PKI Operations Engineer

August Schell; United States; Hybrid; USD 120,000 - 150,000; Full time

Job summary

August Schell is seeking a PKI Operations Engineer to sustain and operate a DoD enterprise PKI in support of a DISA customer. The role focuses on RHCS-based CA tooling, CVE remediation, and high-availability certificate services across live environments.

The engineer will work hybrid and on-site at Fort Meade when required, collaborating with government operations and product engineering to ensure secure, scalable PKI operations and PQC migration readiness.

Qualifications

• Active Secret clearance required; Top Secret preferred.
• 5+ years in systems/operations engineering with PKI experience.
• Strong Linux (RHEL) administration, patching, hardening.
• Experience with PKI (RHCS or similar) and cryptography.
• Experience with RHCS, DogtagPKI or comparable enterprise CA platforms.
• Scripting/automation in Python or Bash for operational tooling.

Responsibilities

• Operate and sustain production PKI environment on RHCS; ensure CA availability and certificate lifecycle operations.
• Manage RA/CRL/OCSP operations and high-volume certificate issuance.
• Onboard new customers/enclaves with secure configuration per standards.
• Own CVE remediation and patch management for PKI stack and RHEL hosts.
• Monitor health, build dashboards, respond to incidents and perform root-cause analyses.
• Support HSM integrations and key escrow (Entrust nShield/ Thales Luna).
• Automate tasks using scripting and CI/CD to reduce toil and errors.
• Assist PQC migration from operations perspective; provide config-as-code support.

Skills

Linux (RHEL) administration

Scripting & automation

PKI/crypto knowledge

DoD security compliance

Communication/documentation

Security operations awareness

Education

DoD 8570/8140 IAT Level II certification (Security+ or equivalent)

Tools

Podman/Docker

KVM virtualization

Prometheus/Grafana

ELK Stack

CI/CD tooling

Job description

PKI Operations Engineer

Ft. Meade, MD — Full Time (Hybrid)

August Schell is looking for a PKI Operations Engineer to sustain andoperateDoD enterprise Public Key Infrastructure in support of our DISA customer. This is a Red Hat Certificate System (RHCS) solution. Where our PKI Software Engineer builds the next-generation certificate-systems code, this role keeps the infrastructure running: operating and hardening the live RHCS environment, standing up new customers and enclaves, driving CVE remediation and patch cycles, monitoring system health, and automating the operational toil that keeps a high-volume CA reliable. The engineer workshand-in-handwith commercial product engineering, government operations teams, and other program contractors — including through the environment’s post-quantum cryptography (PQC) migration.

Individuals in this role must be able to work hybrid and go on site at Fort Meade as requested.

Responsibilities Include

• Operate and sustain the production PKI environment on Red Hat Certificate System (RHCS) — CA availability, certificate lifecycle operations, and the day-to-day health of the issuance pipeline
• Run RA/CRL/OCSP operations and certificate lifecycle management, including the transition to shorter-lived certificates at higher issuance volume (ACME automation)
• Onboard new customers, enclaves, and use cases onto the PKI — configuration, integration, and secure hardening of new environments to program standards
• Own CVE remediation and patch management for the PKI stack and its underlying RHEL hosts — track, test, schedule, and apply security patches with minimal disruption to CA operations
• Monitor system health and performance; build andmaintainalerting, logging, and dashboards; respond to and resolve operational incidents, and lead root-cause analysis
• Operate and troubleshoot HSM integrations (EntrustnShield/ Thales Luna) supporting CA operations and key escrow
• Automate operational tasks — health checks, backups, certificate/CRL monitoring,deploymentand configuration — using scripting and CI/CD tooling to reduce toil and manual error
• Support the program’s PQC migration from an operations standpoint (algorithm rollout, version transition, validation in the live environment)
• Provide development support in an operational capacity asadditionalvalue — small fixes, config-as-code, tooling, and reproduction of issues for the product engineering team — without owning the core feature-development backlog
• Communicate clearly across government operations stakeholders, commercial vendor engineering, and program contractors; document runbooks and elevate risks and blockers before theyimpactoperations

Requirements

• Active Secret clearance minimum (Top Secret preferred and may berequired)
• Local to the DMV area with the ability to work on site at Fort Meade as requested
• Five (5)+years of relevant systems/operations engineering experience (flexible for candidates with exceptional PKI depth)
• Strong Linux (RHEL) systems administration and operations background, including patch management and system hardening
• Knowledge or experience with Linux containers and container orchestration (Podman/ Docker) and VMs (KVM)
• Hands-on experience operating PKI, x.509, cryptography, and system/software security technologies
• Direct experienceoperatingRed Hat Certificate System (RHCS) — this is a Red Hat solution.DogtagPKI experience (RHCS’s upstream open-source project) is an accepted alternative skillset, as is comparable enterprise CA platform operations (EJBCA, Microsoft AD CS, Entrust Authority, ISCCertAgent, or similar)
• Scripting/automationproficiency(Python, Bash, or similar) for operational tooling
• DoD 8570/8140 IAT Level II certification (Security+ or equivalent)
• Strong written and verbal communication skills, with a habit of documenting runbooks and operational procedures

Stand Out With

• Prior DISA or DoD PKI program operations experience (Purebred, derived credentials, RA/CRL/OCSP operations at scale)
• HSM operations experience (EntrustnShield, Thales Luna) — the customer runs Entrust HSMs
• ACME protocol and certificate automation at scale
• Post-quantum cryptography familiarity (ML-DSA/Dilithium, Kyber, CNSA 2.0 timelines) from a migration/operations lens
• Configuration management and infrastructure-as-code (Ansible, or similar)
• Directory Server / LDAP operations experience
• Monitoring/observability tooling (Prometheus/Grafana, ELK, or similar) and incident response
• Agile / ITSM operating rhythms (Scrum, JIRA, change management)