PKI Engineer

Distro
Brazil
Remote

Who this role is best for

Best suited to candidates with hands-on experience in enterprise PKI and automation tools working in cloud and hybrid environments.

Best fit for

  • Candidates with strong experience in ADCS, AWS PCA, and Venafi in cloud and hybrid environments
    — “design, implement, and manage enterprise PKI and Certificate Lifecycle Management services”
  • Individuals who have managed large-scale certificate inventories and performed automation tasks
    — “Maintain and update inventories of machine identities, including certificates, keys, and service credentials”
  • Professionals with a focus on compliance and governance in PKI operations
    — “Support audits and compliance requirements, including CAB Forum standards”

Things to consider

  • The role demands high availability and reliability in CRL/OCSP publishing operations
    — “Manage CRL/OCSP publishing and ensure high availability”
  • Certifications in PKI or security are advantageous but not mandatory
    — “exposure to AWS ACM/PCA, Venafi tools, and relevant security or PKI certifications is advantageous”

How to stand out

  • Highlight experience with certificate automation and integration across cloud and hybrid platforms
    — “Implement and maintain processes for managing internal and external certificate lifecycles”
  • Emphasize hands-on skills with ADCS, OCSP, and CRLs in your resume and interview responses
    — “Possess strong technical expertise in Microsoft Active Directory Certificate Services (ADCS), including OCSP, CRLs, certificate templates, key archival, and NDES/SCEP”
  • Demonstrate familiarity with HSMs and TPMs for secure key management in your application materials
    — “secure key management with HSMs and TPMs”
  • Showcase PowerShell scripting capabilities for certificate lifecycle automation
    — “Proficient in scripting and automation, especially PowerShell”
  • Demonstrate knowledge of certificate governance and risk identification practices
    — “Identify and report at-risk certificates, including expired, soon-to-expire, weak cryptography, or unknown owners”
Pace · SteadyCollaboration · MediumAutonomy · MediumDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

  • secure PKI infrastructure
  • certificate automation
  • compliance adherence
Typical background
hands-on PKI experiencescripting skills

Skills & requirements

Required

PKI ManagementCertificate LifecycleAutomationCloud PKIScripting

Preferred

AD OperationsCyberark

Stack & domain

PKICLMADCSAWS ACMVenafiCertificate Lifecycle ManagementCRLOCSPAWS Key VaultPowershellCryptographyEncryptionTLSX.509Rsa/eccCsrsHSMTpmsCloud-based Certificate And Key ManagementNetwork DevicesLoad BalancersWindows/linux EnvironmentsProblem-solvingTechnical ExpertiseScriptingAutomationTroubleshootingCollaborationCommunicationSecurityITNetworking

About the role

Original posting from Distro via Lever

PKI JD

Summary:

We are looking for a PKI/CLM Engineer with hands-on experience in ADCS, AWS ACM, and Venafi to design, implement, and manage enterprise PKI and Certificate Lifecycle Management services. The role includes certificate automation, policy enforcement, infrastructure and application integration, and ensuring compliance with security and audit standards. Required skills include CRL and OCSP maintenance, AWS Key Vault, cloud and hybrid environments, and PowerShell scripting for automation.

Roles Responsibilities: -

Manage enterprise PKI infrastructure including Root and Issuing Certificate.

Responsibilities:

· Manage certificate lifecycle activities: issuance, renewal, revocation, rekey, rollover, and retirement.

· Configure and maintain Offline Root CA, Issuing CAs, certificate templates/profiles, and policy constraints.

· Manage CRL/OCSP publishing and ensure high availability.

· Maintain PKI documentation aligned with standards like CP/CPS, operational runbooks, and SOPs.

· Support audits and compliance requirements, including CAB Forum standards.

· Manage and monitor PKI/HSM operations end-to-end, including health checks, backups, configurations, and policies.

· Implement and maintain processes for managing internal and external certificate lifecycles.

· Monitor certificates for expiration, perform timely renewals, and revoke compromised or obsolete certificates.

· Possess strong technical expertise in Microsoft Active Directory Certificate Services (ADCS), including OCSP, CRLs, certificate templates, key archival, and NDES/SCEP.

· Proficient in scripting and automation, especially PowerShell, with the ability to integrate PKI solutions across platforms such as network devices, load balancers, and Windows/Linux environments.

· Have solid understanding of cryptography and encryption standards, including TLS, X.509, RSA/ECC, CSRs, and secure key management with HSMs and TPMs.

· Hands-on experience with cloud-based certificate and key management; strong troubleshooting skills; exposure to AWS ACM/PCA, Venafi tools, and relevant security or PKI certifications is advantageous.

· Assist with enterprise-wide certificate lifecycle tasks, including requests, issuance, renewal, and revocation.

· Maintain and update inventories of machine identities, including certificates, keys, and service credentials.

· Assist in identifying orphaned, expired, or misconfigured machine identities.

· Monitor adherence to governance controls and escalate exceptions or risks.

· Maintain accurate certificate inventory records, including ownership, purpose, and expiration dates.

· Identify and report at-risk certificates, including expired, soon-to-expire, weak cryptography, or unknown owners.

· Assist with certificate issuance requests and validate required information.

· Demonstrate experience managing enterprise-scale PKI environments across on-premises and cloud platforms, including lifecycle management and automation (e.g., Venafi Trust Protection Platform).

· Possess strong technical expertise in Microsoft Active Directory Certificate Services (ADCS), including OCSP, CRLs, certificate templates, key archival, and NDES/SCEP.

· Knowledge of AD, DNS, IAM operations, and CyberArk Privilege Cloud is beneficial.

Required Skills:

· Microsoft ADCS

· SCEP

· AWS PCA

· Venafi

· HSM & Encryption

· PKI & Certificate Management.

· AD (Good to have)

· CyberArk (Good to have)

#Matchpoint

#LI-PROMOTED

#LI-Remote

Source: Distro careers (Lever)

Similar roles

More roles at Distro