> Markdown version of [/jobs/ext/4458649-senior-pki-engineer](https://www.wearedevelopers.com/jobs/ext/4458649-senior-pki-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior PKI Engineer

- **Company:** IT Labs
- **Location:** San Diego, CA, United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Microsoft Windows, Active Directory, User Authentication, Virtual Private Networks (VPN), Key Management, Network Connections, Public Key Infrastructure, X.509, Windows PowerShell, Azure Active Directory, Alwayson, Microsoft InTune, Tanium Platform Expertise, Firewall Services Module, Qualys, Unified Endpoint Management
- **Published:** October 6, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=a3fc714551c7f21c

## About the Role

* Strong hands-on experience with Public Key Infrastructure (PKI) in enterprise environments.
 * Strong knowledge of Microsoft AD CS / Certificate Services or comparable enterprise PKI solutions.
 * Experience with:
 + Machine/device certificates
 + Certificate enrollment and auto-enrollment
 + Certificate lifecycle management
 + Certificate renewal and revocation
 + CRL / OCSP
 + X.509 certificates
 + Private key management
 * Strong experience with Windows enterprise environments.
 * Experience with Active Directory.
 * Experience with Microsoft Intune or another enterprise endpoint management platform.
 * Strong troubleshooting skills across certificates, authentication, endpoint configuration, and network connectivity.
 * Experience working in security-conscious enterprise environments.

Nice to Have

 * Experience with Palo Alto GlobalProtect.
 * Experience with Prisma Access.
 * Experience implementing GlobalProtect Pre-Logon.
 * Experience with certificate-based VPN authentication.
 * Understanding of Always-On VPN / Always-On GlobalProtect architectures.
 * Experience with TPM-backed certificates and hardware-protected private keys.
 * Experience with Microsoft Entra ID.
 * Experience with endpoint security tooling such as:
 + CrowdStrike
 + Microsoft Defender
 + Tanium
 + Qualys
 * PowerShell scripting experience.
 * Experience working in regulated or high-security environments.

## Description

The client already has an existing PKI environment. The focus of this role is therefore not to build an enterprise PKI from scratch, but to integrate and manage machine certificate authentication across Windows endpoints, Microsoft Intune, and Palo Alto GlobalProtect / Prisma Access.

The engineer will help ensure that corporate laptops can securely authenticate before user login, maintain reliable certificate lifecycle processes, and support a secure transition from device identity to authenticated user identity.

What You'll Do

 * Implement and support machine certificate-based authentication for Windows endpoints.
 * Integrate an existing enterprise PKI environment with Palo Alto GlobalProtect Pre-Logon.
 * Support secure device authentication before Windows user login.
 * Configure and troubleshoot certificate enrollment, renewal, expiration, and revocation.
 * Work with Microsoft Intune, Active Directory, and Windows endpoint management.
 * Ensure certificates and private keys are securely stored and protected, including TPM-backed key scenarios where applicable.
 * Support CRL and OCSP validation and certificate revocation processes.
 * Configure and troubleshoot GlobalProtect certificate authentication and pre-logon connectivity.
 * Support the transition from machine/device identity to authenticated user identity.
 * Work with network and security teams on Prisma Access, firewall policies, and secure endpoint connectivity.
 * Troubleshoot certificate, authentication, and connectivity issues across endpoints.
 * Support resilience and failover scenarios across GlobalProtect / Prisma Access gateways.
 * Document technical configurations, operational processes, and troubleshooting procedures.
 * Collaborate with endpoint, networking, identity, and security teams.