Sr Platform Engineer, Identity and Security
Private National Mortgage Acceptance Company, LLC
A complete application in a minute
Tailored resume and cover letter, ready to send.
Benefits offered by this job
Job summary
Pennymac is seeking an experienced Platform Engineer to strengthen our AWS and Windows-based infrastructure. You will automate certificate lifecycle, secure PKI operations, and build scalable multi-account patterns while advancing IaC (Terraform/OpenTofu, CDK) and CI/CD pipelines with GitLab.
Strong AD, Kerberos and encryption expertise are essential. You will mentor juniors, collaborate with development teams, and help implement security best practices across deployments, monitoring, and
Qualifications
- Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience).
- 7+ years of experience in Platform Engineering, DevOps or SRE.
- Extensive hands-on AWS experience with ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3.
- Experience designing multi-account AWS environments with cross-account IAM and KMS policies.
- Strong PKI and certificate lifecycle experience, including CA operation, renewal automation and revocation.
- Experience deploying certificates on Windows (IIS) and Linux (Nginx/Apache/Tomcat).
- Strong Active Directory experience including AD DNS integration.
- Knowledge of Windows authentication Kerberos/NTLM, SPNs, delegation.
- Encryption at rest and in transit, with KMS or similar.
- IaC expertise using Terraform (OpenTofu) and AWS CDK.
- CI/CD with GitLab CI/CD.
- Security best practices in cloud and pipelines.
- Networking basics in cloud context (DNS, TLS, load balancers).
- Monitoring/logging with NewRelic, CloudWatch, Cloud Logging, Prometheus.
- Scripting: PowerShell, Python or Bash.
- Config management with Chef, AWS SSM, or Ansible.
- Problem solving and collaboration skills.
Responsibilities
- Design, implement, and manage scalable AWS infrastructure.
- Automate certificate lifecycle at enterprise scale and manage PKI operations.
- Maintain PKI resilience, CA operation, inventory and expiry alerts.
- Build event-driven automation in AWS (EventBridge, Lambda, Secrets Manager, SSM, S3).
- Deploy certificates to AWS services and to Windows/Linux servers.
- Design multi-account AWS patterns with cross-account IAM and KMS policies.
- Administer Active Directory and DNS for resilience and security.
- Support Windows authentication and Kerberos/NTLM models.
- Implement encryption at rest and in transit with key management.
- Develop and maintain IaC with Terraform/OpenTofu and AWS CDK/CDK.
- Manage Windows server config with Chef, SSM or Ansible.
- Design and optimize CI/CD pipelines with GitLab CI/CD.
- Enforce security best practices across infrastructure and deployment.
- Collaborate with development teams to deliver Platform Engineering solutions.
- Troubleshoot deployment and infra issues.
- Implement monitoring, logging and alerting for visibility.
- Contribute to Platform standards and mentor junior staff.
Skills
Education
Tools
Job description
Pennymac is (NYSE: PFSI) is a specialty financial services firm with a comprehensive mortgage platform and integrated business focused on the production and servicing of U.S. mortgage loans and the management of investments related to the U.S. mortgage market.
At Pennymac, our people are the foundation of our success and at the heart of our dynamic work culture. Together, we work towards a unified goal of helping millions of Americans achieve aspirations of homeownership through the complete mortgage journey.
We're looking for an experienced, forward-thinking engineer to strengthen our Platform Engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services and encryption. In this role, you'll design and automate the identity and cryptographic services that our Infrastructure and Application stack depends on, from certificate lifecycle automation at enterprise scale through to directory, authentication and key management. You'll work closely with diverse technology teams to streamline delivery, embed security best practices, and champion infrastructure-as-code. If you're passionate about automation, cloud-native patterns, and making critical services resilient, we want to hear from you.
- Design, implement, and manage scalable and resilient infrastructure on AWS.
- Design and automate the certificate lifecycle at enterprise scale, covering issuance, validation, renewal, revocation and deployment to target workloads.
- Design, maintain and improve the resilience of Public Key Infrastructure (PKI), including certificate authority operation, certificate inventory and expiry alerting.
- Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager and S3.
- Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers.
- Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies and KMS key policies.
- Administer, secure and improve the resilience of Active Directory and DNS.
- Support and advance Windows authentication, including Kerberos, delegation and service account models.
- Implement encryption for data at rest and in transit, and manage keys, rotation and key access policy.
- Develop and maintain infrastructure-as-code (IaC) using both Terraform (OpenTofu) and AWS CloudFormation/CDK.
- Develop and maintain Configuration Management for Windows servers using Chef, AWS SSM or Ansible.
- Design, build, and optimize CI/CD pipelines using GitLab CI/CD.
- Implement and enforce security best practices across the infrastructure and deployment processes.
- Collaborate closely with development teams to understand their needs and provide Platform Engineering expertise.
- Troubleshoot and resolve infrastructure and application deployment issues.
- Implement and manage monitoring, logging and alerting to ensure system visibility and proactive issue detection.
- Clearly and concisely contribute to the development and documentation of Platform standards and best practices.
- Provide mentorship and guidance to junior team members.
- Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience).
- 7+ years of experience in a Platform Engineering, DevOps or Site Reliability Engineering (SRE) role.
- Extensive hands-on experience with Amazon Web Services (AWS), including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3.
- Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies and KMS key policies.
- Strong Public Key Infrastructure (PKI) and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation and revocation.
- Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers.
- Strong Active Directory experience, including replication, FSMO roles, trust relationships and AD-integrated DNS.
- Strong understanding of Windows authentication protocols, specifically Kerberos and NTLM, including service principal names, delegation, supported encryption types and service account models.
- Practical experience with encryption at rest and in transit, and with key management services.
- Solid understanding of Windows Server administration and integration with cloud environments.
- Proven experience with infrastructure-as-code (IaC) tools, specifically Terraform (OpenTofu) and AWS CDK.
- Strong experience designing and implementing CI/CD pipelines using GitLab CI/CD.
- Deep understanding of security best practices and their implementation in cloud infrastructure and CI/CD pipelines.
- Solid understanding of networking principles (TCP/IP, DNS, load balancing, firewalls) in cloud environments.
- Experience with monitoring and logging tools (e.g., NewRelic, CloudWatch, Cloud Logging, Prometheus).
- Strong scripting skills, with PowerShell at an advanced level, plus Python or Bash.
- Experience with configuration management tools, such as Chef, AWS SSM, or Ansible.
- Excellent problem-solving and troubleshooting skills.
- Strong communication and collaboration skills.
- AWS Certified Security – Specialty, or other relevant AWS certifications, are a plus.
- Experience with certificate automation protocols and tooling (e.g., ACME, cert-manager or equivalent).
- Experience operating a private certificate authority.
- Experience with multi-tenant platforms and namespace isolation.
- Experience hardening Active Directory against credential attacks.
- Experience with Microsoft Entra ID and hybrid identity integration is a plus.
- Experience with disaster recovery design for critical services, including defined RTO and RPO targets.
- Strong background with AWS EC2 features and Services (Autoscaling and WarmPools)
- Understanding of Windows server Build process using tools like Chocolatey for packages and Packer for AMI/Image generation.
- Solid experience with the Windows server operating system and server tools such as IIS.
- Experience with containerization & orchestration technologies (e.g., Docker, Kubernetes) is a plus.
As one of the top mortgage lenders in the country, Pennymac has helped over 4 million lifetime homeowners achieve and sustain their aspirations of home. Our vision is to be the most trusted partner for home. Together, 4,000 Pennymac team members across the country are guided by our core values: to be Accountable, Reliable and Ethical in all that we do.
Pennymac is committed to conducting a business that makes positive contributions and promotes long-term sustainable growth and to fostering an equitable and inclusive environment, where all employees and customers feel valued, respected and supported.
Benefits That Bring It Home: Whether you're looking for flexible benefits for today, setting up short-term goals for tomorrow, or planning for long-term success and retirement, Pennymac's benefits have you covered. Some key benefits include:
- Comprehensive Medical, Dental, and Vision
- Paid Time Off Programs including vacation, holidays, illness, and parental leave
- Wellness Programs, Employee Recognition Programs, and onsite gyms and cafe style dining (select locations)
- Retirement benefits, life insurance, 401k match, and tuition reimbursement
- Philanthropy Programs including matching gifts, volunteer grants, charitable grants and corporate sponsorships
- We value the hard work and dedication of our employees. In addition to a competitive salary, positions may offer bonus opportunities.
To learn more about our benefits visit: https://pennymacnews.page.link/benefits
For residents with state required benefit information, additional information can be found at: https://www.pennymac.com/additional-benefits-information
Compensation: Individual salary may vary based on multiple factors including specific role, geographic location / market data, and skills and experience as defined below:
- Lower in range - Building skills and experience in the role
- Mid-range - Experience and skills align with proficiency in the role
- Higher in range - Experience and skills add value above typical requirements of the role
Some roles may be eligible for performance-based compensation and/or stock-based incentives awarded to employees based on company and individual performance.
$110,000 - $170,000
OFFICE
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
