-based certificate management platforms, and Hardware Security Modules (HSMs) to safeguard sensitive cryptographic keys. You will architect and implement automated certificate lifecycle pipelines using Python, PowerShell, or Shell scripting to streamline issuance, renewal, revocation, and expiration tracking across servers, applications, middleware, databases, APIs, and network devices. You will act as the technical subject matter expert for troubleshooting complex certificate errors, trust-chain failures, and TLS handshake anomalies. Furthermore, you will support strategic security modernization programs, including TLS 1.3 adoption, cryptographic algorithm upgrades, and comprehensive audits to meet regulatory compliance standards.

Key Responsibilities

• Manage and maintain enterprise PKI infrastructure, including Certificate Authorities (CA), Registration Authorities (RA), and certificate management platforms.
• Administer end-to-end certificate lifecycle management covering issuance, renewal, revocation, replacement, and proactive expiration tracking.
• Deploy and support SSL/TLS certificates across diverse servers, applications, middleware, databases, APIs, and network infrastructure devices.
• Manage cryptographic keys, Hardware Security Modules (HSMs), and strict PKI security controls and access policies.
• Automate certificate provisioning, validation, and renewal workflows using PowerShell, Python, or Shell scripting.
• Troubleshoot complex certificate, encryption, authentication, and trust-chain issues across distributed enterprise environments.
• Support PKI governance, regulatory compliance, TLS 1.3 adoption, and enterprise security modernization programs.
• Collaborate with IT operations and development teams to integrate automated certificate enrollment into CI/CD pipelines.

Required Qualifications & Skills

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related technical discipline.
• 10+ years of professional experience in Public Key Infrastructure (PKI), Cybersecurity, or Infrastructure Security.
• Strong knowledge and practical understanding of PKI, X.509 Certificates, CA hierarchies, CRL, OCSP, SSL/TLS protocols, and cryptographic standards.
• Hands-on experience with enterprise certificate management platforms such as Microsoft ADCS, DigiCert, Entrust, Keyfactor, Venafi, AppViewX, or similar tools.
• Proven proficiency in Windows and Linux operating system environments combined with strong automation scripting capabilities.
• Solid understanding of Hardware Security Modules (HSMs), Role-Based Access Control (RBAC), audit controls, and security compliance requirements.
• Prior working experience in banking, financial services, or highly regulated enterprise environments.
• Exceptional analytical, problem-solving, and communication skills with the ability to manage multiple concurrent security initiatives.

Nice-to-Have Skills

• Direct experience with advanced certificate automation protocols such as ACME, SCEP, and EST.
• Familiarity with container security, Kubernetes secret management, and service mesh mTLS configurations.
• Experience with cloud-native key management services across AWS, Azure, or Google Cloud Platform.
• Contribution to open-source security tools or participation in industry cybersecurity forums.
• Prior experience in leading cross-functional migration projects for cryptographic algorithm upgrades (e.g., post-quantum readiness).

Salary/Rate: Competitive and commensurate with experiencen.
Deadline: Open until filled.
Notice Period: As per candidate availability.
Contract Duration: 1 Year Renewable Contract.