> Markdown version of [/jobs/ext/222215-cyber-consultant-contract](https://www.wearedevelopers.com/jobs/ext/222215-cyber-consultant-contract). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Consultant (contract) - **Company:** Kpmg LLP - **Location:** United States (Remote available) - **Experience:** Expert - **Salary:** $124,800.0 - $249,600.0 - **Contract:** Permanent contract - **Skills:** Microsoft Windows, Active Directory, Amazon Web Services, User Authentication, Microsoft Azure, Bash Shell, Cloud Computing, Cloud Engineering, Cyber Security, Computer Programming, Continuous Integration, DevOps, Federal Information Processing Standards (FIPS), Github, Networking Hardware, Python (Programming Language), Key Management, Multi-Purpose Internet Mail Extensions (MIME), PCI Data Security Standards, Public Key Infrastructure, X.509, Windows PowerShell, Ansible, Zero Trust Network Access, RSA (Cryptosystem), Smart Cards, Systems Integration, SSL Certificate Management, Google Cloud, Load Balancing, Okta, Istio, Multi-Cloud, Git Flow, Kubernetes, Information Technology, Hashicorp, Restful APIs, Terraform, Api Management, Key Vault, Jenkins, Golang - **Published:** May 19, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=c7fc56f4dc5a5c61 ## About the Role Do you have experience in Load balancing?, Do you have a Bachelor's degree?, * Minimum seven years of recent experience in cybersecurity or infrastructure engineering, with at least four years focused on PKI and certificate management in large enterprise environments. * Hands-on experience designing and operating multi-tier internal PKI (offline root, policy, issuing CAs) using Microsoft ADCS, EJBCA, or equivalent. * Proven experience implementing certificate lifecycle automation via ACME, SCEP, EST, CMP, or REST APIs at scale. * Strong experience with smart cards, YubiKey, and identity certificates (PIV, FIDO2/WebAuthn, certificate-based authentication). * Experience integrating PKI with AWS, Azure, and GCP, plus endpoints, network devices, load balancers, and MDM platforms. * Experience operating HSMs (Thales, Entrust, CloudHSM, Azure Managed HSM) with FIPS-aligned key ceremony and controls. Preferred: * Bachelor's degree from an accredited college or university in computer science, information security, or related discipline; CISSP, CISM, or GIAC certifications a plus. * Hands-on experience with Keyfactor (Command, EJBCA) and/or Venafi (TLS Protect, Trust Protection Platform). * Experience integrating PKI with DevOps toolchains (HashiCorp Vault, cert-manager, service mesh, CI/CD pipelines). * Familiarity with regulated environments (NIST, FIPS 140-2/3, PCI-DSS, SOX) and crypto-agility / post-quantum readiness., * PKI and Cryptograph y: X.509, RFC 5280, certificate profiles, CRL/OCSP, CA/B Forum baseline requirements; RSA, ECDSA, AES, SHA-2/3, TLS 1.2/1.3, mTLS, S/MIME, code signing. * Identity Certificates and Strong Authentication: Smart cards (PIV/CAC), YubiKey (PIV, FIDO2, OpenPGP), Windows Hello for Business, integration with Active Directory, Entra ID, and Okta. * Certificate Lifecycle Management : Hands-on with Keyfactor and Venafi preferred, plus ACME, SCEP, EST, CMP, and REST-based enrollment workflows. * Cloud and Platform Integration : AWS (ACM, Private CA, KMS), Azure (Key Vault, Managed HSM), GCP (CAS, KMS), Kubernetes cert-manager, and service mesh mTLS. * DevOps and Automation : Terraform, Ansible, CI/CD pipelines (Jenkins, GitHub Actions, Azure DevOps), and Git-based workflows. * Scripting and Programming: Proficiency in at least one of Python, PowerShell, Go, or Bash for tooling and API integrations. Professional Skills : * Self-starter with strong ownership and the ability to drive initiatives end-to-end ## Description * We are seeking a Senior PKI and Cryptography Engineer to design, implement, and operate enterprise certificate and cryptographic services across our hybrid, multi-cloud environment. * The role owns secure, full lifecycle certificate management - discovery, issuance, renewal, rotation, and revocation - and delivers integrations across cloud platforms, endpoints, network and security devices, and application stacks. * This is a hands-on role for a self-starter who can scope and deliver complex initiatives independently, automate aggressively to eliminate manual toil, and partner across security, infrastructure, identity, and DevOps teams. * You will set cryptographic standards, build the automation that enforces them, and shape a modern PKI program that supports both traditional infrastructure and cloud-native, zero-trust use cases., * Architect and operate enterprise PKI services, including offline root, policy, and issuing CA tiers with HSM-backed key protection. * Implement and manage full certificate lifecycle automation across cloud, on-premises, endpoint, and network domains. * Deploy and operate certificate lifecycle management platforms such as Keyfactor and Venafi. * Design strong authentication solutions using smart cards, YubiKey, and identity certificates for workforce, privileged users, and machine identities. * Define and enforce cryptographic standards and key management policies aligned to NIST, FIPS, and applicable compliance frameworks. * Lead incident response and remediation for certificate-related outages or compromise scenarios. * Act with integrity, professionalism, and personal responsibility to uphold the firm's respectful and courteous work environment. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves) - [Get started with securing your cloud-native Java microservices applications](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [The Cloud is Calling: Answer with In-Demand Skills](https://www.wearedevelopers.com/videos/945-the-cloud-is-calling-answer-with-in-demand-skills) - [Next-gen CI/CD with Gitops and Progressive Delivery](https://www.wearedevelopers.com/videos/1603-next-gen-ci-cd-with-gitops-and-progressive-delivery) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Why Upskilling And Reskilling is Important For Developers](https://www.wearedevelopers.com/magazine/428-why-upskilling-and-reskilling-is-important-for-developers) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Best Coding Boot Camps in Germany](https://www.wearedevelopers.com/magazine/237-best-coding-boot-camps-in-germany) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)