Description

You will own the design and implementation of enterprise-scale security infrastructure focused on PKI and cryptographic controls.

Responsibilities

• Design and implement automated certificate lifecycle management for TLS/SSL, code signing, and device authentication across the network.
• Architect and maintain the internal Certificate Authority (CA) hierarchy and HSM infrastructure, ensuring compliance with FIPS 140-2/140-3.
• Design and implement secure firmware and code signing pipelines for avionics software per DO-326A requirements.
• Implement automated monitoring and alerting for certificate expiration, weak algorithms, and trust chain validation failures.
• Facilitate external compliance audits (CMMC, SOX, ITAR) and maintain cryptographic governance documentation (CP/CPS).

Required Skills

• 5+ years of experience in PKI engineering, cryptographic operations, or related security roles.
• Minimum 2 years designing and implementing production PKI systems at an architect or senior engineer level.
• Expertise in architecting Certificate Authority (CA) hierarchies and managing Hardware Security Module (HSM) infrastructure.
• Proficiency with Python, Go, Powershell, and Bash scripting for automation.
• Experience securing service-to-service authentication using mutual TLS (mTLS) and service mesh.
• Familiarity with compliance frameworks including CMMC Level 2, DO-326A, and NIST SP 800-171.
• Experience integrating PKI services with Identity and Access Management systems like Okta and Active Directory.
• Knowledge of Certificate Transparency logging, OCSP, and CRL distribution.

Key Skills

Education

Bachelor's degree