Sr. PKI Engineer

Blackbaud; United States; On-site; USD 102,000 - 133,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

Remote-flexible workforce

Wellness Programs

401(k) program with employer match

Flexible paid time off

Generous Parental Leave

Donations for Doers

Pet insurance, legal and identity保护

Tuition reimbursement program

Job summary

Blackbaud seeks a senior PKI engineer to administer AD CS, NDES, and certificate lifecycle across an enterprise. You will manage Venafi or Keyfactor-powered PKI platforms, monitor inventory, support renewals, and troubleshoot integrations with Azure or AWS.

Strong PowerShell skills and deep TLS/X.509 knowledge are required. You will collaborate with networking, cloud, and application teams to ensure secure key usage, perform health checks, and maintain runbooks and documentation for audits and

Qualifications

• Strong hands-on experience operating Microsoft AD CS in an enterprise environment.
• Experience administering Venafi Trust Protection Platform or Keyfactor Command.
• Knowledge of Fortanix DSM or similar HSM solutions and PKI key management.

Responsibilities

• Administer and maintain AD CS including CAs, templates, enrollment, NDES, and CRL publication.
• Operate PKI platform like Venafi or Keyfactor; monitor inventory and support renewals.
• Perform PKI health checks, patching, backups, and recovery testing; respond to expiration alerts.

Skills

PKI management

PowerShell scripting

AD CS administration

TLS/X.509

Cross-functional collaboration

Tools

Venafi Trust Protection Platform

Keyfactor Command

Fortanix Data Security Manager

HSM solutions

PKI tooling and automation

Job description

Responsibilities

Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services (including autoenrollment), Network Device Enrollment Service (NDES), and CRL publication. Operate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command. Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations. Use Fortanix Data Security Manager and other HSM-backed services as part of PKI operations. Work with the team that owns those services to resolve access, connectivity, and key usage issues. Investigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues. Perform routine PKI health checks, patching, maintenance, backups, and recovery testing. Respond to certificate expiration alerts and coordinate renewals with application and infrastructure owners. Maintain existing PowerShell scripts, scheduled tasks, reports, and PKI automation. Maintain CLM/CLaaS infrastructure. Keep documentation, runbooks, and certificate records accurate. Support audits, change management, and incident response. The immediate goal of this role is to keep established PKI services secure, available, documented, and running smoothly.

Required qualifications

Strong hands-on experience operating Microsoft AD CS in an enterprise environment, including NDES. Experience administering Venafi Trust Protection Platform or Keyfactor Command. Working knowledge of Fortanix Data Security Manager or comparable HSM solutions, including how PKI services use protected keys. Direct responsibility for administering the HSM platform is not required. Strong understanding of X.509 certificates, certificate chains, enrollment, revocation, TLS, and private key protection. PowerShell scripting and troubleshooting skills. Ability to work with Active Directory, DNS, networking, application, and key management teams to resolve certificate issues. Understanding of cryptographic management in Microsoft Azure or Amazon AWS. Understanding and experience with certificate configuration and management on content delivery networks, web application firewalls, network load balancers and azure application gateways. Experience with change control, operational documentation, and production support. Experience and knowledge of offline root CA ceremonies and maintenance processes associated with an ORCA

Preferred qualifications

Experience supporting code signing or publicly trusted TLS certificates. Familiarity with PKI backup, recovery, and audit requirements. Stay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube

Blackbaud powers social impact through purpose‑driven technology and responsible AI. Guided by our Intelligence for Good® vision, we’re building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world.

Blackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.

The starting base pay is $101,900.00 to $132,800.00. Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.

Benefits

• Medical, dental, and vision insurance
• Remote-flexible workforce
• Wellness Programs
• 401(k) program with employer match
• Flexible paid time off
• Generous Parental Leave
• Donations for Doers
• Pet insurance, legal and identity protection
• Tuition reimbursement program

Blackbaud (NASDAQ: BLKB) is the world’s leading cloud software company powering social good. Serving the entire social good community—nonprofits, foundations, corporations, education institutions, healthcare institutions and individual change agents—Blackbaud connects and empowers organizations to increase their impact through software, services, expertise, and data intelligence. Serving the industry for more than three decades, Blackbaud is headquartered in Charleston, South Carolina and has operations in the United States, Australia, Canada, and the United Kingdom.