PKI Venafi Architect

Job Description

PKI and Security Architecture

Design and maintain enterprise Public Key Infrastructure (PKI) architecture, including Root CA, Issuing CA, CRL, OCSP, HSM, and trust frameworks.

Develop certificate governance standards, policies, and cryptographic control frameworks.

Architect highly available and resilient PKI and Certificate Lifecycle Management (CLM) platforms.

Drive enterprise machine identity and certificate management strategy.

Venafi Platform Architecture

Design and administer Venafi Trust Protection Platform (TPP).

Define onboarding standards, workflows, policies, reporting, discovery jobs, and access models.

Architect integrations between Venafi and enterprise applications, cloud services, and security platforms.

Lead Venafi platform upgrades, enhancements, and optimisation initiatives.

Certificate Lifecycle Automation

Architect automated certificate provisioning and renewal solutions.

Design automation frameworks using:

Venafi APIs

vCert

PowerShell

Python

Ansible

GitHub Actions

Azure DevOps

CI/CD pipelines

Drive adoption of certificate automation across enterprise application portfolios.

Application and Cloud Integration

Lead application onboarding into CLM services.

Support certificate deployment and automation across:

Windows Server

Linux/Unix

IIS

Apache

Tomcat

WebLogic

Kubernetes

Azure

AWS

F5 Load Balancers

Kafka

Solace

PingFederate

Provide architecture guidance and troubleshooting support for complex trust and certificate-related issues.

Governance and Compliance

Ensure compliance with NIST, PCI-DSS, SOX, ISO 27001, FedRAMP, and enterprise security standards.

Conduct cryptographic risk assessments and certificate posture reviews.

Define certificate ownership models and governance processes.

Support audits and regulatory compliance activities.

Required Qualifications

Bachelor’s degree in Computer Science, Cybersecurity, Engineering, or a related discipline.

10+ years of Information Security experience.

5+ years of hands-on PKI architecture experience.

5+ years of Venafi Trust Protection Platform experience.

Strong expertise in:

X.509 certificates

TLS/SSL

PKI

CLM

CRL/OCSP

HSM technologies

Digital signatures

Cryptographic key management

Experience designing PKI solutions in Azure and AWS environments.

Strong scripting skills using PowerShell and Python.

Preferred Qualifications

CISSP, CISM, CCSP, or equivalent certification.

Venafi Certified Professional/Architect certification.

Experience with:

Keyfactor

DigiCert

Entrust

Microsoft ADCS

HashiCorp Vault

Azure Key Vault

AWS Certificate Manager

Experience operating in BFSI or other highly regulated environments.

Technical Skills

PKI and Cryptography

PKI Architecture

X.509 Certificates

TLS/SSL

PKCS Standards

Digital Signatures

HSM Integration

CRL/OCSP

Venafi

Venafi TPP

Venafi TLS Protect

Certificate Discovery

Policy Management

Workflow Automation

Reporting and Governance

Cloud and DevOps

Azure

AWS

Kubernetes

GitHub Actions

Azure DevOps

CI/CD Pipelines

Infrastructure as Code

Programming and Automation

PowerShell

Python

REST APIs

Ansible

Leadership Expectations

Serve as the PKI and Machine Identity Subject Matter Expert (SME).

Provide technical leadership to engineering and operations teams.

Develop enterprise PKI roadmaps and modernisation strategies.

Mentor engineers and establish best practices for certificate lifecycle management.

Drive Zero Trust and identity-centric security initiatives.