Senior PKI Engineer & Automation Architect

Charles Schwab; Southlake (TX); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

401(k) match

Paid time off and sabbatical after 5+

Parental leave

Tuition reimbursement

Health, dental, and vision insurance

Job summary

Schwab is seeking a Senior Security Engineer specializing in PKI to design, implement, and run enterprise PKI services across on‑prem, SaaS, and IaaS environments. You will manage CAs, RAs, HSMs, and certificate lifecycles while building automation to scale trust across the organization.

The role requires hands-on expertise in PKI, certificate lifecycle management, and security engineering, with a strong focus on risk reduction, reliability, and cross‑team collaboration.

Qualifications

• 5+ years of hands-on experience in network security, data security, PKI, certificate management, or other cybersecurity-related controls and technologies.
• Strong understanding of Public Key Infrastructure PKI principles, including certificate lifecycle management, trust chains, validation, renewal, revocation, and common failure modes.
• Experience managing or supporting enterprise PKI technologies such as Microsoft Active Directory Certificate Services AD CS, Entrust, Venafi, or other commercial PKI solutions.
• Experience with Certificate Lifecycle Management automation using tools and scripting such as Venafi, PowerShell, and Python; GitHub and .NET experience are highly desired.
• Experience managing or working with Hardware Security Modules HSMs.
• Strong software engineering or automation background with the ability to design, build, and maintain services or automation that operate reliably at scale.
• Experience integrating PKI with authentication, access control, applications, infrastructure platforms, or enterprise security systems.
• Ability to assess system designs and identify trust, identity, certificate, or cryptographic risks without requiring deep cryptographic research or protocol design specialization.
• Proven ability to deliver high-visibility, high-impact cybersecurity projects with cross-functional teams while maintaining strong results across planning, requirements, design, testing, and deployment.
• Strong communication skills with the ability to translate technical information for different audiences and influence stakeholders across multiple levels of the organization.
• Bachelor’s degree in computer science or a related field highly preferred.

Responsibilities

• Architect, deploy, maintain, and enhance enterprise PKI infrastructure, including Certificate Authorities CAs, Registration Authorities RAs, Hardware Security Modules HSMs, and related certificate services.
• Implement and maintain issuance, renewal, revocation, and lifecycle management processes for digital certificates across users, servers, applications, services, and devices.
• Design and build automation that improves PKI reliability, reduces manual effort, and scales certificate lifecycle management across enterprise environments.
• Apply PKI, certificate, and trust concepts when designing or reviewing system architectures, platform integrations, authentication flows, access control mechanisms, and security automation.
• Integrate PKI solutions with security systems, applications, infrastructure platforms, developer workflows, and enterprise technology services.
• Identify and address trust failures, certificate lifecycle risks, validation gaps, automation issues, and potential sources of outages or security exposure.
• Conduct security assessments and audits of PKI systems to identify vulnerabilities, operational risks, and opportunities for improvement.
• Drive complex technical initiatives from design through delivery using cybersecurity practices, software engineering principles, agile delivery methods, and strong stakeholder engagement.
• Partner closely with Data Protection, Cybersecurity, infrastructure, application, developer, and engineering teams to ensure PKI services meet business, security, and operational needs.
• Translate technical PKI and trust requirements into practical, repeatable engineering patterns that can be adopted across teams.

Skills

PKI

Certificate Lifecycle

Automation

HSMs

Security Engineering

Cross-functional Collaboration

Communication

Cloud & On-prem

Education

Bachelor's degree in CS

Tools

AD CS

Entrust

Venafi

PowerShell

Python

GitHub

.NET

Job description

Schwab is seeking a Senior Security Engineer specializing in PKI to design, implement, and run enterprise PKI services across on‑prem, SaaS, and IaaS environments. You will manage CAs, RAs, HSMs, and certificate lifecycles while building automation to scale trust across the organization.

The role requires hands-on expertise in PKI, certificate lifecycle management, and security engineering, with a strong focus on risk reduction, reliability, and cross‑team collaboration.