PKI Venafi Architect
Lead enterprise PKI architecture and Venafi implementations, advancing certificate automation, governance, and machine identity security.
Job Description
PKI and Security Architecture
PKI and Security Architecture
- Design and maintain enterprise Public Key Infrastructure (PKI) architecture, including Root CA, Issuing CA, CRL, OCSP, HSM, and trust frameworks.
- Develop certificate governance standards, policies, and cryptographic control frameworks.
- Architect highly available and resilient PKI and Certificate Lifecycle Management (CLM) platforms.
- Drive enterprise machine identity and certificate management strategy.
- Design and administer Venafi Trust Protection Platform (TPP).
- Define onboarding standards, workflows, policies, reporting, discovery jobs, and access models.
- Architect integrations between Venafi and enterprise applications, cloud services, and security platforms.
- Lead Venafi platform upgrades, enhancements, and optimisation initiatives.
- Architect automated certificate provisioning and renewal solutions.
- Design automation frameworks using:
- Venafi APIs
- vCert
- PowerShell
- Python
- Ansible
- GitHub Actions
- Azure DevOps
- CI/CD pipelines
- Drive adoption of certificate automation across enterprise application portfolios.
- Lead application onboarding into CLM services.
- Support certificate deployment and automation across:
- Windows Server
- Linux/Unix
- IIS
- Apache
- Tomcat
- WebLogic
- Kubernetes
- Azure
- AWS
- F5 Load Balancers
- Kafka
- Solace
- PingFederate
- Provide architecture guidance and troubleshooting support for complex trust and certificate-related issues.
- Ensure compliance with NIST, PCI-DSS, SOX, ISO 27001, FedRAMP, and enterprise security standards.
- Conduct cryptographic risk assessments and certificate posture reviews.
- Define certificate ownership models and governance processes.
- Support audits and regulatory compliance activities.
- Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related discipline.
- 10+ years of Information Security experience.
- 5+ years of hands-on PKI architecture experience.
- 5+ years of Venafi Trust Protection Platform experience.
- Strong expertise in:
- X.509 certificates
- TLS/SSL
- PKI
- CLM
- CRL/OCSP
- HSM technologies
- Digital signatures
- Cryptographic key management
- Experience designing PKI solutions in Azure and AWS environments.
- Strong scripting skills using PowerShell and Python.
- CISSP, CISM, CCSP, or equivalent certification.
- Venafi Certified Professional/Architect certification.
- Experience with:
- Keyfactor
- DigiCert
- Entrust
- Microsoft ADCS
- HashiCorp Vault
- Azure Key Vault
- AWS Certificate Manager
- Experience operating in BFSI or other highly regulated environments.
PKI and Cryptography
- PKI Architecture
- X.509 Certificates
- TLS/SSL
- PKCS Standards
- Digital Signatures
- HSM Integration
- CRL/OCSP
- Venafi TPP
- Venafi TLS Protect
- Certificate Discovery
- Policy Management
- Workflow Automation
- Reporting and Governance
- Azure
- AWS
- Kubernetes
- GitHub Actions
- Azure DevOps
- CI/CD Pipelines
- Infrastructure as Code
- PowerShell
- Python
- REST APIs
- Ansible
- Serve as the PKI and Machine Identity Subject Matter Expert (SME).
- Provide technical leadership to engineering and operations teams.
- Develop enterprise PKI roadmaps and modernisation strategies.
- Mentor engineers and establish best practices for certificate lifecycle management.
- Drive Zero Trust and identity-centric security initiatives.
IT & Technology > Cybersecurity > IT & Technology