ICA Security Engineer (4 Roles)

Innova Solutions; Charlotte (NC); On-site; USD 99,187 - 106,075; Full time

Benefits offered by this job

Medical & pharmacy coverage

401(k)

Flexible spending account (FSA)

Job summary

A technology solutions firm is seeking a PKI Security Engineer to design, implement, and operate enterprise-grade PKI services, particularly utilizing Microsoft Active Directory Certificate Services. The ideal candidate will have over 8 years of experience in Security Engineering, including hands-on expertise with multi-tier PKI infrastructure. This role offers competitive compensation and is located in Charlotte, NC, requiring presence onsite 5 days a week.

Qualifications

• 8+ years in Security Engineering/Identity Infrastructure.
• 5+ years with Microsoft AD CS and managing CA infrastructure.
• Deep knowledge of X.509, CRL/OCSP, EKU/KU, SANs.

Responsibilities

• Design and maintain enterprise PKI architectures.
• Implement certificate lifecycle management including automation.
• Regular PKI risk assessments and compliance alignment.

Skills

Microsoft Active Directory Certificate Services (ADCS)

PowerShell scripting

Multi-tier Microsoft Public Key Infrastructure

Tools

Windows Server

Linux

HSM

Job description

Overview

A client of Innova Solutions is immediately hiring for an PKI Security Engineer/ICA Security Engineer. Position type: Contract. Duration: 12 to 18 months. Location: 5 days onsite per week in Charlotte, NC.

Top Skills

As a PKI Security Engineer/ICA Security Engineer, you will:

• 5+ years of hands-on experience with Microsoft Active Directory Certificate Services (ADCS)
• 3+ years of experience designing, deploying, and operating multi-tier Microsoft Public Key Infrastructure (offline root, issuing CAs) in large/complex environments
• 2+ years of strong PowerShell experience

Details

Senior PKI Engineer to design, implement, and operate enterprise-grade Public Key Infrastructure (PKI) services with a strong focus on Microsoft Active Directory Certificate Services (AD CS) and Active Directory (AD) integration. Hands-on implementation and integration knowledge of certificate lifecycle management, CA hierarchy governance, enrollment automation, HSM-backed key protection, CA backup/restore, migration and integration with platforms such as Windows Server, Linux, network/security devices, cloud providers, MDM/EPP, and zero-trust tooling. Subject matter expert for cryptographic standards, certificate-based authentication, and PKI security controls across the organization.

Key Responsibilities

Architecture & Design:

• Design and maintain enterprise PKI architectures (Root CA, Policy CA, Issuing CA) with offline/air-gapped roots, secure key ceremonies, key usage, and issuance workflows and robust CRL/OCSP distribution.
• Integrate PKI with Active Directory (incl. AD forests/domains, AD CS, AIA/CDP locations, GPOs), and Azure AD/Entra ID where applicable (e.g., certificate-based auth).
• Engineer solutions for mutual TLS, 802.1X (wired/wireless/VPN), device identity, code signing, S/MIME, BitLocker, and disk/volume encryption certs.
• Key sizes, algorithms (RSA, ECC and PQC) encryption and hashing.
• Implement HSM-backed key storage for CAs and code signing; lead key ceremonies, disaster recovery designs.

Operations & Automation:

• Own certificate lifecycle management (issuance, renewal, revocation) including automation via Intune, GPO/Autoenrollment, SCEP/NDES, ACME, or MDM connectors.
• Manage CRL/OCSP publication, monitoring, and availability, design highly available, geo-distributed revocation endpoints.
• Implement scripting/automation (PowerShell, APIs) for bulk issuance, inventory, renewal, and drift detection. Enabling separation of duties for secure operation of PKI infrastructure.
• CA backup, restore renewal and migration strategy.

Security & Compliance:

• Apply strong key management practices (FIPS 140-2/140-3), certificate assurance levels, and secure CA hardening baselines.
• Regular PKI risk assessments, access reviews, and control testing (e.g., template permissions, EKU misuse, issuance constraints).
• Lead root cause analysis and incident response for certificate/PKI-related outages or security events.
• Maintain alignment with NIST, CAB Forum, Microsoft Security Baselines, and internal compliance frameworks (e.g., SOX, PCI, HIPAA, ISO 27001) as applicable.

Minimum Qualifications

• 8+ years in Security Engineering/Identity Infrastructure, including 5+ years hands-on with Microsoft AD CS and enterprise Active Directory with managing CA infra
• Proven experience designing, deploying, and operating multi-tier Microsoft PKI (offline root, issuing CAs) in large/complex environments.
• Deep knowledge of X.509, CRL/OCSP, EKU/KU, SANs, key algorithms and sizes (RSA/ECC), hashing (SHA-2), and certificate validation paths.
• Strong PowerShell and Windows Server administration; GPOs, autoenrollment, templates, AIA/CDP configuration.
• Experience with 802.1X/EAP-TLS, TLS/mTLS, VPN auth, and device/user certificate issuance at scale.
• HSM experience (e.g., nCipher/Entrust/Thales) for CA key management.

Qualified candidates should APPLY NOW for immediate consideration!

This position is only open to applicants who can be engaged on a W-2 basis.

Please hit APPLY to provide the required information, and we will be back in touch as soon as possible.

We are currently interviewing to fill this and other similar positions. If this role is not a fit for you, we do offer a referral bonus program for referrals that we successfully place with our clients, subject to program guidelines. ASK ME HOW.

Thank you!

Balbir Rana

[phone]

[e-mail]

Pay Range And Benefits

Pay Range*: $72 - $77 per hour

• Pay range offered to a successful candidate will be based on several factors, including the candidate\'s education, work experience, work location, specific job duties, certifications, etc.

Benefits: Innova Solutions offers benefits (based on eligibility) that include Medical & pharmacy coverage, Dental/vision insurance, 401(k), Health saving account (HSA) and Flexible spending account (FSA), Life Insurance, Pet Insurance, Short term and Long term Disability, Accident & Critical illness coverage, Pre-paid legal & ID theft protection, Sick time, and other types of paid leaves (as required by law), Employee Assistance Program (EAP).

About Innova Solutions

Founded in 1998 and headquartered in Atlanta, Georgia, Innova Solutions employs approximately 50,000 professionals worldwide and reports an annual revenue approaching $3 Billion. Through our global delivery centers across North America, Asia, and Europe, we deliver strategic technology and business transformation solutions to our clients, enabling them to operate as leaders within their fields.

Recent Recognitions

• Named One of America’s Best Employers for New Grads by Forbes (2024)
• Named One of the Best Companies to Work for by U.S. News & World Report (Private Companies List, 2024-2025)
• One of the Largest IT Staffing Firms in the US – Ranked #3 by Staffing Industry Analysts (SIA, 2024)
• One of the Largest Staffing Firms in the US – Ranked #13 by Staffing Industry Analysts (SIA, 2024; includes Innova Solutions, Volt, & HireGenics)
• Named One of the Top Ten Private Companies in Atlanta by the Atlanta Business Chronicle (2023)
• One of the Largest Certified Minority Business Enterprises (MBEs) in the United States (NMSDC, 2024)
• AWS Advanced Tier Services Partner with 100+ certifications

Website: https://www.innovasolutions.com/

Innova Solutions offers a referral bonus for qualified Ambassadors who refer eligible referrals. Submit referrals at https://innovasolutions.workllama.com/atsuser/anonreferafriend and earn $250-$1,000 per referral.

Innova Solutions is an Equal Opportunity Employer and prohibits any kind of unlawful discrimination and harassment. Innova Solutions is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment on the basis of race, color, religion or belief, national origin, citizenship, sex, age, physical or mental disability, veteran status, marital status, domestic partner status, sexual orientation, or any other status protected by the statutes, rules, and regulations in the locations where it operates. If you are an individual with a disability and need a reasonable accommodation to assist with your job search or application for employment, please contact us at [e-mail] or [phone]. Please indicate the specifics of the assistance needed. Innova Solutions encourages all interested and qualified candidates to apply for employment opportunities. Innova Solutions (HireGenics/Volt) does not discriminate against applicants based on citizenship status, immigration status, or national origin, in accordance with 8 U.S.C. 1324b. The company will consider for employment qualified applicants with arrest and conviction records in a manner that complies with applicable fair chance laws. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Innova Solutions and its affiliates, and contracted partners. Frequency varies for text messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at Privacy Policy - innovasolutions.