PKI Operations Engineer

augustschell; Fort Meade (MD); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

Hybrid work

Job summary

August Schell seeks a PKI Operations Engineer to sustain and operate a DoD enterprise PKI (RHCS) at Fort Meade. You will manage CA availability, certificate lifecycles, and patch cycles while automating tasks and supporting PQC migrations.

The role requires on-site presence as requested and a Secret/Top Secret-preferred clearance. You will collaborate with government operations teams and contractors, handle CVE remediation, and ensure secure hardening of the PKI stack in a high-volume

Qualifications

• Active Secret clearance minimum (Top Secret preferred)
• Local to the DMV area with ability to work on site at Fort Meade
• Five (5)+ years of relevant systems/operations engineering experience
• Strong Linux (RHEL) systems administration and patch management
• Knowledge/experience with Linux containers and VMs (Podman/Docker, KVM)
• Hands-on PKI, x.509, cryptography and security technologies
• DoD 8570/8140 IAT II certification (Security+ or equivalent)
• Strong written and verbal communication; document runbooks and procedures

Responsibilities

• Operate and sustain production PKI environment on RHCS; ensure CA availability and certificate lifecycle
• Manage RA/CRL/OCSP operations and higher-volume issuance
• Onboard new customers/enclaves; configure, integrate and harden new environments
• Own CVE remediation and patch management for PKI stack and RHEL hosts
• Monitor system health; build alerts/logs/dashboards; manage incidents and RCA
• Operate and troubleshoot HSM integrations (Entrust nShield/Thales Luna)
• Automate operational tasks via scripting/CI/CD to reduce toil
• Support PQC migration from an operations perspective
• Provide operational development support without owning core feature backlog
• Communicate with stakeholders; document runbooks and risk blockers

Skills

PKI operations

Linux (RHEL)

RHCS / Dogtag

Scripting (Python/Bash)

DoD 8570/8140 IAT II

HSM integration

Patch management

ACME automation

Monitoring/observability

RA/OCSP/CRL operations

Tools

Podman/Docker

KVM

Entrust nShield

Thales Luna

Prometheus/Grafana

ELK stack

Ansible

Job description

PKI Operations Engineer

Ft. Meade, MD — Full Time (Hybrid)

August Schell is looking for a PKI Operations Engineer to sustain and operate DoD enterprise Public Key Infrastructure in support of our DISA customer. This is a Red Hat Certificate System (RHCS) solution. Where our PKI Software Engineer builds the next-generation certificate-systems code, this role keeps the infrastructure running: operating and hardening the live RHCS environment, standing up new customers and enclaves, driving CVE remediation and patch cycles, monitoring system health, and automating the operational toil that keeps a high-volume CA reliable. The engineer works hand-in-hand with commercial product engineering, government operations teams, and other program contractors — including through the environment's post-quantum cryptography (PQC) migration.

Individuals in this role must be able to work hybrid and go on site at Fort Meade as requested.

Responsibilities Include

• Operate and sustain the production PKI environment on Red Hat Certificate System (RHCS) — CA availability, certificate lifecycle operations, and the day-to-day health of the issuance pipeline

• Run RA/CRL/OCSP operations and certificate lifecycle management, including the transition to shorter-lived certificates at higher issuance volume (ACME automation)

• Onboard new customers, enclaves, and use cases onto the PKI — configuration, integration, and secure hardening of new environments to program standards

• Own CVE remediation and patch management for the PKI stack and its underlying RHEL hosts — track, test, schedule, and apply security patches with minimal disruption to CA operations

• Monitor system health and performance; build and maintain alerting, logging and dashboards; respond to and resolve operational incidents, and lead root‑cause analysis

• Operate and troubleshoot HSM integrations (Entrust nShield/ Thales Luna) supporting CA operations and key escrow

• Automate operational tasks — health checks, backups, certificate/CRL monitoring, deployment and configuration — using scripting and CI/CD tooling to reduce toil and manual error

• Support the program's PQC migration from an operations standpoint (algorithm rollout, version transition, validation in the live environment)

• Provide development support in an operational capacity as additional value — small fixes, config-as-code, tooling, and reproduction of issues for the product engineering team — without owning the core feature‑development backlog

• Communicate clearly across government operations stakeholders, commercial vendor engineering and program contractors; document runbooks and escape risks and blockers before they impact operations

Requirements

• Active Secret clearance minimum (Top Secret preferred and may be required)

• Local to the DMV area with ability to work on site at Fort Meade as requested

• Five (5)+years of relevant systems/operations engineering experience (flexible for candidates with exceptional PKI depth)

• Strong Linux (RHEL) systems administration and operations background, including patch management and system hardening

• Knowledge or experience with Linux containers and container orchestration (Podman/ Docker) and VMs (KVM)

• Hands‑on experience operating PKI, x.509, cryptography and system/software security technologies

• Direct experience operating Red Hat Certificate System (RHCS) — this is a Red Hat solution. Dogtag PKI experience (RHCS's upstream open‑source project) is an accepted alternative skillset, as is comparable enterprise CA platform operations (EJBCA, Microsoft AD CS, Entrust Authority, ISCCertAgent or similar)

• Scripting/automation proficiency (Python, Bash or similar) for operational tooling

• DoD 8570/8140 IAT Level II certification (Security+ or equivalent)

• Strong written and verbal communication skills, with a habit of documenting runbooks and operational procedures

Stand Out With

• Prior DISA or DoD PKI program operations experience (Purebred, derived credentials, RA/CRL/OCSP operations at scale)

• HSM operations experience (Entrust nShield, Thales Luna) — the customer runs Entrust HSMs

• ACME protocol and certificate automation at scale

• Post‑quantum cryptography familiarity (ML‑DSA/Dilithium, Kyber, CNSA 2.0 timelines) from a migration/operations lens

• Configuration management and infrastructure‑as‑code (Ansible or similar)

• Directory Server / LDAP operations experience

• Monitoring/observability tooling (Prometheus/Grafana, ELK or similar) and incident response

• Agile / ITSM operating rhythms (Scrum, JIRA, change management)