Remote VP, Enterprise PKI & Cryptographic Engineering

New-York-Life; New York (NY); Hybrid; USD 148,000 - 211,000; Full time

Job summary

New York Life seeks a senior PKI and cryptographic engineering leader to design, implement, and modernize the company’s enterprise PKI, certificate lifecycle, and cryptographic services across data centers and cloud environments.

The role emphasizes hands-on design, automation, and production delivery, with collaboration across Security Review Board and Architecture Review Board to mitigate PKI risks.

Qualifications

• 8+ years of hands-on PKI/cryptographic engineering experience.
• Experience with enterprise PKI environments and Microsoft AD CS.
• Experience with cloud PKI (AWS/Azure/GCP) and DevOps integrations.

Responsibilities

• Design, engineer, and modernize enterprise PKI services and trust hierarchies across on-prem and cloud.
• Configure and maintain Microsoft AD CS, templates, trust chains, CRLs, OCSP, and recovery.
• Own Certificate Lifecycle Management (CLM) from discovery to revocation; drive automation APIs.
• Build self-service certificate APIs (ACME, SCEP, EST, REST) and integrate with CI/CD, Kubernetes, ServiceNow.
• Manage HSM/KMS-backed CA, key ceremonies, backup, rotation, and DR across environments.
• Provide SME input to Security Review Board and Architecture Review Board and advise on PKI risks.

Skills

PKI engineering

Cryptographic engineering

AD CS

Certificate lifecycle mgmt

Cloud PKI

Education

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering

Tools

Venafi

AppViewX

Keyfactor

DigiCert Trust Lifecycle Manager

Job description

New York Life seeks a senior PKI and cryptographic engineering leader to design, implement, and modernize the company’s enterprise PKI, certificate lifecycle, and cryptographic services across data centers and cloud environments.

The role emphasizes hands-on design, automation, and production delivery, with collaboration across Security Review Board and Architecture Review Board to mitigate PKI risks.