Senior Platform Engineer—Identity & PKI Security (AWS)

Private National Mortgage Acceptance Company, LLC; Westlake Village (CA); On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

Medical, Dental, Vision

Paid Time Off

Wellness Programs

Retirement benefits

Philanthropy Programs

Bonus opportunities

Job summary

Pennymac is seeking an experienced Platform Engineer to strengthen our AWS and Windows-based infrastructure. You will automate certificate lifecycle, secure PKI operations, and build scalable multi-account patterns while advancing IaC (Terraform/OpenTofu, CDK) and CI/CD pipelines with GitLab.

Strong AD, Kerberos and encryption expertise are essential. You will mentor juniors, collaborate with development teams, and help implement security best practices across deployments, monitoring, and

Qualifications

• Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience).
• 7+ years of experience in Platform Engineering, DevOps or SRE.
• Extensive hands-on AWS experience with ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3.
• Experience designing multi-account AWS environments with cross-account IAM and KMS policies.
• Strong PKI and certificate lifecycle experience, including CA operation, renewal automation and revocation.
• Experience deploying certificates on Windows (IIS) and Linux (Nginx/Apache/Tomcat).
• Strong Active Directory experience including AD DNS integration.
• Knowledge of Windows authentication Kerberos/NTLM, SPNs, delegation.
• Encryption at rest and in transit, with KMS or similar.
• IaC expertise using Terraform (OpenTofu) and AWS CDK.
• CI/CD with GitLab CI/CD.
• Security best practices in cloud and pipelines.
• Networking basics in cloud context (DNS, TLS, load balancers).
• Monitoring/logging with NewRelic, CloudWatch, Cloud Logging, Prometheus.
• Scripting: PowerShell, Python or Bash.
• Config management with Chef, AWS SSM, or Ansible.
• Problem solving and collaboration skills.

Responsibilities

• Design, implement, and manage scalable AWS infrastructure.
• Automate certificate lifecycle at enterprise scale and manage PKI operations.
• Maintain PKI resilience, CA operation, inventory and expiry alerts.
• Build event-driven automation in AWS (EventBridge, Lambda, Secrets Manager, SSM, S3).
• Deploy certificates to AWS services and to Windows/Linux servers.
• Design multi-account AWS patterns with cross-account IAM and KMS policies.
• Administer Active Directory and DNS for resilience and security.
• Support Windows authentication and Kerberos/NTLM models.
• Implement encryption at rest and in transit with key management.
• Develop and maintain IaC with Terraform/OpenTofu and AWS CDK/CDK.
• Manage Windows server config with Chef, SSM or Ansible.
• Design and optimize CI/CD pipelines with GitLab CI/CD.
• Enforce security best practices across infrastructure and deployment.
• Collaborate with development teams to deliver Platform Engineering solutions.
• Troubleshoot deployment and infra issues.
• Implement monitoring, logging and alerting for visibility.
• Contribute to Platform standards and mentor junior staff.

Skills

Platform Engineering

DevOps

SRE

AWS expertise

PKI lifecycle

IaC

GitLab CI/CD

Active Directory

Windows authentication

Terraform/OpenTofu

AWS CDK

Chef/Ansible/AWS SSM

Monitoring/Logging

PowerShell

Python/Bash

Education

Bachelor's degree in Computer Science, Engineering, or a related field

Tools

AWS (ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda, S3)

PKI/Certificate lifecycle

Active Directory

Nginx/Apache/Tomcat

IIS (Windows)

Terraform/OpenTofu

AWS CDK

GitLab CI/CD

Chef/Ansible/AWS SSM

NewRelic/CloudWatch/Prometheus

Job description

Pennymac is seeking an experienced Platform Engineer to strengthen our AWS and Windows-based infrastructure. You will automate certificate lifecycle, secure PKI operations, and build scalable multi-account patterns while advancing IaC (Terraform/OpenTofu, CDK) and CI/CD pipelines with GitLab.

Strong AD, Kerberos and encryption expertise are essential. You will mentor juniors, collaborate with development teams, and help implement security best practices across deployments, monitoring, and