Pki Certificate Infrastructure Engineer

Tata Consultancy Services; Phoenix (AZ); On-site; USD 110,000 - 120,000; Full time

Job summary

Tata Consultancy Services Limited seeks a mid-level PKI Certificate Infrastructure Engineer to design, deploy, administer, and maintain enterprise PKI and certificate infrastructure. You will manage the certificate lifecycle, CA infra, HSMs, cryptographic keys, automation, and monitoring across on-prem and cloud environments.

The role requires hands-on PKI experience, scripting ability, and collaboration with Cybersecurity, IAM, Cloud, and Network teams to ensure secure certificate solutions.

Qualifications

• Approximately 3-6 years of relevant infrastructure/security engineering experience.
• Hands-on exposure to PKI and certificate technologies in enterprise environments.
• Ability to collaborate with application, infrastructure, cloud, network, and cybersecurity teams.

Responsibilities

• Design, deploy, configure, and maintain enterprise PKI and CA infrastructure.
• Manage complete digital certificate lifecycle including enrollment, issuance, renewal, revocation.
• Administer Root CA, Intermediate/Issuing CA, templates, CRLs, and OCSP.
• Deploy and support HSMs to protect private keys and cryptographic assets.
• Automate certificate provisioning and lifecycle processes using scripting.
• Integrate PKI with Windows/Linux servers, AD, cloud, APIs, and networks.

Skills

PKI management

CA administration

HSMs

AD CS / enterprise PKI

Scripting (PowerShell Python)

Windows / Linux

TLS/SSL concepts

Tools

Keyfactor / Venafi / DigiCert

HSM vendors Thales / Entrust

SCEP / EST / ACME

Job description

PKI Certificate Infrastructure Engineer

Job Summary

We are seeking a mid-level PKI (Public Key Infrastructure) Certificate Infrastructure Engineer to design, deploy, administer, and maintain enterprise PKI and digital certificate infrastructure. The engineer will be responsible for certificate lifecycle management, Certificate Authority (CA) infrastructure, Hardware Security Modules (HSMs), cryptographic key management, automation, monitoring, and operational support.

The ideal candidate will have hands-on experience supporting enterprise PKI environments and securing certificates and cryptographic keys used across applications, servers, APIs, network infrastructure, and cloud environments.

Key Responsibilities

• Design, deploy, configure, and maintain enterprise PKI and Certificate Authority infrastructure.
• Manage the complete digital certificate lifecycle, including certificate enrollment, issuance, renewal, revocation, expiration, and replacement.
• Administer Root CA, Intermediate/Issuing CA, certificate templates, CRLs, OCSP, and related PKI services.
• Deploy, configure, and support Hardware Security Modules (HSMs) used to protect private keys and other cryptographic assets.
• Manage cryptographic key lifecycle activities, including secure key generation, storage, rotation, backup, recovery, archival, and retirement.
• Support TLS/SSL certificates, client certificates, machine certificates, code-signing certificates, and other enterprise certificate use cases.
• Monitor certificate inventories and expiration dates and implement processes to prevent certificate-related application or service outages.
• Troubleshoot certificate trust chains, certificate enrollment, TLS/SSL, CRL/OCSP validation, private key, and HSM-related issues.
• Automate certificate provisioning, renewal, discovery, and lifecycle processes using scripting and certificate management platforms.
• Integrate PKI services with Windows/Linux servers, Active Directory, cloud infrastructure, applications, APIs, and network/security platforms.
• Maintain PKI configuration, operational procedures, certificate policies, and technical documentation.
• Support security assessments, audits, vulnerability remediation, and compliance requirements related to cryptography and certificate management.
• Collaborate with Cybersecurity, IAM, Cloud, Infrastructure, Network, DevOps, and Application teams to implement secure certificate solutions.

Must-Have Technical / Functional Skills

• Strong hands-on experience with Public Key Infrastructure (PKI) and enterprise certificate management.
• Experience administering Certificate Authorities (CA) and certificate lifecycle processes.
• Strong understanding of:
  • X.509 digital certificates
  • Public/private key cryptography
  • TLS/SSL
  • Certificate signing requests (CSRs)
  • Certificate chains and trust stores
  • CRL and OCSP
  • Encryption and digital signatures
• Hands-on experience with Hardware Security Modules (HSMs) and cryptographic key management.
• Experience with Microsoft Active Directory Certificate Services (AD CS) or equivalent enterprise PKI platforms.
• Knowledge of certificate enrollment technologies such as SCEP, EST, ACME, or related protocols.
• Experience troubleshooting certificate, TLS, trust-chain, and cryptographic issues in enterprise environments.
• Scripting/automation experience using PowerShell, Python, Bash, or equivalent.
• Working knowledge of Windows and Linux environments.
• Understanding of security controls and industry practices related to key protection, certificate issuance, encryption, and cryptographic operations.

Preferred / Nice-to-Have Skills

• Experience with enterprise certificate lifecycle management solutions such as Keyfactor, Venafi, DigiCert, Sectigo, or similar platforms.
• Experience with HSM technologies from vendors such as Thales or Entrust.
• Knowledge of cloud certificate/key management services in Microsoft Azure, AWS, or GCP.
• Experience integrating certificates into DevOps/CI/CD pipelines, APIs, Kubernetes, containers, and cloud-native applications.
• Familiarity with NIST cryptographic guidance, FIPS 140-2/140-3, and security/audit requirements.
• Exposure to Secrets Management, IAM, Zero Trust, or broader cryptographic security technologies.

Qualifications

• Approximately 3-6 years of relevant infrastructure/security engineering experience, with meaningful hands-on exposure to PKI and certificate technologies.
• Strong analytical and troubleshooting skills with the ability to support critical enterprise certificate infrastructure.
• Ability to collaborate effectively with application, infrastructure, cloud, network, and cybersecurity teams.

Salary Range- $110,000-$120,000 a year

Location: Phoenix, AZ

Function: TECHNOLOGY

Role: Engineer

ID: 437826

Skills: IT Infrastructure

Salary Range: $110,000 - $120,000