Sunrise Systems, Inc. is seeking a PKI Engineer to design, implement, and operate enterprise PKI services. The role involves collaborating with architects, integrating PKI services with various protocols, and automating certificate management processes.
Responsibilities:
- Design, implement, and operate enterprise PKI services using Venafi PKI/CLM and associated CA/HSM integrations
- Design and manage Venafi SSH Manager and implement modern SSH CA workflows for short lived user, host, and workload SSH certificates
- Integrate PKI /CLM services with a variety of services/protocols including: Azure Key Vault (and other CSP KMS) for certificate storage and workload identity, Intune / SCEP, Active Directory, Wi-Fi EAP-TLS / Radius, Kubernetes certificate and trust patterns (service mesh, workload identity, SPIFFE/SPIRE compatible models), Various Pipeline / IaC tools and templates, including Terraform
- Engineer secure certificate issuance, renewal, rotation, and revocation, including fully automated CA and CLM workflows
- Support rollout of certificate based access controls across platforms, applications, and APIs
- Collaborate with PKI, SSH, and cryptography architects to translate high level trust and cryptographic patterns into detailed engineering designs
- Design secure trust controls for certificate issuance, key protection, certificate validation, OCSP/CRL management, and SSH certificate workflows
- Embed certificate, SSH, and key governance into CI/CD systems, including automatic issuance and renewal pipelines
- Build automation and tooling to streamline platform integration with Venafi PKI/CLM, Venafi SSH Manager, and cloud KMS services
- Conduct PKI/SSH assessments, identify vulnerabilities or misconfigurations, and recommend remediation
- Develop scalable key and certificate patterns (short lived certificates, key rotation, envelope encryption, secure provisioning)
- Integrate PKI and SSH trust services with applications running on Kubernetes, hybrid cloud, and multi cloud environments
Requirements:
- Design, implement, and operate enterprise PKI services using Venafi PKI/CLM and associated CA/HSM integrations
- Design and manage Venafi SSH Manager and implement modern SSH CA workflows for short lived user, host, and workload SSH certificates
- Integrate PKI /CLM services with a variety of services/protocols including: Azure Key Vault (and other CSP KMS) for certificate storage and workload identity, Intune / SCEP, Active Directory, Wi-Fi EAP-TLS / Radius, Kubernetes certificate and trust patterns (service mesh, workload identity, SPIFFE/SPIRE compatible models), Various Pipeline / IaC tools and templates, including Terraform
- Engineer secure certificate issuance, renewal, rotation, and revocation, including fully automated CA and CLM workflows
- Support rollout of certificate based access controls across platforms, applications, and APIs
- Collaborate with PKI, SSH, and cryptography architects to translate high level trust and cryptographic patterns into detailed engineering designs
- Design secure trust controls for certificate issuance, key protection, certificate validation, OCSP/CRL management, and SSH certificate workflows
- Embed certificate, SSH, and key governance into CI/CD systems, including automatic issuance and renewal pipelines
- Build automation and tooling to streamline platform integration with Venafi PKI/CLM, Venafi SSH Manager, and cloud KMS services
- Conduct PKI/SSH assessments, identify vulnerabilities or misconfigurations, and recommend remediation
- Develop scalable key and certificate patterns (short lived certificates, key rotation, envelope encryption, secure provisioning)
- Integrate PKI and SSH trust services with applications running on Kubernetes, hybrid cloud, and multi cloud environments