PKI Engineer: Certificate Lifecycle & Security Ops

SFE; Irving (TX); On-site; USD 90,000 - 125,000; Full time

Job summary

SFE is seeking a PKI Engineer to design, administer, and secure the enterprise PKI environment in Irving, TX. The role focuses on certificate lifecycle, CA/RA operations, and integration with automated management tools.

The ideal candidate has 3–5 years of PKI and information security experience, strong scripting ability, and a solid understanding of cryptographic principles. This is a full-time, onsite position with occasional after-hours support.

Qualifications

• Experience managing AD CS or equivalent PKI platforms.
• Strong PKI lifecycle and SSL/TLS knowledge.
• Experience with HSMs and cryptographic key management.
• Automation scripting with PowerShell or similar.
• Excellent troubleshooting and documentation skills.

Responsibilities

• Administer enterprise PKI platforms including CAs, RAs, HSMs, OCSP, and enrollment services.
• Lifecycle management of certificates for users, devices, servers, apps, and cloud.
• Implement PKI security controls, policies, and cryptographic standards.
• Design automated certificate management using AD CS, Venafi, Keyfactor, DigiCert, ACME.
• Manage cryptographic key generation, storage, rotation, escrow, destruction.
• Troubleshoot certificate issues for apps, websites, VPNs, authentication.
• Develop PKI diagrams, procedures, and governance documentation.
• Participate in security assessments and incident response.

Skills

PKI engineering

Information security

Automation scripting

Education

Bachelor's degree in IT/CS/Cybersecurity

Tools

Active Directory Certificate Services (AD CS)

HSMs

Venafi

Keyfactor

DigiCert

ACME

PowerShell

Job description

SFE is seeking a PKI Engineer to design, administer, and secure the enterprise PKI environment in Irving, TX. The role focuses on certificate lifecycle, CA/RA operations, and integration with automated management tools.

The ideal candidate has 3–5 years of PKI and information security experience, strong scripting ability, and a solid understanding of cryptographic principles. This is a full-time, onsite position with occasional after-hours support.