PKI & Certificate Management Engineer

Remote; San Francisco (CA); On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Competitive salary

Excellent medical coverage

100% medical premiums covered

Incentives programs

Training and certifications

PTO + Holidays

401k with company match

Phone/internet stipend

Parental leave

Certification incentives

Job summary

True Zero Technologies is seeking a PKI Engineer to design, deploy, and manage a secure, scalable Public Key Infrastructure across Windows, Linux, cloud, and on-prem environments. The role supports federal PKI and DoD PKI integrations, CAC/PIV, and mTLS for Zero Trust architectures.

You will work with IAM, cloud platforms, and security teams to ensure compliant cryptographic standards, automate certificate workflows, and monitor certificate health across enterprise systems.

Qualifications

• Bachelor’s degree in Cybersecurity, CS, IT, IS, or related technical discipline.
• Experience designing, implementing, or administering enterprise PKI.
• Strong knowledge of X.509, trust chains, cryptographic algorithms, key management.
• Experience with ACME-based certificate automation.
• Experience managing certificates across Windows, Linux, cloud, containerized, network, and application environments.
• Hands-on with AWS Private CA, ACM, AWS CloudHSM.
• Knowledge of cryptography, encryption, digital signatures, hashing, key exchange, and secure communications.
• Experience integrating PKI with IAM and cloud services.
• Familiarity with Federal PKI, DoD PKI, CAC/PIV authentication.
• Experience implementing mTLS and certificate-based workload identity in Zero Trust architectures.
• Familiarity with FIPS-validated cryptography and gov environments.
• Experience with certificate discovery, inventory management, expiration monitoring, and renewal processes.
• Strong TLS configuration, trust stores, and PKI troubleshooting.
• Experience with AWS GovCloud or government/regulatory environments preferred.
• Strong governance, documentation, troubleshooting, and cross-functional collaboration skills.

Responsibilities

• Design, implement, and maintain enterprise PKI supporting internal and external certificate requirements.
• Manage the full certificate lifecycle, including request, issuance, validation, distribution, renewal, revocation, expiration, and retirement.
• Implement ACME-based certificate automation and other enrollment/renewal workflows.
• Manage certificates across Windows, Linux, cloud, containers, applications, load balancers, and network devices.
• Design and operate integrations with AWS Private CA, ACM, and related AWS services.
• Implement and administer HSM capabilities, including AWS CloudHSM.
• Support Federal PKI (FPKI) and DoD PKI trust relationships and interoperability.
• Integrate CAC/PIV authentication with enterprise apps and identity platforms.
• Implement and maintain mutual TLS for workload identity and Zero Trust communications.
• Ensure cryptographic implementations use FIPS-validated modules and approved algorithms.
• Establish certificate discovery, inventory, monitoring, and alerting to prevent outages.
• Develop governance standards for certificate ownership, issuance, naming, key length, cryptographic algorithms, renewal, and retention.
• Integrate certificate management with IAM and authentication workflows.
• Support secure networking via TLS/mTLS and encryption standards.
• Monitor PKI platform health, certificate status, and expiration events.
• Troubleshoot certificate-chain, trust-store, TLS, and enrollment issues.
• Collaborate with cybersecurity, identity, cloud, and network teams to integrate PKI into architectures.
• Maintain PKI architecture docs, policies, and runbooks.

Skills

PKI knowledge

TLS/mTLS

Cloud PKI

IAM integration

Education

Bachelor’s degree in Cybersecurity/CS/IT

Tools

AWS Private CA

AWS Certificate Manager

AWS CloudHSM

ACME automation

Job description

True Zero Technologies is seeking a PKI Engineer to design, deploy, and manage a secure, scalable Public Key Infrastructure across Windows, Linux, cloud, and on-prem environments. The role supports federal PKI and DoD PKI integrations, CAC/PIV, and mTLS for Zero Trust architectures.

You will work with IAM, cloud platforms, and security teams to ensure compliant cryptographic standards, automate certificate workflows, and monitor certificate health across enterprise systems.