Senior PKI Engineer - Remote-Flexible & Automation Leader

Blackbaud; Oregon; Hybrid; USD 102,000 - 133,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Remote-flexible workforce

Wellness Programs

401(k) program with employer match

Flexible paid time off

Generous Parental Leave

Donations for Doers

Pet insurance, legal and identity保护

Tuition reimbursement program

Job summary

Blackbaud is seeking a Sr PKI Engineer to operate and maintain our public key infrastructure and certificate management services. The role emphasizes automation, expansion of the Cryptographic Services Program, and integration with AD CS environments and HSM-backed services.

You will administer certificate lifecycles, monitor inventories, and coordinate renewals with application teams while maintaining runbooks and documentation.

Qualifications

• Strong hands-on experience operating Microsoft AD CS in an enterprise environment, including NDES.
• Experience administering Venafi Trust Protection Platform or Keyfactor Command.
• Knowledge of Fortanix Data Security Manager or comparable HSM solutions.
• Understanding of X.509 certificates, certificate chains, TLS, and private key protection.
• PowerShell scripting and troubleshooting skills.
• Ability to work with Active Directory, DNS, networking, application, and key management teams to resolve certificate issues.
• Understanding of cryptographic management in Microsoft Azure or Amazon AWS.
• Understanding and experience with certificate configuration and management on content delivery networks, web application firewalls, network load balancers and azure application gateways.
• Experience with change control, operational documentation, and production support.
• Experience and knowledge of offline root CA ceremonies and maintenance processes associated with an ORCA.

Responsibilities

• Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services, NDES, and CRL publication.
• Operate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command.
• Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations.
• Use Fortanix Data Security Manager and other HSM-backed services as part of PKI operations.
• Work with the team that owns those services to resolve access, connectivity, and key usage issues.
• Investigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues.
• Perform routine PKI health checks, patching, maintenance, backups, and recovery testing.
• Respond to certificate expiration alerts and coordinate renewals with application and infrastructure owners.
• Maintain existing PowerShell scripts, scheduled tasks, reports, and PKI automation.
• Maintain CLM/CLaaS infrastructure.
• Keep documentation, runbooks, and certificate records accurate.
• Support audits, change management, and incident response.

Skills

PKI operations

PowerShell scripting

Active Directory

TLS / X.509 knowledge

Cross-team collaboration

Audit & compliance

Tools

Microsoft AD CS

Venafi Trust Protection Platform

Keyfactor Command

Fortanix DSM

HSM administration

NDES

PowerShell

Job description

Blackbaud is seeking a Sr PKI Engineer to operate and maintain our public key infrastructure and certificate management services. The role emphasizes automation, expansion of the Cryptographic Services Program, and integration with AD CS environments and HSM-backed services.

You will administer certificate lifecycles, monitor inventories, and coordinate renewals with application teams while maintaining runbooks and documentation.