Senior Public Key Infrastructure (PKI) Engineer
HybridFairfax, Virginia, United States
Job Summary
Architect, deploy, and maintain enterprise PKI environments and Certificate Authority infrastructure, including Microsoft Active Directory Certificate Services. Design certificate strategies across Windows, Linux, virtualization, and cloud platforms while automating lifecycle management using ACME, PowerShell, Python, or Terraform. Troubleshoot TLS/SSL certificates, integrate services with Azure, AWS, and DevSecOps pipelines, and support Zero Trust initiatives and post-quantum cryptography planning. Ensure compliance with NIST, FIPS, and DISA STIGs, participate in incident response, and mentor junior engineers. Hybrid onsite role in Fairfax, VA, with Top Secret clearance sponsorship.
Required Qualifications
- U.S. Citizen with an active Secret clearance; eligible for Top Secret (ZTI sponsors processing)
- Hybrid: up to 3 days/week onsite in Fairfax, VA
- DoD 8140 IAT Level II certification (Security+ CE or higher), or ability to obtain within 90 days
- 8+ years of systems/security engineering experience with 4+ years focused on enterprise PKI (or 12 years total without a degree)
- Experience administering AD CS or comparable enterprise PKI platforms
- Experience automating certificate lifecycle management at scale
- Experience administering Windows Server and/or Linux
- Strong understanding of X.509, CRL/OCSP, enterprise trust models, cryptographic algorithms, and key management
- Excellent analytical, problem-solving, and communication skills
Desired Qualifications
- CISSP, Azure Security Engineer Associate, or AWS Certified Security - Specialty
- Experience with Entrust, DigiCert, EJBCA, Keyfactor, Venafi, or similar platforms
- Hardware Security Module (HSM) experience
- Azure Government, AWS GovCloud, or hybrid cloud environments
- PKI integration with Kubernetes, containers, or service mesh
- Experience supporting DoD RMF, FedRAMP, or CMMC compliance initiatives
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.