PKI Venafi Architect

Themesoft Inc; Chicago (IL); On-site; USD 150,000 - 210,000; Full time

Job summary

Themesoft Inc in Chicago seeks a PKI / Venafi Architect with 10+ years of experience to lead enterprise PKI design, governance, and automation across hybrid, cloud, and on‑prem environments.

You will own Venafi Trust Protection Platform (TPP) architecture, certificate onboarding standards, and integrations with enterprise applications, CI/CD, and security solutions, ensuring scalable trust services.

Qualifications

• 10+ years in PKI, security architecture, or related security engineering domains.
• Strong enterprise PKI architecture experience incl. Root/Issuing CA, CRL, OCSP, and HSM.
• Hands-on Venafi TPP architecture, administration, integration, and optimization.
• Experience with CLM, machine identity management, governance, and cryptographic controls.
• Proven ability to design automated certificate provisioning, renewal, rotation, and revocation workflows.
• Familiarity with Venafi APIs and automation tech such as vCert, PowerShell, Python, and Ansible.
• Experience integrating certificate automation with GitHub Actions, Azure DevOps, and CI/CD.
• Ability to collaborate with security, infrastructure, cloud, DevOps, IAM, and application teams.

Responsibilities

• Design, implement, and govern enterprise PKI architecture across hybrid, cloud, and on-prem environments.
• Lead Venafi Platform architecture, upgrades, and governance for scalable certificate management.
• Architect and implement automated certificate provisioning, renewal, and revocation workflows.
• Drive machine identity management, cryptographic controls, and trusted infrastructure standards.

Skills

Security architecture

PKI architecture

Machine identity management

Cross-functional collaboration

Leadership

Education

Bachelor's degree in CS/IS/Security

Tools

Venafi TPP

vCert

PowerShell

Python

Ansible

Job description

We are seeking an experienced PKI / Venafi Architect with 10+ years of experience in Public Key Infrastructure (PKI), certificate lifecycle management (CLM), security architecture, and certificate automation. The ideal candidate will lead the design, implementation, governance, and optimization of enterprise PKI and Venafi solutions across hybrid, cloud, and on-premises environments.

The candidate should have strong expertise in enterprise PKI architecture, machine identity management, cryptographic controls, certificate automation, and Venafi Trust Protection Platform (TPP). This role requires close collaboration with Security, Infrastructure, Cloud, DevOps, Identity and Access Management (IAM), and Application teams to deliver scalable, resilient, and secure enterprise trust services.

Key Responsibilities

1. PKI and Security Architecture

• Design, implement, and maintain enterprise PKI architecture, including Root Certificate Authorities (Root CA), Issuing Certificate Authorities (Issuing CA), Certificate Revocation Lists (CRL), Online Certificate Status Protocol (OCSP), Hardware Security Modules (HSM), and enterprise trust frameworks.
• Develop and maintain certificate governance standards, security policies, cryptographic controls, and certificate management frameworks.
• Architect highly available, scalable, and resilient PKI and Certificate Lifecycle Management (CLM) platforms.
• Define and drive enterprise machine identity management and certificate lifecycle management strategies.
• Ensure secure certificate issuance, distribution, renewal, revocation, and retirement processes across enterprise environments.

2. Venafi Platform Architecture and Engineering

• Design, implement, configure, and administer the Venafi Trust Protection Platform (TPP).
• Define certificate onboarding standards, workflows, policies, reporting mechanisms, discovery jobs, and role-based access models.
• Architect and implement integrations between Venafi and enterprise applications, cloud services, infrastructure platforms, and security solutions.
• Lead Venafi platform upgrades, enhancements, troubleshooting, performance optimization, and continuous improvement initiatives.
• Establish platform governance, operational standards, and best practices for enterprise-wide certificate management.

3. Certificate Lifecycle Automation

• Design and implement automated certificate provisioning, renewal, rotation, revocation, and replacement solutions.
• Develop certificate automation frameworks using Venafi APIs, vCert, PowerShell, Python, and Ansible.
• Integrate certificate lifecycle automation into GitHub Actions, Azure DevOps, and CI/CD pipelines.
• Drive adoption of certificate automation across enterprise application portfolios to reduce manual effort and prevent certificate expiration-related outages.
• Develop reusable automation scripts, workflows, and integration patterns for application and infrastructure teams.
• Collaborate with DevOps and cloud engineering teams to embed certificate management into application deployment and infrastructure provisioning processes.

4. Enterprise Security and Cross-Functional Collaboration

• Work closely with Security, Infrastructure, Cloud, DevOps, IAM, and Application teams to define and implement enterprise certificate management solutions.
• Establish secure machine identity practices and cryptographic control standards across hybrid, cloud, and on-premises environments.
• Provide architecture guidance, technical leadership, and recommendations for PKI modernization and certificate management initiatives.
• Support the implementation of scalable, secure, and highly available trust services aligned with enterprise security requirements.

Essential Skills and Qualifications

• 10+ years of experience in PKI, security architecture, certificate management, or related security engineering domains.
• Strong expertise in enterprise PKI architecture, including Root CA, Issuing CA, CRL, OCSP, HSM, and trust frameworks.
• Hands-on experience with Venafi Trust Protection Platform (TPP) architecture, administration, integration, and optimization.
• Strong knowledge of Certificate Lifecycle Management (CLM), machine identity management, certificate governance, and cryptographic controls.
• Experience designing and implementing automated certificate provisioning, renewal, rotation, and revocation workflows.
• Hands-on experience with Venafi APIs and automation technologies such as vCert, PowerShell, Python, and Ansible.
• Experience integrating certificate automation with GitHub Actions, Azure DevOps, and CI/CD pipelines.
• Ability to architect Venafi integrations with enterprise applications, cloud services, infrastructure, and security platforms.
• Experience supporting PKI and certificate management solutions across hybrid, cloud, and on-premises environments.
• Strong understanding of security best practices, access controls, high availability, resilience, and enterprise platform governance.
• Excellent architecture, troubleshooting, technical leadership, communication, and cross-functional collaboration skills.

Preferred Qualifications

• Experience leading enterprise-wide PKI modernization and certificate automation initiatives.
• Knowledge of cloud-native certificate management and machine identity security.
• Experience developing reusable automation frameworks and enterprise certificate onboarding standards.
• Ability to work effectively with security architects, infrastructure engineers, application teams, and DevOps stakeholders.

The PKI / Venafi Architect will provide technical and architectural leadership for enterprise PKI, machine identity management, and certificate lifecycle automation, ensuring secure, scalable, resilient, and automated certificate services across the organization.

Work Authorization

Applicants must be legally authorized to work in the United States.

Themesoft Inc is an Equal Employment Opportunity employer. We consider qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by applicable federal, state, or local law.