The Role
Manage enterprise PKI and certificate lifecycle services across on-premises, cloud, and hybrid environments. Responsibilities include operating root and issuing CAs, managing certificate issuance, renewal, revocation, CRLs, OCSP, HSMs, and certificate inventories. Automate processes with PowerShell, integrate PKI with infrastructure and applications, monitor compliance and cryptographic standards, support audits, and troubleshoot certificate and key-management issues involving ADCS, AWS, Venafi, and related platforms.
Summary Generated by Built In
PKI JD
Summary:
We are looking for a PKI/CLM Engineer with hands-on experience in ADCS, AWS ACM, and Venafi to design, implement, and manage enterprise PKI and Certificate Lifecycle Management services. The role includes certificate automation, policy enforcement, infrastructure and application integration, and ensuring compliance with security and audit standards. Required skills include CRL and OCSP maintenance, AWS Key Vault, cloud and hybrid environments, and PowerShell scripting for automation.
Roles Responsibilities: -
Manage enterprise PKI infrastructure including Root and Issuing Certificate.
Responsibilities:
· Manage certificate lifecycle activities: issuance, renewal, revocation, rekey, rollover, and retirement.
· Configure and maintain Offline Root CA, Issuing CAs, certificate templates/profiles, and policy constraints.
· Manage CRL/OCSP publishing and ensure high availability.
· Maintain PKI documentation aligned with standards like CP/CPS, operational runbooks, and SOPs.
· Support audits and compliance requirements, including CAB Forum standards.
· Manage and monitor PKI/HSM operations end-to-end, including health checks, backups, configurations, and policies.
· Implement and maintain processes for managing internal and external certificate lifecycles.
· Monitor certificates for expiration, perform timely renewals, and revoke compromised or obsolete certificates.
· Possess strong technical expertise in Microsoft Active Directory Certificate Services (ADCS), including OCSP, CRLs, certificate templates, key archival, and NDES/SCEP.
· Proficient in scripting and automation, especially PowerShell, with the ability to integrate PKI solutions across platforms such as network devices, load balancers, and Windows/Linux environments.
· Have solid understanding of cryptography and encryption standards, including TLS, X.509, RSA/ECC, CSRs, and secure key management with HSMs and TPMs.
· Hands-on experience with cloud-based certificate and key management; strong troubleshooting skills; exposure to AWS ACM/PCA, Venafi tools, and relevant security or PKI certifications is advantageous.
· Assist with enterprise-wide certificate lifecycle tasks, including requests, issuance, renewal, and revocation.
· Maintain and update inventories of machine identities, including certificates, keys, and service credentials.
· Assist in identifying orphaned, expired, or misconfigured machine identities.
· Monitor adherence to governance controls and escalate exceptions or risks.
· Maintain accurate certificate inventory records, including ownership, purpose, and expiration dates.
· Identify and report at-risk certificates, including expired, soon-to-expire, weak cryptography, or unknown owners.
· Assist with certificate issuance requests and validate required information.
· Demonstrate experience managing enterprise-scale PKI environments across on-premises and cloud platforms, including lifecycle management and automation (e.g., Venafi Trust Protection Platform).
· Possess strong technical expertise in Microsoft Active Directory Certificate Services (ADCS), including OCSP, CRLs, certificate templates, key archival, and NDES/SCEP.
· Knowledge of AD, DNS, IAM operations, and CyberArk Privilege Cloud is beneficial.
Required Skills:
· Microsoft ADCS
· SCEP
· AWS PCA
· Venafi
· HSM & Encryption
· PKI & Certificate Management.
· AD (Good to have)
· CyberArk (Good to have)
#Matchpoint
#LI-PROMOTED
#LI-Remote
Skills Required
- Hands-on experience with Microsoft Active Directory Certificate Services (ADCS)
- Experience with certificate lifecycle management, including issuance, renewal, revocation, rekey, rollover, and retirement
- Experience configuring Offline Root CAs, Issuing CAs, certificate templates, profiles, and policy constraints
- Experience managing CRL and OCSP publishing
- PowerShell scripting and automation experience
- Experience integrating PKI across network devices, load balancers, and Windows/Linux environments
- Understanding of cryptography and encryption standards, including TLS, X.509, RSA, ECC, and CSRs
- Experience with HSMs, TPMs, and secure key management
- Experience with cloud-based certificate and key management
- Experience with AWS ACM or AWS PCA
- Experience with Venafi tools or Trust Protection Platform
- Experience managing enterprise-scale PKI environments across on-premises and cloud platforms
- Knowledge of SCEP and NDES
- Knowledge of Active Directory, DNS, and IAM operations
- Knowledge of CyberArk Privilege Cloud
- Relevant security or PKI certifications
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Distro is an AI-powered platform designed to enhance the efficiency and productivity of distributor sales teams. By automating manual recruiting and sales tasks, the company helps teams move faster, reduce costs, and improve hiring outcomes. Their technology focuses on optimizing counter and inside sales operations, providing tools that assist recruitment and sales processes while maintaining human oversight in final decision-making.
