PKI Venafi Architect

Location: Remote
Employment Type: Full Time
Experience: 8–10+ Years

Job Summary

We are seeking an experienced PKI Venafi Architect / Venafi Security Architect with deep expertise in Public Key Infrastructure (PKI), Venafi Trust Protection Platform (TPP), Certificate Lifecycle Management (CLM), machine identity, cryptography, and enterprise certificate automation.

The ideal candidate will have strong hands-on experience designing and managing enterprise PKI environments, including Root CA, Issuing CA, X.509 certificates, TLS/SSL, CRL, OCSP, HSM, certificate policies, trust frameworks, and cryptographic key management.

This role will lead enterprise machine identity and certificate management strategy, architect Venafi integrations, automate certificate provisioning and renewal, support cloud and application onboarding, and provide technical leadership for PKI modernization and Zero Trust initiatives.

Required Qualifications

• 8–10+ years of Information Security, PKI, Cybersecurity, or Infrastructure Security experience.

• 5+ years of hands-on PKI architecture and engineering experience.

• 5+ years of hands-on Venafi Trust Protection Platform (TPP) experience.

• Strong experience designing and implementing enterprise PKI architectures.

• Strong hands-on knowledge of:

  • PKI / Public Key Infrastructure

  • X.509 Certificates

  • TLS/SSL

  • Certificate Lifecycle Management (CLM)

  • Certificate Authorities (CA)

  • Root CA / Issuing CA

  • CRL / OCSP

  • HSM / Hardware Security Modules

  • Cryptographic Key Management

  • Digital Signatures

  • PKCS Standards

  • Certificate Trust Frameworks

• Strong experience with Venafi Trust Protection Platform (TPP).

• Experience architecting machine identity and certificate management solutions.

• Strong scripting and automation experience with:

  • PowerShell

  • Python

  • Ansible

  • REST APIs

• Experience designing PKI and certificate management solutions across AWS and Azure environments.

• Strong understanding of certificate discovery, onboarding, provisioning, renewal, revocation, deployment, and monitoring.

• Experience supporting enterprise production environments and troubleshooting complex certificate, trust, TLS, and PKI issues.

Venafi Platform Expertise

Strong hands-on experience with:

• Venafi Trust Protection Platform (TPP)

• Venafi TLS Protect

• Venafi Certificate Lifecycle Management

• Certificate Discovery

• Certificate Inventory

• Certificate Onboarding

• Certificate Policy Management

• Certificate Ownership

• Certificate Renewal Automation

• Certificate Provisioning

• Certificate Deployment

• Certificate Revocation

• Workflow Automation

• Venafi APIs

• vCert

• Venafi Reporting

• Venafi Governance

• Venafi Platform Upgrades

• Venafi Configuration and Optimization

Key Responsibilities

PKI & Security Architecture

• Design, implement, and maintain enterprise PKI architecture.

• Architect and maintain Root CA, Issuing CA, CRL, OCSP, HSM, and certificate trust frameworks.

• Define enterprise PKI standards, certificate policies, cryptographic controls, and security architecture.

• Develop and maintain certificate governance standards and cryptographic control frameworks.

• Architect highly available, resilient, and secure PKI and Certificate Lifecycle Management platforms.

• Develop enterprise machine identity and certificate management strategies.

• Establish certificate ownership, lifecycle, governance, and operational processes.

• Perform cryptographic risk assessments and certificate posture reviews.

• Define PKI modernization roadmaps and enterprise security standards.

Venafi Architecture

• Design, administer, configure, and optimize Venafi Trust Protection Platform (TPP).

• Define Venafi onboarding standards, workflows, policies, access models, discovery jobs, and reporting.

• Architect integrations between Venafi and enterprise applications, cloud platforms, infrastructure, and security tools.

• Lead Venafi upgrades, enhancements, migrations, and platform optimization.

• Develop scalable Venafi architecture for enterprise certificate lifecycle management.

• Establish Venafi governance, operational standards, and best practices.

Certificate Lifecycle Automation

• Architect automated certificate provisioning, renewal, deployment, and revocation solutions.

• Develop certificate automation frameworks using:

  • Venafi APIs

  • vCert

  • PowerShell

  • Python

  • Ansible

  • GitHub Actions

  • Azure DevOps

  • CI/CD Pipelines

• Drive adoption of automated certificate lifecycle management across enterprise application portfolios.

• Eliminate manual certificate management processes through automation.

• Integrate certificate management into application deployment and DevOps workflows.

Application & Cloud Integration

Lead certificate onboarding, deployment, and automation across:

• Windows Server

• Linux / Unix

• IIS

• Apache

• Tomcat

• WebLogic

• Kubernetes

• Azure

• AWS

• F5 Load Balancers

• Kafka

• Solace

• PingFederate

• Design certificate deployment strategies for applications, middleware, APIs, load balancers, messaging platforms, and cloud services.

• Provide architecture guidance for complex certificate and trust integrations.

• Troubleshoot TLS/SSL, certificate chain, trust-store, key-store, and authentication issues.

Cloud & DevOps Skills

Microsoft Azure

• Azure PKI and certificate management

• Azure Key Vault

• Azure application integrations

• Azure DevOps

• CI/CD automation

• Cloud security

Amazon Web Services

• AWS Certificate Manager (ACM)

• AWS cloud security

• Certificate deployment and automation

• Cloud application integrations

DevOps / Automation

• GitHub Actions

• Azure DevOps

• CI/CD Pipelines

• Ansible

• PowerShell

• Python

• REST APIs

• Infrastructure as Code

• Automated certificate lifecycle processes

Governance, Risk & Compliance

• Define and enforce enterprise PKI and certificate governance.

• Ensure compliance with applicable security and regulatory standards.

• Experience with security frameworks and standards such as:

  • NIST

  • PCI-DSS

  • SOX

  • ISO 27001

  • FedRAMP

• Conduct certificate posture assessments and cryptographic risk reviews.

• Support internal and external audits.

• Establish certificate ownership and accountability models.

• Develop security policies, standards, procedures, and operational controls.

• Support Zero Trust and identity-centric security initiatives.

Preferred Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.

• CISSP, CISM, CCSP, or equivalent security certification.

• Venafi Certified Professional / Venafi Architect certification.

• Experience with alternative or complementary certificate-management platforms:

  • Keyfactor

  • DigiCert

  • Entrust

  • Microsoft ADCS

  • HashiCorp Vault

  • Azure Key Vault

  • AWS Certificate Manager

• Experience in BFSI, banking, insurance, or other highly regulated environments.

• Experience with enterprise Zero Trust architecture.

• Experience with large-scale PKI modernization and certificate automation programs.

Technical Skills

PKI & Cryptography: PKI, Public Key Infrastructure, X.509, TLS, SSL, PKCS, Digital Certificates, Digital Signatures, Certificate Authority, Root CA, Issuing CA, CRL, OCSP, HSM, Cryptographic Key Management, Trust Frameworks

Venafi: Venafi TPP, Venafi Trust Protection Platform, Venafi TLS Protect, CLM, Certificate Lifecycle Management, Certificate Discovery, Certificate Inventory, Certificate Onboarding, Policy Management, Workflow Automation, vCert, Venafi APIs, Certificate Renewal, Certificate Provisioning, Certificate Deployment

Cloud: Microsoft Azure, Azure Key Vault, AWS, AWS Certificate Manager, Cloud Security, Cloud PKI

Automation: PowerShell, Python, Ansible, REST APIs, GitHub Actions, Azure DevOps, CI/CD, Infrastructure as Code

Infrastructure: Windows Server, Linux, Unix, IIS, Apache, Tomcat, WebLogic, Kubernetes, F5, Kafka, Solace, PingFederate

Security & Compliance: NIST, PCI-DSS, SOX, ISO 27001, FedRAMP, Zero Trust, Security Architecture, Cryptographic Risk, Security Governance

Leadership Responsibilities

• Serve as the PKI, Venafi, and Machine Identity SME.

• Provide technical leadership to security engineering, infrastructure, DevOps, and operations teams.

• Define enterprise PKI and Certificate Lifecycle Management roadmaps.

• Lead PKI modernization and certificate automation initiatives.

• Establish enterprise standards and reusable PKI/CLM architecture patterns.

• Mentor PKI engineers and security professionals.

• Work with application, cloud, infrastructure, security, and architecture teams.

• Communicate complex PKI and cryptographic concepts to technical and business stakeholders.

• Drive adoption of certificate automation, machine identity management, and Zero Trust security practices.

Ideal Candidate Profile

The ideal candidate is a Senior PKI / Venafi Architect who can combine enterprise PKI architecture, Venafi TPP expertise, certificate lifecycle automation, cloud security, cryptography, and technical leadership.

The candidate should be capable of managing the complete certificate lifecycle:

Certificate Discovery → Inventory → Ownership → Policy → Onboarding → Provisioning → Deployment → Monitoring → Renewal → Revocation → Compliance

Core Dice Search Keywords

PKI Venafi Architect, Venafi Architect, PKI Architect, Venafi Security Architect, Venafi Engineer, PKI Engineer, Senior PKI Engineer, Certificate Management Architect, Certificate Lifecycle Management, CLM, Machine Identity Management, Machine Identity Security, Venafi TPP, Venafi Trust Protection Platform, Venafi TLS Protect, Venafi vCert, Venafi API, PKI Architecture, Public Key Infrastructure, X.509, TLS, SSL, PKCS, Digital Certificates, Digital Signatures, Root CA, Issuing CA, Certificate Authority, CRL, OCSP, HSM, Hardware Security Module, Cryptographic Key Management, Certificate Discovery, Certificate Provisioning, Certificate Renewal, Certificate Automation, Certificate Deployment, Certificate Governance, Certificate Policy, Azure PKI, Microsoft Azure, Azure Key Vault, AWS, AWS Certificate Manager, Kubernetes, Windows Server, Linux, IIS, Apache, Tomcat, WebLogic, F5, Kafka, Solace, PingFederate, PowerShell, Python, Ansible, REST API, GitHub Actions, Azure DevOps, CI/CD, Keyfactor, DigiCert, Entrust, Microsoft ADCS, HashiCorp Vault, Zero Trust, NIST, PCI-DSS, SOX, ISO 27001, FedRAMP, Cybersecurity, Information Security, Security Architecture, BFSI, Machine Identity, Enterprise PKI.