Forward Deployed PKI Engineer

As a Forward Deployed PKI Engineer, you’ll work at the intersection of enterprise cryptography, artificial intelligence, and software engineering.

You’ll help deploy ITVA’s certificate lifecycle management and security automation capabilities into some of the world’s most critical enterprise infrastructure.

You’ll work directly with customers to modernize certificate operations, automate complex PKI workflows, and introduce AI-powered capabilities into environments where security and reliability are essential.

This isn’t a traditional PKI administration role. You’ll have the opportunity to help define the future of enterprise certificate management, contribute directly to our product, and work on emerging challenges such as post-quantum cryptography readiness., * Lead deployments of ITVA’s certificate lifecycle management capabilities across complex enterprise customer environments.

• Integrate ITVA with enterprise certificate authorities, including Microsoft Active Directory Certificate Services (AD CS) and commercial CA platforms.
• Implement AI-powered certificate discovery, monitoring, troubleshooting, and lifecycle automation workflows.
• Automate certificate issuance, renewal, revocation, and deployment across diverse enterprise systems.
• Work directly with customer security, infrastructure, and PKI teams to understand their operational challenges.
• Troubleshoot complex PKI issues involving certificate chains, trust stores, TLS, mutual TLS, and enrollment protocols.
• Help enterprises evaluate cryptographic risks and prepare for evolving security standards, including post-quantum cryptography.
• Collaborate directly with ITVA’s software engineering team to design and develop new product features, integrations, and automation capabilities.
• Translate complex customer requirements into scalable product improvements.
• Serve as a trusted technical advisor for enterprise PKI modernization initiatives.

• 7+ years of hands-on experience in enterprise PKI, certificate services, cryptographic infrastructure, or certificate lifecycle management.
• Deep understanding of X.509 certificates, certificate chains, trust models, TLS, and mutual TLS.
• Extensive experience administering Microsoft Active Directory Certificate Services (AD CS) or comparable enterprise PKI systems.
• Strong knowledge of certificate issuance, renewal, revocation, CRLs, OCSP, CSRs, and certificate templates.
• Experience managing certificates across Windows and Linux servers, enterprise applications, and networking infrastructure.
• Proven ability to troubleshoot complex PKI and cryptographic issues independently.
• Experience with PowerShell, Python, Bash, or similar scripting languages for automation.
• Strong communication skills and experience collaborating with enterprise customers or cross-functional teams.
• Interest in AI-driven security automation and emerging cryptographic technologies., * Experience with certificate lifecycle management platforms such as DigiCert, Venafi, Keyfactor, or Sectigo.
• Familiarity with enrollment protocols including ACME, SCEP, EST, and CMP.
• Experience with HSMs, enterprise key management, and cloud PKI services.
• Experience managing certificates on F5 BIG-IP, Fortinet, NGINX, Apache, IIS, or similar systems.
• Familiarity with post-quantum cryptography, NIST standards, and cryptographic migration planning.
• Experience with Microsoft Intune, NDES, Active Directory, or enterprise device identity management.
• Experience supporting critical infrastructure, government, utilities, or highly regulated industries.
• Experience developing API integrations or PKI automation tools.

• Bring AI to critical infrastructure: Help implement intelligent automation into the security systems that enterprises rely on every day.
• Work on the next generation of cryptography: Gain hands-on experience helping organizations prepare for post-quantum security challenges.
• Shape the future of PKI: Directly influence how enterprise certificate management evolves through AI and automation.
• Build, don’t just administer: Collaborate with software engineers to turn real-world PKI problems into new product capabilities.
• Solve problems at enterprise scale: Work with complex environments where security, reliability, and automation truly matter.
• Join an engineering-driven company: Help build technology alongside people who have firsthand experience managing the infrastructure they’re transforming.

Compensation Range: $125K - $250K