Job Description
PKI Certificate Infrastructure Engineer
Job Summary
We are seeking a mid-level PKI (Public Key Infrastructure) Certificate Infrastructure Engineer to design, deploy, administer, and maintain enterprise PKI and digital certificate infrastructure. The engineer will be responsible for certificate lifecycle management, Certificate Authority (CA) infrastructure, Hardware Security Modules (HSMs), cryptographic key management, automation, monitoring, and operational support. The ideal candidate will have hands-on experience supporting enterprise PKI environments and securing certificates and cryptographic keys used across applications, servers, APIs, network infrastructure, and cloud environments.
Key Responsibilities
- Design, deploy, configure, and maintain enterprise PKI and Certificate Authority infrastructure.
- Manage the complete digital certificate lifecycle, including certificate enrollment, issuance, renewal, revocation, expiration, and replacement.
- Administer Root CA, Intermediate/Issuing CA, certificate templates, CRLs, OCSP, and related PKI services.
- Deploy, configure, and support Hardware Security Modules (HSMs) used to protect private keys and other cryptographic assets.
- Manage cryptographic key lifecycle activities, including secure key generation, storage, rotation, backup, recovery, archival, and retirement.
- Support TLS/SSL certificates, client certificates, machine certificates, code-signing certificates, and other enterprise certificate use cases.
- Monitor certificate inventories and expiration dates and implement processes to prevent certificate-related application or service outages.
- Troubleshoot certificate trust chains, certificate enrollment, TLS/SSL, CRL/OCSP validation, private key, and HSM-related issues.
- Automate certificate provisioning, renewal, discovery, and lifecycle processes using scripting and certificate management platforms.
- Integrate PKI services with Windows/Linux servers, Active Directory, cloud infrastructure, applications, APIs, and network/security platforms.
- Maintain PKI configuration, operational procedures, certificate policies, and technical documentation.
- Support security assessments, audits, vulnerability remediation, and compliance requirements related to cryptography and certificate management.
- Collaborate with Cybersecurity, IAM, Cloud, Infrastructure, Network, DevOps, and Application teams to implement secure certificate solutions.
Must-Have Technical / Functional Skills
- Strong hands-on experience with Public Key Infrastructure (PKI) and enterprise certificate management.
- Experience administering Certificate Authorities (CA) and certificate lifecycle processes.
- Strong understanding of:
- X.509 digital certificates
- Public/private key cryptography
- TLS/SSL
- Certificate signing requests (CSRs)
- Certificate chains and trust stores
- CRL and OCSP
- Encryption and digital signatures
- Hands-on experience with Hardware Security Modules (HSMs) and cryptographic key management.
- Experience with Microsoft Active Directory Certificate Services (AD CS) or equivalent enterprise PKI platforms.
- Knowledge of certificate enrollment technologies such as SCEP, EST, ACME, or related protocols.
- Experience troubleshooting certificate, TLS, trust-chain, and cryptographic issues in enterprise environments.
- Scripting/automation experience using PowerShell, Python, Bash, or equivalent.
- Working knowledge of Windows and Linux environments.
- Understanding of security controls and industry practices related to key protection, certificate issuance, encryption, and cryptographic operations.
Preferred / Nice-to-Have Skills
- Experience with enterprise certificate lifecycle management solutions such as Keyfactor, Venafi, DigiCert, Sectigo, or similar platforms.
- Experience with HSM technologies from vendors such as Thales or Entrust.
- Knowledge of cloud certificate/key management services in Microsoft Azure, AWS, or GCP.
- Experience integrating certificates into DevOps/CI/CD pipelines, APIs, Kubernetes, containers, and cloud-native applications.
- Familiarity with NIST cryptographic guidance, FIPS 140-2/140-3, and security/audit requirements.
- Exposure to Secrets Management, IAM, Zero Trust, or broader cryptographic security technologies.
Qualifications
- Approximately 3-6 years of relevant infrastructure/security engineering experience, with meaningful hands-on exposure to PKI and certificate technologies.
- Strong analytical and troubleshooting skills with the ability to support critical enterprise certificate infrastructure.
- Ability to collaborate effectively with application, infrastructure, cloud, network, and cybersecurity teams.
Salary Range- $110,000-$120,000 a year #LI-SP3 #LI-VX1
Location
Phoenix, AZ
Function
TECHNOLOGY
Role
Engineer
ID
437826
Skills
IT Infrastructure
Salary Range
$110,000 - $120,000 |
Tata Consultancy Services
$110,000 - $120,000
Oct 29, 2026