Sr Platform Engineer, Identity and Security

PennyMac Corp.; Westlake Village (CA); On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

Comprehensive Medical, Dental, and Vis

Paid Time Off Programs

Wellness Programs

Retirement benefits, 401k match

Life insurance

Tuition reimbursement

Philanthropy Programs

Bonus opportunities

Job summary

Pennymac, a leading mortgage finance company, seeks an experienced Platform Engineer to strengthen AWS and Windows environments, focusing on authentication, certificate services, and encryption. You will design and automate identity and cryptographic services across enterprise-scale infrastructure, promoting IaC practices and secure deployment.

Responsibilities include building scalable AWS infrastructure, PKI resilience, certificate automation, and CI/CD pipelines.

Qualifications

• Bachelor's degree or equivalent experience in a relevant field.
• 7+ years in Platform Engineering, DevOps or SRE roles.
• Extensive hands-on AWS experience with ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3.

Responsibilities

• Design, implement, and manage scalable AWS infrastructure.
• Automate certificate lifecycle at enterprise scale (issuance, renewal, revocation, deployment).
• Maintain PKI, CA operation, inventory, expiry alerting.
• Build event-driven automation in AWS (EventBridge, Lambda, Secrets Manager, SSM, S3).
• Deploy and bind certificates to AWS services and to Windows/Linux servers.
• Design multi-account AWS patterns (cross-account IAM, policies, KMS).
• Administer Active Directory and DNS; support Windows authentication incl. Kerberos/NTLM.
• Implement encryption at rest and in transit; manage keys and rotation.
• Develop IaC with Terraform/OpenTofu and AWS CDK; configure Windows with Chef/Ansible/SSM.
• Design, build, and optimize CI/CD with GitLab CI/CD; enforce security best practices.
• Collaborate with development teams; troubleshoot deployment issues.
• Implement monitoring, logging, and alerting for visibility.

Skills

AWS

Platform Engineering

SRE

DevOps

Terraform/OpenTofu

AWS CDK

GitLab CI/CD

PKI/Certificate Management

Active Directory

PowerShell

Python

Bash

Ansible

Chef

EventBridge

Lambda

IAM

KMS

Security best practices

Networking

Education

Bachelor's degree in Computer Science, Engineering, or related field

Tools

Terraform/OpenTofu

AWS CDK

GitLab CI/CD

Chef

Ansible

Job description

PENNYMAC

Pennymac is (NYSE: PFSI) is a specialty financial services firm with a comprehensive mortgage platform and integrated business focused on the production and servicing of U.S. mortgage loans and the management of investments related to the U.S. mortgage market.

At Pennymac, our people are the foundation of our success and at the heart of our dynamic work culture. Together, we work towards a unified goal of helping millions of Americans achieve aspirations of homeownership through the complete mortgage journey.

A Typical Day

We're looking for an experienced, forward-thinking engineer to strengthen our Platform Engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services and encryption. In this role, you'll design and automate the identity and cryptographic services that our Infrastructure and Application stack depends on, from certificate lifecycle automation at enterprise scale through to directory, authentication and key management. You'll work closely with diverse technology teams to streamline delivery, embed security best practices, and champion infrastructure-as-code. If you're passionate about automation, cloud-native patterns, and making critical services resilient, we want to hear from you.

Key Responsibilities

• Design, implement, and manage scalable and resilient infrastructure on AWS.
• Design and automate the certificate lifecycle at enterprise scale, covering issuance, validation, renewal, revocation and deployment to target workloads.
• Design, maintain and improve the resilience of Public Key Infrastructure (PKI), including certificate authority operation, certificate inventory and expiry alerting.
• Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager and S3.
• Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers.
• Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies and KMS key policies.
• Administer, secure and improve the resilience of Active Directory and DNS.
• Support and advance Windows authentication, including Kerberos, delegation and service account models.
• Implement encryption for data at rest and in transit, and manage keys, rotation and key access policy.
• Develop and maintain infrastructure-as-code (IaC) using both Terraform (OpenTofu) and AWS CloudFormation/CDK.
• Develop and maintain Configuration Management for Windows servers using Chef, AWS SSM or Ansible.
• Design, build, and optimize CI/CD pipelines using GitLab CI/CD.
• Implement and enforce security best practices across the infrastructure and deployment processes.
• Collaborate closely with development teams to understand their needs and provide Platform Engineering expertise.
• Troubleshoot and resolve infrastructure and application deployment issues.
• Implement and manage monitoring, logging and alerting to ensure system visibility and proactive issue detection.
• Clearly and concisely contribute to the development and documentation of Platform standards and best practices.
• Provide mentorship and guidance to junior team members.

What You’ll Bring

Required Qualifications

• Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience).
• 7+ years of experience in a Platform Engineering, DevOps or Site Reliability Engineering (SRE) role.
• Extensive hands-on experience with Amazon Web Services (AWS), including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3.
• Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies and KMS key policies.
• Strong Public Key Infrastructure (PKI) and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation and revocation.
• Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers.
• Strong Active Directory experience, including replication, FSMO roles, trust relationships and AD-integrated DNS.
• Strong understanding of Windows authentication protocols, specifically Kerberos and NTLM, including service principal names, delegation, supported encryption types and service account models.
• Practical experience with encryption at rest and in transit, and with key management services.
• Solid understanding of Windows Server administration and integration with cloud environments.
• Proven experience with infrastructure-as-code (IaC) tools, specifically Terraform (OpenTofu) and AWS CDK.
• Strong experience designing and implementing CI/CD pipelines using GitLab CI/CD.
• Deep understanding of security best practices and their implementation in cloud infrastructure and CI/CD pipelines.
• Solid understanding of networking principles (TCP/IP, DNS, load balancing, firewalls) in cloud environments.
• Experience with monitoring and logging tools (e.g., NewRelic, CloudWatch, Cloud Logging, Prometheus).
• Strong scripting skills, with PowerShell at an advanced level, plus Python or Bash.
• Experience with configuration management tools, such as Chef, AWS SSM, or Ansible.
• Excellent problem-solving and troubleshooting skills.
• Strong communication and collaboration skills.

Preferred Qualifications

• AWS Certified Security - Specialty, or other relevant AWS certifications, are a plus.
• Experience with certificate automation protocols and tooling (e.g., ACME, cert-manager or equivalent).
• Experience operating a private certificate authority.
• Experience with multi-tenant platforms and namespace isolation.
• Experience hardening Active Directory against credential attacks.
• Experience with Microsoft Entra ID and hybrid identity integration is a plus.
• Experience with disaster recovery design for critical services, including defined RTO and RPO targets.
• Strong background with AWS EC2 features and Services (Autoscaling and WarmPools)
• Understanding of Windows server Build process using tools like Chocolatey for packages and Packer for AMI/Image generation.
• Solid experience with the Windows server operating system and server tools such as IIS.
• Experience with containerization & orchestration technologies (e.g., Docker, Kubernetes) is a plus.

Why You Should Join

As one of the top mortgage lenders in the country, Pennymac has helped over 4 million lifetime homeowners achieve and sustain their aspirations of home. Our vision is to be the most trusted partner for home. Together, 4,000 Pennymac team members across the country are guided by our core values: to be Accountable, Reliable and Ethical in all that we do.

Pennymac is committed to conducting a business that makes positive contributions and promotes long-term sustainable growth and to fostering an equitable and inclusive environment, where all employees and customers feel valued, respected and supported.

Benefits That Bring It Home: Whether you're looking for flexible benefits for today, setting up short-term goals for tomorrow, or planning for long-term success and retirement, Pennymac's benefits have you covered. Some key benefits include:

• Comprehensive Medical, Dental, and Vision
• Paid Time Off Programs including vacation, holidays, illness, and parental leave
• Wellness Programs, Employee Recognition Programs, and onsite gyms and cafe style dining (select locations)
• Retirement benefits, life insurance, 401k match, and tuition reimbursement
• Philanthropy Programs including matching gifts, volunteer grants, charitable grants and corporate sponsorships
• We value the hard work and dedication of our employees. In addition to a competitive salary, positions may offer bonus opportunities.

To learn more about our benefits visit:

https://pennymacnews.page.link/benefits

For residents with state required benefit information, additional information can be found at: https://www.pennymac.com/additional-benefits-information

Compensation: Individual salary may vary based on multiple factors including specific role, geographic location / market data, and skills and experience as defined below:

• Lower in range - Building skills and experience in the role
• Mid-range - Experience and skills align with proficiency in the role
• Higher in range - Experience and skills add value above typical requirements of the role

Some roles may be eligible for performance-based compensation and/or stock-based incentives awarded to employees based on company and individual performance.

Salary

$110,000 - $170,000

Work Model

OFFICE