PKI Engineer

Voto Consulting LLC; Irving (TX); In loco; USD 110.000 - 150.000; Tempo pieno

Descrizione del lavoro

Voto Consulting LLC in Irving, TX is seeking an experienced PKI / Certificate Lifecycle Management Engineer to manage enterprise PKI services and certificate workflows. You will administer AD CS, manage issuing/offline root CAs, automate lifecycle tasks with PowerShell and REST, and coordinate with security, cloud, and operations teams to prevent outages.

If you bring 3+ years in PKI, strong knowledge of X.509, TLS/mTLS, and experience with DigiCert or Sectigo, you will help sustain trusted

Competenze

• 3+ years of hands-on Enterprise PKI and Certificate Management.
• Experience administering Microsoft AD CS environments.
• Experience with Offline Root CA and Issuing CA operations.
• Hands-on experience managing public TLS certificates through providers such as DigiCert or Sectigo.
• Strong understanding of: X.509 Certificates, Certificate Chains, CRL and OCSP, CSRs and SANs, Trust Stores.
• Experience with Active Directory, Group Policy, Windows Server, and Auto-Enrollment.
• Strong PowerShell scripting and automation experience.
• Hands-on experience using OpenSSL for certificate creation, conversion, and troubleshooting.
• Ability to troubleshoot certificate trust, TLS, and mTLS issues across enterprise environments.

Mansioni

• Administer and support Microsoft AD CS.
• Manage enterprise issuing CAs and offline root CAs.
• Maintain certificate templates, enrollment permissions, and auto-enrollment configurations.
• Support CRL, AIA, and OCSP services.
• Perform CA maintenance, upgrades, backups, recovery testing, and monitoring.
• Manage the lifecycle of internal and public certificates including issuance, renewal, revocation, and retirement.
• Coordinate certificate deployments with application, server, network, and cloud teams.
• Develop and maintain automation using PowerShell, REST APIs, and ACME-based workflows.
• Integrate certificate management workflows with ServiceNow, CMDB, monitoring, and security platforms.
• Maintain reusable scripts, technical documentation, and operational procedures.
• Troubleshoot PKI, certificate chain, and trust-related issues.
• Diagnose TLS/mTLS handshake failures and certificate validation problems.
• Use OpenSSL, certutil, PowerShell, logs, and traces to identify root causes.
• Support investigations involving certificate outages, renewals, and security incidents.

Conoscenze

PKI

AD CS

PowerShell

OpenSSL

TLS certificates

Certificate lifecycle

Automation

REST APIs

Azure PKI

Strumenti

DigiCert

Sectigo

Venafi

Keyfactor

ACME

Descrizione del lavoro

PKI / Certificate Lifecycle Management Engineer

Irving TX/ Phoenix AZ/ Columbus OH (Onsite)

Onsite role, 1st round Video, 2nd round is In person.

About the Role

We are looking for an experienced PKI / Certificate Lifecycle Management Engineer to manage and enhance our enterprise Public Key Infrastructure (PKI) services and certificate management processes.

In this role, you will be responsible for the administration of Microsoft Active Directory Certificate Services (AD CS), management of publicly trusted TLS certificates, automation of certificate lifecycle activities, and troubleshooting certificate trust and encryption-related issues across enterprise environments.

You will work closely with Cybersecurity, Identity & Access Management, Infrastructure, Cloud, Application, and Operations teams to ensure secure, reliable, and scalable certificate services.

Key Responsibilities

PKI Administration

• Administer and support Microsoft Active Directory Certificate Services (AD CS).
• Manage enterprise issuing CAs and offline root CAs.
• Maintain certificate templates, enrollment permissions, and auto-enrollment configurations.
• Support CRL, AIA, and OCSP services.
• Perform CA maintenance, upgrades, backups, recovery testing, and operational health monitoring.

Certificate Lifecycle Management

• Manage the complete lifecycle of internal and public certificates including issuance, deployment, renewal, replacement, revocation, and retirement.
• Support public certificate providers such as DigiCert and Sectigo.
• Maintain certificate inventories, ownership records, and renewal tracking.
• Monitor certificate expirations and proactively prevent service disruptions.
• Coordinate certificate deployments with application, server, network, and cloud teams.

Automation & Integration

• Develop and maintain automation using PowerShell, REST APIs, and ACME-based workflows.
• Automate certificate request, renewal, deployment, validation, and revocation processes.
• Integrate certificate management workflows with ServiceNow, CMDB, monitoring, and security platforms.
• Maintain reusable scripts, technical documentation, and operational procedures.
• Troubleshoot PKI, certificate chain, and trust-related issues.
• Diagnose TLS/mTLS handshake failures and certificate validation problems.
• Use tools such as OpenSSL, certutil, PowerShell, logs, and network traces to identify root causes.
• Support investigations involving certificate outages, renewals, and security incidents.

Governance & Documentation

• Maintain operational runbooks and technical documentation.
• Support audits, compliance reviews, and security assessments.
• Follow secure key-management practices and change-management procedures.
• Provide technical guidance to operational and support teams.

Required Qualifications

• 3+ years of hands-on experience with Enterprise PKI and Certificate Management.
• Strong experience administering Microsoft AD CS environments.
• Experience with Offline Root CA and Issuing CA operations.
• Hands-on experience managing public TLS certificates through providers such as DigiCert or Sectigo.
• Strong understanding of:
• X.509 Certificates
• Certificate Chains
• CRL and OCSP
• CSRs and SANs
• Trust Stores
• Experience with Active Directory, Group Policy, Windows Server, and Auto-Enrollment.
• Strong PowerShell scripting and automation experience.
• Hands-on experience using OpenSSL for certificate creation, conversion, and troubleshooting.
• Ability to troubleshoot certificate trust, TLS, and mTLS issues across enterprise environments.
• Strong communication, documentation, and stakeholder management skills.

Preferred Qualifications

• Experience with Sectigo Certificate Manager, Venafi, Keyfactor, or similar Certificate Lifecycle Management platforms.
• Experience performing CA recovery and key-ceremony activities.
• Experience supporting PKI solutions in Microsoft Azure environments.
• Knowledge of ACME-based certificate automation.
• Experience automating certificate deployment to web servers, load balancers, cloud services, or application platforms.
• Experience working in regulated industries such as Banking, Financial Services, Healthcare, or Telecommunications.