Forward Deployed PKI Engineer

ITVA; Oregon; Hybrid; USD 140,000 - 210,000; Full time

Job summary

ITVA, Inc. is seeking an experienced Forward Deployed PKI Engineer to deploy certificate lifecycle management and AI-driven automation in enterprise environments.

You will work with customers to modernize certificate operations, automate PKI workflows, and influence product direction in the area of post-quantum readiness. You will collaborate with IT and security teams, design scalable PKI solutions, and help define the future of enterprise certificate management.

Qualifications

• 7+ years of hands-on enterprise PKI experience.
• Deep understanding of X.509 certificates, certificate chains, trust models, TLS, and mutual TLS.
• Extensive experience administering Microsoft Active Directory Certificate Services (AD CS) or comparable PKI systems.
• Strong knowledge of certificate issuance, renewal, revocation, CRLs, OCSP, CSRs, and certificate templates.
• Experience managing certificates across Windows and Linux servers and enterprise applications.
• Proven ability to troubleshoot complex PKI and cryptographic issues independently.
• Experience with scripting for automation (PowerShell, Python, Bash).
• Strong communication skills and experience collaborating with enterprise customers.

Responsibilities

• Lead deployments of ITVA's certificate lifecycle management across complex enterprise environments.
• Integrate ITVA with enterprise CAs (AD CS and commercial CA platforms).
• Implement AI-powered certificate discovery, monitoring, and lifecycle automation workflows.
• Automate certificate issuance, renewal, revocation, and deployment across diverse systems.
• Collaborate with customer security, infrastructure, and PKI teams to understand challenges.
• Troubleshoot PKI issues involving chains, trust stores, TLS, and enrollment protocols.
• Help enterprises evaluate cryptographic risks and post-quantum readiness.
• Collaborate with ITVA's software engineers to design new product features and integrations.
• Translate customer requirements into scalable product improvements.
• Serve as trusted advisor for PKI modernization initiatives.

Skills

Enterprise PKI

X.509 certificates

AD CS

TLS/mTLS

PKI automation

PowerShell/Python/Bash

Communication with customers

AI-driven security

Tools

AD CS

DigiCert

Venafi

Keyfactor

Sectigo

HSMs

Job description

About ITVA

ITVA is building an AI-native platform transforming how enterprises manage and secure their IT infrastructure. Our technology combines infrastructure visibility, automation, cybersecurity, certificate lifecycle management, and IT operations into a single intelligent platform.As enterprises face increasingly complex security requirements and prepare for a post-quantum future, we're building technology that brings AI-driven intelligence and automation to critical infrastructure security.We're looking for experienced PKI engineers and administrators who want to help lead this transformation.

About the Role

As a Forward Deployed PKI Engineer, you'll work at the intersection of enterprise cryptography, artificial intelligence, and software engineering.You'll help deploy ITVA's certificate lifecycle management and security automation capabilities into some of the world's most critical enterprise infrastructure.You'll work directly with customers to modernize certificate operations, automate complex PKI workflows, and introduce AI-powered capabilities into environments where security and reliability are essential.This isn't a traditional PKI administration role. You'll have the opportunity to help define the future of enterprise certificate management, contribute directly to our product, and work on emerging challenges such as post-quantum cryptography readiness.

What You’ll Do

• Lead deployments of ITVA's certificate lifecycle management capabilities across complex enterprise customer environments.
• Integrate ITVA with enterprise certificate authorities, including Microsoft Active Directory Certificate Services (AD CS) and commercial CA platforms.
• Implement AI-powered certificate discovery, monitoring, troubleshooting, and lifecycle automation workflows.
• Automate certificate issuance, renewal, revocation, and deployment across diverse enterprise systems.
• Work directly with customer security, infrastructure, and PKI teams to understand their operational challenges.
• Troubleshoot complex PKI issues involving certificate chains, trust stores, TLS, mutual TLS, and enrollment protocols.
• Help enterprises evaluate cryptographic risks and prepare for evolving security standards, including post-quantum cryptography.
• Collaborate directly with ITVA's software engineering team to design and develop new product features, integrations, and automation capabilities.
• Translate complex customer requirements into scalable product improvements.
• Serve as a trusted technical advisor for enterprise PKI modernization initiatives.

What We're Looking For

• 7+ years of hands-on experience
• in enterprise PKI, certificate services, cryptographic infrastructure, or certificate lifecycle management.
• Deep understanding of X.509 certificates, certificate chains, trust models, TLS, and mutual TLS.
• Extensive experience administering Microsoft Active Directory Certificate Services (AD CS) or comparable enterprise PKI systems.
• Strong knowledge of certificate issuance, renewal, revocation, CRLs, OCSP, CSRs, and certificate templates.
• Experience managing certificates across Windows and Linux servers, enterprise applications, and networking infrastructure.
• Proven ability to troubleshoot complex PKI and cryptographic issues independently.
• Experience with PowerShell, Python, Bash, or similar scripting languages for automation.
• Strong communication skills and experience collaborating with enterprise customers or cross-functional teams.
• Interest in AI-driven security automation and emerging cryptographic technologies.

Nice to Have

• Experience with certificate lifecycle management platforms such as DigiCert, Venafi, Keyfactor, or Sectigo.
• Familiarity with enrollment protocols including ACME, SCEP, EST, and CMP.
• Experience with HSMs, enterprise key management, and cloud PKI services.
• Experience managing certificates on F5 BIG-IP, Fortinet, NGINX, Apache, IIS, or similar systems.
• Familiarity with post-quantum cryptography, NIST standards, and cryptographic migration planning.
• Experience with Microsoft Intune, NDES, Active Directory, or enterprise device identity management.
• Experience supporting critical infrastructure, government, utilities, or highly regulated industries.
• Experience developing API integrations or PKI automation tools.

Why Join ITVA

• Bring AI to critical infrastructure:
• Help implement intelligent automation into the security systems that enterprises rely on every day.
• Work on the next generation of cryptography:
• Gain hands‑on experience helping organizations prepare for post‑quantum security challenges.
• Shape the future of PKI:
• Directly influence how enterprise certificate management evolves through AI and automation.
• Build, don't just administer:
• Collaborate with software engineers to turn real-world PKI problems into new product capabilities.
• Solve problems at enterprise scale:
• Work with complex environments where security, reliability, and automation truly matter.
• Join an engineering-driven company:
• Help build technology alongside people who have firsthand experience managing the infrastructure they're transforming.