PKI Architect

Required Skills & Experience

5–6+ years of consulting experience, ideally in client-facing technical engagements. Strong hands-on PKI and certificate lifecycle management experience. Hands-on Venafi experience. Strong experience specifically with public TLS certificates. Experience designing and building certificate lifecycle solutions, not just administering an existing environment. Experience automating certificate issuance, deployment, validation, renewal, and lifecycle management. Ability to assess a client's current environment and design the future-state architecture. Experience reducing manual touchpoints through automation and standardized processes. Ability to build a pilot/POC, validate it, and scale the approach. Strong client-facing communication skills, including the ability to teach the client's team and hand off the solution.

Nice to Have Skills & Experience

Experience creating standardized certificate patterns, golden paths, and exception-handling processes. Experience integrating Venafi with other enterprise platforms/workflows. Experience defining technical acceptance criteria for a PKI pilot.

Job Description

We are looking for an experienced PKI / Certificate Lifecycle Engineer to support a client that currently has Venafi in place but does not have certificate lifecycle automation established. This person will assess the current environment and design the future-state approach for managing and automating public TLS certificates, with a focus on standardizing certificate lifecycle patterns and minimizing manual touchpoints. They will be responsible for designing and building a representative pilot within the PKI/Venafi environment, defining scalable processes for certificate issuance, deployment, validation, and renewal, and working with the broader team on necessary integrations. Once the solution is established, this person will help educate the client's team on how to operate and manage the solution before transitioning ownership back to them. This role is specifically focused on public TLS certificates, with device certificates and other certificate types out of scope.

Day-to-Day:

Assess the client's current PKI and public TLS certificate lifecycle processes. Review the existing Venafi environment and identify where automation can replace manual processes. Design the future-state certificate lifecycle architecture. Establish standardized patterns and "golden paths" for certificate issuance, deployment, validation, renewal, and exception handling. Design and build a representative pilot that proves the future-state solution. Configure and work within Venafi as the primary certificate management platform. Identify opportunities to minimize manual touchpoints throughout the certificate lifecycle. Define technical requirements and success/acceptance criteria for the pilot. Partner with automation and integration resources to ensure workflows integrate appropriately with the client's environment. Create an approach that can scale beyond the initial pilot. Teach and enable the client's internal team to use and manage the solution. Support the final handoff to the client once the pilot is complete and the team is comfortable operating it.