Senior PKI & IAM Security Engineer

Veriipro; Miami (FL); On-site; USD 140,000 - 190,000; Full time

Job summary

Veriipro is seeking an experienced PKI & IAM Security Engineer to modernize enterprise PKI infrastructure, migrate CAs, and manage certificate lifecycle platforms. Role includes designing scalable PKI, integrating SSO/MFA, and automating tasks with PowerShell and Python.

You will collaborate across security, infrastructure, and cloud teams, developing documentation, migration plans, and security standards for enterprise cryptographic modernization.

Qualifications

• Must have a Bachelor's degree in CS, cybersecurity, or a related field.
• 7+ years in cybersecurity or infra engineering, with 5+ years in enterprise PKI.
• 4+ years IAM engineering, including SSO, MFA, and access governance.
• Proven PKI migrations, CA rebuilds, and cryptographic modernization.
• Strong ADCS experience in multi-tier/multi-forest environments.
• Hands-on with certificate lifecycle platforms (Venafi/Keyfactor/AppViewX).
• Experience with HSMs (Thales Luna, Entrust nShield) and crypto key ceremonies.
• Knowledge of SOX, PCI DSS, HIPAA; strong documentation skills.

Responsibilities

• Assess PKI infra, CA hierarchies, trust relationships, and certs.
• Design scalable PKI with offline root CA and HSM-backed keys.
• Lead enterprise PKI migrations and CA rebuilds with minimal downtime.
• Admin ADCS in multi-tier/multi-forest environments.
• Implement certificate lifecycle platforms (Venafi/Keyfactor/AppViewX).
• Manage certificate discovery, renewal, revocation, and automation.
• Design and support IAM solutions including SSO and MFA.
• Develop automation using PowerShell, Python, REST APIs, JSON.
• Collaborate with security, infra, cloud teams; produce docs and plans.

Skills

PKI security

IAM engineering

Scripting (PowerShell/Python)

ADCS mastery

Certificate lifecycle mgmt

HSM familiarity

REST APIs/JSON

Security policy & audits

Education

Bachelor's degree in CS/Cybersecurity/Engineering

Tools

Venafi

Keyfactor

AppViewX

Microsoft ADCS

Job description

Job Summary

We are seeking an experienced PKI & IAM Security Engineer with strong hands-on expertise in Public Key Infrastructure (PKI), Identity and Access Management (IAM), cryptographic security, and enterprise security architecture.

The candidate will be responsible for modernizing enterprise PKI infrastructure, leading Certificate Authority (CA) migrations, managing certificate lifecycle platforms, and engineering IAM solutions, including Single Sign-On (SSO), Multi-Factor Authentication (MFA), and access governance.

Roles and Responsibilities

• Assess existing PKI infrastructure, CA hierarchies, trust relationships, certificates, and cryptographic configurations.
• Design and implement modern, scalable, and automated PKI architectures, including offline root CA, intermediate/issuing CAs, and HSM-backed key protection.
• Lead enterprise PKI migrations, CA rebuilds, certificate re-issuance, trust store distribution, and legacy CA decommissioning with minimal production disruption.
• Administer Microsoft Active Directory Certificate Services (ADCS) in multi-tier and multi-forest environments.
• Implement and manage certificate lifecycle management platforms such as Venafi, Keyfactor, and AppViewX.
• Perform certificate discovery, onboarding, renewal, revocation, and lifecycle automation.
• Manage Hardware Security Modules (HSMs), including Thales Luna and Entrust nShield, and participate in cryptographic key ceremonies.
• Design, implement, and support IAM solutions, including SSO, MFA, user lifecycle management, and access certification.
• Develop automation using PowerShell, Python, REST APIs, and JSON.
• Support security assessments, compliance audits, and security policy development.
• Collaborate with security architects, infrastructure, cloud, and engineering teams to implement enterprise security solutions.
• Develop technical documentation, migration plans, security standards, and operational procedures.

Required Skills & Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field.
• 7+ years of cybersecurity or infrastructure engineering experience.
• 5+ years of hands-on enterprise PKI experience and 4+ years of IAM engineering experience.
• Proven experience leading enterprise PKI migrations, CA rebuilds, or cryptographic modernization initiatives.
• Strong expertise in Microsoft ADCS and multi-tier, multi-forest PKI environments.
• Hands-on experience with Venafi, Keyfactor, AppViewX, or similar certificate lifecycle management platforms.
• Experience administering HSM solutions such as Thales Luna or Entrust nShield.
• Strong knowledge of certificate management, OCSP, CRL, certificate authorities, and cryptographic key management.
• IAM experience with SSO, MFA, identity lifecycle automation, and access governance.
• Strong scripting and automation skills using PowerShell and Python.
• Experience with REST APIs, JSON, and enterprise security automation.
• Knowledge of security compliance frameworks such as SOX, PCI DSS, and HIPAA.
• Strong communication, documentation, and stakeholder management skills.

Preferred Qualifications

• Cloud PKI and key management experience with Azure Key Vault, Azure Managed HSM, AWS Private CA, AWS ACM, AWS KMS, or Google Cloud Certificate Authority Service.
• Experience with workload identity solutions such as SPIFFE/SPIRE, Kubernetes cert-manager, and service mesh mTLS.
• Knowledge of HashiCorp Vault, CyberArk, or Delinea.
• Experience with cloud security architecture and enterprise cryptographic modernization.