PKI Engineer

Job Title: PKI & Venafi Certificate Lifecycle Management EngineerLocation: Chicago, ILWork Model: Hybrid – OnsiteExperience: 8+ Years in PKI / Certificate Lifecycle ManagementVenafi Experience: 5+ Years of Hands-on Administration and EngineeringJob SummaryWe are seeking an experienced PKI & Venafi Certificate Lifecycle Management Engineer to administer, engineer, and automate enterprise certificate lifecycle management solutions. The ideal candidate will have strong hands-on experience with Venafi, Public Key Infrastructure (PKI), TLS/SSL certificates, certificate automation, and enterprise security integrations.This role involves managing the end-to-end certificate lifecycle, onboarding applications into the Certificate Lifecycle Management (CLM) platform, developing automation solutions, supporting PKI infrastructure, and ensuring compliance with enterprise security standards.Key Responsibilities1. Certificate Lifecycle ManagementAdminister and support enterprise Certificate Lifecycle Management (CLM) services.Manage the complete certificate lifecycle, including discovery, request, issuance, renewal, revocation, deployment, monitoring, and retirement.Maintain certificate inventory, visibility, ownership, and compliance.Identify and remediate expired, expiring, unmanaged, self-signed, and non-compliant certificates.Ensure adherence to enterprise certificate policies and industry standards.2. Venafi Platform AdministrationAdminister, configure, and maintain the Venafi Trust Protection Platform (TPP) and Venafi SaaS solutions.Configure certificate policies, workflows, Certificate Authorities (CAs), integrations, discovery jobs, notifications, reporting, and access controls.Support platform upgrades, maintenance, enhancements, and technology refresh initiatives.Troubleshoot platform issues and collaborate with Venafi support teams and vendors to implement solutions.Maintain platform stability, security, availability, and operational efficiency.3. Application Onboarding & Solution EngineeringLead application onboarding into the enterprise Certificate Lifecycle Management platform.Assess application certificate requirements and define appropriate onboarding and deployment strategies.Partner with application, infrastructure, cloud, and security teams to understand application architectures, certificate formats, trust requirements, and operational processes.Design scalable and reusable certificate onboarding and automation patterns.Support certificate integrations across Windows, Linux/Unix, Azure, Kubernetes, WebLogic, IIS, F5, Kafka, Solace, PingFederate, and cloud-native platforms.Provide technical guidance and recommendations to application teams.4. Certificate Automation & DevSecOps IntegrationDesign, implement, and maintain automated certificate provisioning, renewal, deployment, and validation solutions.Develop automation using Venafi Native Drivers, Venafi APIs, vCert utilities, PowerShell, Python, Ansible, and REST APIs.Integrate certificate lifecycle processes with CI/CD pipelines, GitHub Actions, and Azure DevOps.Automate certificate deployment validation and application restart activities where required.Develop reusable automation frameworks to reduce manual effort, minimize operational risk, and improve service reliability.Collaborate with DevOps and application teams to integrate certificate management into software delivery workflows.5. PKI Operations & ResiliencySupport enterprise PKI infrastructure, Certificate Authority services, and certificate issuance processes.Manage and support root and intermediate Certificate Authorities, Certificate Revocation Lists (CRLs), and related certificate infrastructure.Participate in backup and recovery testing, disaster recovery exercises, and resiliency improvements.Monitor certificate ecosystem health, availability, and performance.Troubleshoot certificate infrastructure issues and participate in major incident response activities.Support cryptographic key management and Hardware Security Module (HSM) integrations, where applicable.6. Security, Governance & ComplianceSupport certificate governance, security controls, and compliance initiatives.Ensure adherence to TLS/SSL security standards, certificate issuance policies, cryptographic key management practices, and CA controls.Maintain certificate ownership, metadata, accountability, and audit records.Participate in security audits, control assessments, evidence collection, and remediation activities.Apply security best practices related to authentication, authorization, secrets management, cloud security, and Zero Trust principles.7. Operational Support & DocumentationProvide L2/L3 support for PKI, certificate lifecycle, TLS/SSL, and Venafi-related incidents.Troubleshoot certificate provisioning, renewal failures, trust chain issues, and application integration problems.Support service requests, incident management, problem management, change implementation, and production releases.Participate in maintenance windows, platform upgrades, and release activities.Develop and maintain architecture documents, implementation guides, runbooks, operational procedures, troubleshooting guides, and application onboarding documentation.Deliver knowledge transfer and technical guidance to support teams and application owners.Ensure operational SLAs and service availability targets are met.Required Technical SkillsPKI & CryptographyPublic Key Infrastructure (PKI)X.509 Certificates and TLS/SSLCertificate Authorities (CA)Certificate Revocation Lists (CRL) and OCSPCryptographic Key ManagementRoot and Intermediate CA ManagementHardware Security Modules (HSM)Code-Signing CertificatesVenafi PlatformVenafi Trust Protection Platform (TPP)Venafi SaaSCertificate Discovery and AutomationVenafi APIs and vCert UtilitiesVenafi Native Drivers and Adaptable AppsCertificate Lifecycle WorkflowsPolicy Configuration, Reporting, and GovernancePlatforms & IntegrationsWindows Server and IISLinux/UnixMicrosoft Azure and Azure Key VaultKubernetes and cloud-native environmentsF5 Load BalancersApache, Tomcat, and WebLogicKafka and SolacePingFederateServiceNow IntegrationsDevOps & AutomationPowerShell and PythonREST APIsAnsibleGitHub ActionsAzure DevOpsCI/CD Pipeline IntegrationInfrastructure and Certificate AutomationSecurity DomainsAuthentication and AuthorizationIdentity and Access Management (IAM)Secrets ManagementZero Trust PrinciplesCloud SecuritySecurity Monitoring and ComplianceQualifications & ExperienceBachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field.8+ years of experience supporting PKI, TLS certificates, or Certificate Lifecycle Management.5+ years of hands-on experience administering and engineering the Venafi platform.Strong understanding of PKI architecture, certificate lifecycle processes, and enterprise certificate management.Proven experience implementing certificate automation solutions and DevSecOps integrations.Experience supporting enterprise-scale certificate environments and application onboarding.Strong troubleshooting, analytical, and problem-solving skills.Excellent communication, documentation, and stakeholder management skills.Preferred Candidate ProfileThe ideal candidate is a hands-on PKI and Venafi engineer who can manage enterprise certificate environments, lead application onboarding, implement scalable automation solutions, troubleshoot complex certificate issues, and collaborate effectively with application, infrastructure, cloud, and security teams.