Identity Engineer

blacklight.network; Columbus (OH); On-site; USD 130,000 - 170,000; Full time

Benefits offered by this job

Equity

401(k) plan

Full family health coverage

Job summary

blacklight.network is seeking an experienced identity infrastructure engineer to design and operate a production certificate authority, including offline root custody and issuance policies. You will work with the CTO and founding team to shape secure identity systems without legacy baggage.

The role requires deep expertise in mTLS, X.509, certificate enrollment, FIDO/WebAuthn, OAuth 2.0 and OpenID Connect, paired with strong judgment on cryptographic keys, access controls, and auditability in

Qualifications

• Experience designing and operating a production certificate authority.
• Fluency in mTLS, X.509, certificate enrollment, FIDO/WebAuthn, OAuth 2.0, and OpenID Connect.
• Strong judgment on cryptographic keys, credential custody, access control, and auditability.
• Production Linux and container infrastructure experience.

Responsibilities

• Design, operate, and protect production CA infrastructure (root/intermediate) and offline root custody.
• Define lifecycles for sponsor, human, agent, device, service, and network authorization.
• Implement auditable, attributable paths with evidence readable by auditors.
• Manage secure key custody outside application/agent environments.

Skills

Certificate Authority design

mTLS / X.509

FIDO/WebAuthn

OAuth 2.0 / OpenID Connect

Linux administration

Container infrastructure

Key custody & auditability

Tools

Linux

Containerization

Job description

Why this role

Certificate authority, enrollment lifecycles, key custody, and identity infrastructure. Why this roleYou will work directly with the CTO and founding team to shape identity infrastructure without an inherited legacy system or accumulated compromise.

What you will own

• Root and intermediate CA design, offline root custody, issuance policy, rotation, revocation, and recovery.
• Distinct sponsor, human, agent, device, service, and network authorization lifecycles.
• Attributable protected paths with evidence an auditor can read.
• Key custody that keeps long-lived keys outside application and agent reasoning environments.

What we need

• Experience designing and operating a production certificate authority.
• Fluency in mTLS, X.509, certificate enrollment, FIDO/WebAuthn, OAuth 2.0, and OpenID Connect.
• Sound judgment on cryptographic keys, credential custody, access control, and auditability.
• Production Linux and container infrastructure experience.

Compensation

• $130K–$170K. Potential equity, 401(k), and 100% paid family medical, dental, vision, and life insurance.