PKI Operations Engineer
HybridFort Meade, Maryland, United States
Job Summary
Operate and sustain the production PKI environment on Red Hat Certificate System, managing CA availability, certificate lifecycle operations, and the issuance pipeline health. Run RA/CRL/OCSP operations and onboard new customers and enclaves, including secure hardening and CVE remediation for the PKI stack and underlying RHEL hosts. Monitor system performance, maintain alerting dashboards, and lead root-cause analysis for operational incidents while troubleshooting HSM integrations. Automate operational tasks using scripting and CI/CD tooling to reduce toil, and support the program's post-quantum cryptography migration from an operations standpoint. Provide development support for small fixes and tooling without owning core feature development. Communicate across government operations, commercial vendors, and contractors, documenting runbooks and escalating risks proactively.
Required Qualifications
- Active Secret clearance minimum (Top Secret preferred and may be required)
- Local to the DMV area with the ability to work on site at Fort Meade as requested
- Five (5)+ years of relevant systems/operations engineering experience (flexible for candidates with exceptional PKI depth)
- Strong Linux (RHEL) systems administration and operations background, including patch management and system hardening
- Knowledge or experience with Linux containers and container orchestration (Podman / Docker) and VMs (KVM)
- Hands-on experience operating PKI, x.509, cryptography, and system/software security technologies
- Direct experience operating Red Hat Certificate System (RHCS) — this is a Red Hat solution. Dogtag PKI experience (RHCS's upstream open-source project) is an accepted alternative skillset, as is comparable enterprise CA platform operations (EJBCA, Microsoft AD CS, Entrust Authority, ISC CertAgent, or similar)
- Scripting/automation proficiency (Python, Bash, or similar) for operational tooling
- DoD 8570/8140 IAT Level II certification (Security+ or equivalent)
- Strong written and verbal communication skills, with a habit of documenting runbooks and operational procedures
Desired Qualifications
- Prior DISA or DoD PKI program operations experience (Purebred, derived credentials, RA/CRL/OCSP operations at scale)
- HSM operations experience (Entrust nShield, Thales Luna) — the customer runs Entrust HSMs
- ACME protocol and certificate automation at scale
- Post-quantum cryptography familiarity (ML-DSA/Dilithium, Kyber, CNSA 2.0 timelines) from a migration/operations lens
- Configuration management and infrastructure-as-code (Ansible, or similar)
- Directory Server / LDAP operations experience
- Monitoring/observability tooling (Prometheus/Grafana, ELK, or similar) and incident response
- Agile / ITSM operating rhythms (Scrum, JIRA, change management)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.