PKI Certificate Lifecycle Management Engineer

Computacenter; Irving (TX); On-site; USD 110,000 - 140,000; Full time

Job summary

Computacenter is seeking a hands-on PKI Engineer to operate and improve enterprise Certificate Authority services and manage the full lifecycle of internal and publicly trusted certificates. The role covers AD CS administration, public TLS management, lifecycle automation, and troubleshooting of certificate chains across production and non-production environments.

You will collaborate with Cybersecurity, Cloud Engineering, application teams, and support partners to maintain secure certificate

Qualifications

• 3+ years hands-on PKI, AD CS, and certificate operations.
• Experience managing public TLS certificates via enterprise CAs.
• Automation of certificate workflows using PowerShell and APIs.
• Familiarity with ACME-based workflows and certificate lifecycles.
• Strong documentation and cross-team communication.

Responsibilities

• Administer AD CS including offline root and enterprise issuing CAs.
• Manage public TLS certificates across DigiCert/Sectigo.
• Automate certificate requests, issuance, renewal, deployment, and revocation.
• Monitor cert inventories and renewal risks, escalate issues.
• Support on-call rotation and runbooks.

Education

Bachelor's degree in Computer Science

3+ years PKI experience

Tools

OpenSSL

PowerShell

certutil

ServiceNow

Sectigo Certificate Manager

ACME

Job description

Position Title::PKI / Certificate Lifecycle Management Engineer

Locations :: Phoenix AZ 85004

Job Description:

We are seeking a hands-on PKI Engineer to operate and improve enterprise Certificate Authority services and manage the complete lifecycle of internal and publicly trusted digital certificates.

This role covers Microsoft AD CS administration, public TLS certificate management, certificate lifecycle automation, and troubleshooting of certificate chains and trust issues. The engineer will collaborate with Cybersecurity, Active Directory, Cloud Engineering, application teams, and support partners to maintain secure, reliable certificate services across production and non-production environments.

Key Responsibilities

PKI and Certificate Authority Operations

• Administer Microsoft Active Directory Certificate Services (AD CS), including offline root CAs and enterprise issuing CAs.
• Maintain CA configurations, certificate templates, enrollment permissions, and auto-enrollment policies.
• Maintain and monitor Certificate Revocation List (CRL) and Authority Information Access (AIA) publication services; support OCSP where implemented.
• Support secure key storage, and documented key ceremonies under approved dual-control procedures.
• Perform CA maintenance, patching, backup validation, and disaster recovery exercises through established change-management processes.

Public TLS and Certificate Lifecycle Management

• Manage internal and publicly trusted certificates throughout discovery, request validation, issuance, deployment, monitoring, renewal, replacement, revocation, and retirement.
• Manage public TLS certificates through providers such as DigiCert and Sectigo, including domain and organization validation, issuance, reissuance, and renewal.
• Administer public CA accounts, access permissions, approved certificate profiles, and validation records.
• Operate certificate lifecycle management platforms, including discovery scans, CA connectors, workflows, expiration alerts, and reporting.
• Maintain accurate certificate inventories with application ownership, deployment locations, business criticality, and renewal responsibilities.
• Coordinate certificate installation and replacement with application, server, network, and cloud teams; verify successful deployment.
• Monitor expiration risks and renewal failures, **escalate unresolved issues**, and drive remediation to prevent certificate-related outages.

Certificate Automation and Integration

• Design, implement, and maintain automation for certificate requests, issuance, renewal, deployment, validation, and revocation using PowerShell, REST APIs, ACME, and certificate management platforms.
• Integrate automated workflows with internal and public CAs, web servers, load balancers, cloud services, and application platforms.
• Automate CSR generation and certificate installation while maintaining secure private-key handling and appropriate access controls.
• Implement failure alerts, controlled retries, and post-deployment checks to confirm that renewed certificates are installed and actively served.
• Integrate certificate workflows with ServiceNow, CMDB, monitoring, and security logging platforms.
• Maintain reusable scripts, version-controlled integrations, and documentation to reduce manual effort and operational errors.

Certificate Tools and Troubleshooting

• Use OpenSSL to generate private keys and CSRs; create and extract PFX/PKCS#12 packages; and convert certificates between PEM and DER formats.
• Securely package certificates with their private keys and intermediate CA certificates for deployment.
• Inspect certificate subjects, issuers, SANs, validity periods, key usage, extended key usage, and fingerprints.
• Verify certificate chains against trusted roots and confirm that certificates match their private keys.
• Troubleshoot missing or incorrect intermediate certificates, untrusted roots, expired or revoked certificates, and incorrect certificate bundles.
• Diagnose TLS/mTLS handshake failures, hostname mismatches, certificate binding issues, and CRL/OCSP validation failures.
• Troubleshoot AD CS enrollment and auto-enrollment failures, template configurations, and permissions.
• Use OpenSSL, certutil, PowerShell, application logs, and network traces to identify root causes and document corrective actions.

Operational Support and Governance

• Maintain operational runbooks, technical documentation, audit evidence, and service metrics.
• Follow privileged-access, separation-of-duties, and secure key-handling requirements.
• Support security reviews, incident investigations, and remediation activities.
• Provide technical guidance to L2 support teams and application owners.
• Participate in an agreed on-call rotation and scheduled maintenance activities.

Required Qualifications

• At least 3 years of hands-on experience supporting enterprise PKI, Microsoft AD CS, and certificate operations.
• Practical experience administering issuing CAs and supporting offline root CA operations.
• Experience managing publicly trusted TLS certificates through enterprise public CA providers.
• Experience with certificate lifecycle management, including inventory, ownership tracking, monitoring, renewal, deployment, and revocation.
• Strong understanding of X.509 certificates, certificate chains, trust stores, CSRs, SANs, private keys, certificate extensions, and revocation.
• Experience with Active Directory, Group Policy, Windows Server, certificate templates, and auto-enrollment.
• Demonstrated ability to automate certificate operations using PowerShell and APIs; familiarity with ACME-based workflows.
• Hands-on OpenSSL experience, including PFX creation and extraction, certificate conversion, chain verification, and TLS troubleshooting.
• Ability to diagnose certificate trust and TLS/mTLS issues across enterprise systems.
• Strong documentation, change-management, incident-management, and cross-team communication skills.

Preferred Qualifications

• Experience with Sectigo Certificate Manager.
• Experience with root CA ceremonies, and CA recovery.
• Experience automating certificate deployment to web servers, load balancers, cloud services, or application platforms.
• Familiarity with Certificate Transparency monitoring, and public CA validation requirements.
• Experience in banking, financial services, or another regulated industry.

Expected Outcomes

• Reliable internal CA services and public TLS certificate operations.
• Timely renewals and fewer preventable certificate-related outages.
• Accurate certificate inventories with accountable owners.
• Increased automation across the certificate lifecycle.
• Effective troubleshooting and timely resolution of certificate and trust issues.
• Documented, tested, and auditable operational and recovery processes.