Security Engineer II

Hello

Job Title: Security Engineer -II

Irving, TX office

Summary of Position:

The Security Engineer II role strengthens and maintains the organization's IT infrastructure, supporting complex PKI and IAM initiatives, conducting security assessments, and developing policies, standards, and procedures. We're seeking a PKI Infrastructure & IAM Engineer to modernize the enterprise's cryptographic trust infrastructure and manage platforms governing access.

You will architect and execute the transition to a modern, automated, crypto-agile PKI with no disruption to production. In parallel, you'll engineer and govern the IAM platform: SSO, MFA, lifecycle automation, and access certification. This is a hands-on senior role with architectural ownership. You'll be the technical authority both when a cert outage threatens production and when an auditor asks how quarterly access reviews are evidenced.

This role will work closely with Staff Security engineers, architects, and various engineering disciplines to ensure that adequate cloud security solutions are designed, implemented, and configured appropriately.

Principal Duties and Responsibilities:

PKI Migration & Modernization (Must)

• Assess the current-state CA hierarchy, trust relationships, key material, and certificate estate; produce a gap analysis against modern standards and a phased target-state architecture
• Design and stand up the next-generation PKI: new offline root, intermediate/issuing CA tier, HSM-backed key protection, modern OCSP and CRL distribution, and defined trust boundaries between internal and public trust
• Plan and execute CA migration with zero unplanned outage - parallel trust operation, staged re-issuance, cross-signing where needed, trust store distribution, and controlled decommissioning of legacy CAs
• Work on cryptographic uplift: retire SHA-1 and weak/short RSA keys, move to modern key sizes and ECC where appropriate, shorten certificate validity periods, and enforce approved algorithm policy at issuance
• Deploy or mature a (DigiCert, Keyfactor Command, AppViewX) to establish authoritative discovery, inventory, ownership mapping, expiry alerting, and automated renewal across the estate
• Modernize code signing onto hardware-backed keys with enforced signing policy and timestamping
• Build the crypto-agility foundation: algorithm inventory, key/cert ownership metadata, and a post-quantum readiness assessment and migration roadmap (ML-KEM / ML-DSA, hybrid certificates)
• Author and maintain the Certificate Policy (CP) and Certification Practice Statement (CPS) for the new hierarchy; run formal key ceremonies with documented quorum controls
• Develop migration runbooks, rollback plans, and stakeholder communications; drive application-team adoption through clear standards rather than case-by-case escalation

IAM Platform (Good to have)

• Engineer and operate the enterprise IdP - Microsoft Entra ID, Okta, or Ping - including SSO federation (SAML 2.0, OIDC, OAuth 2.0, WS-Fed), conditional access, and phishing-resistant MFA (FIDO2/WebAuthn, certificate-based authentication)
• Build and maintain role-based access models, entitlement catalogs, and access request workflows business owners can actually use
• Integrate applications via SCIM, LDAP, JDBC, REST, and custom connectors; reduce the long tail of locally managed accounts
• Automate access reviews and produce audit-ready evidence for SOX, PCI DSS, and internal control testing
• Operate and modernize directory services - Active Directory, Entra ID, LDAP - including trust design, group strategy, and AD hygiene

Cross-Cutting

• Partner with application, infrastructure, and cloud teams to embed certificate and identity automation into platform standards rather than bolting them on afterward
• Serve as escalation point for P1/P2 identity and certificate incidents; participate in on-call rotation
• Define standards, reference architectures, and runbooks; mentor mid-level and junior engineers
• Support internal and external audits, penetration test remediation, and risk assessments
• Contribute to Zero Trust roadmap execution, with emphasis on strong device and workload identity

Required Qualifications

• 7+ years in information security or infrastructure engineering, with 5+ years hands-on enterprise PKI and 4+ years IAM engineering
• Demonstrated experience leading a PKI migration, CA rebuild, or large-scale cryptographic uplift in a production enterprise environment - please be prepared to walk through scope, approach, and outcome
• Deep expertise with Microsoft ADCS (or equivalent CA platform) in a multi-tier, multi-forest environment
• Production experience with a certificate lifecycle management platform (Venafi, Keyfactor, AppViewX, or similar), including discovery and onboarding of an unmanaged estate
• Hands-on HSM administration (Thales Luna, Entrust nShield, or cloud KMS/CloudHSM) and participation in formal key ceremonies
• Strong command of X.509, ASN.1, TLS/mTLS, asymmetric and symmetric cryptography, hashing, and key management practices
• Production experience administering a major IdP (Entra ID, Okta, or Ping) including federation and conditional access design
• Automation proficiency: PowerShell plus Python; comfort with REST APIs and JSON
• Experience supporting regulated audits (SOX, PCI DSS, HIPAA, or similar)
• Ability to plan and communicate a migration to both engineers and executives, and to write documentation people actually follow

Preferred Qualifications

• Cloud PKI and key management: Azure Key Vault / Managed HSM, AWS Private CA / ACM / KMS, Google Cloud Platform Certificate Authority Service
• Workload identity: SPIFFE/SPIRE, Kubernetes cert-manager, service mesh mTLS (Istio, Linkerd)
• Secrets and privileged access adjacency: HashiCorp Vault, CyberArk, Delinea

Education and Experience Requirements:

Education: Bachelor's degree required in Computer Science, Cybersecurity, Engineering, or related field.

• Experience:

7 years of hands-on cybersecurity engineering experience with exposure to PKI, IAM and security architecture.

• • Cloud PKI and key management: Azure Key Vault / Managed HSM, AWS Private CA / ACM / KMS, Google Cloud Platform Certificate Authority Service
  • Workload identity: SPIFFE/SPIRE, Kubernetes cert-manager, service mesh mTLS (Istio, Linkerd)
  • Secrets and privileged access adjacency: HashiCorp Vault, CyberArk, Delinea
  • Infrastructure as code and pipelines: Terraform, Ansible, GitHub Actions or Azure DevOps
  • Familiarity with NIST SP 800-57, SP 800-63, CA/Browser Forum baseline requirements, and NIST post-quantum standards
  • Certifications: CISSP, GIAC (GCED, GDSA, GPCS), Microsoft SC-300 / AZ-500, Venafi or Keyfactor product certification

Additional Skills, Knowledge, and Experience:

• Strong knowledge of cloud security technologies, network security principles, and current threat that comprise the cybersecurity landscape.
• Working knowledge of cloud-based Identity Providers, access controls, and hybrid federated IAM architectures.
• Strong knowledge and experience with Microsoft Active Directory (AD) Domain Services, management of AD users and security groups, and security best practices for configuring AD infrastructure, policies, group policy objects.
• Experience with implementing access control mechanisms, such as authentication policies, identity lifecycle management (provisioning, deprovisioning), and methods for authorization management.
• Experience with securing SaaS cloud delivery platforms, such as Office 365 Online Services, Entra ID, Azure, Box.com, Salesforce, and Workday.
• Experience with applying security standards and frameworks experience with industry-specific standards and frameworks desirable (NIST, ISO, CIS, CSA).
• Strong skills in developing visual design documentation (Visio, Lucid), oral presentation skills, problem solving / critical thinking, and decision-making skills.
• Strong verbal and written communication skills.

Ability to facilitate productive meetings and work comfortably in a team-oriented environment.