> Markdown version of [/jobs/ext/4464474-pki-engineer](https://www.wearedevelopers.com/jobs/ext/4464474-pki-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# PKI Engineer

- **Company:** Blackbaud, Inc.
- **Location:** Haiku-Pauwela, HI, United States (Remote available)
- **Experience:** Expert
- **Salary:** $102,000.0 - $133,000.0
- **Contract:** Permanent contract
- **Skills:** Active Directory, Amazon Web Services, Application Firewall, Microsoft Azure, Backup Devices, Content Delivery Networks, Data Security, Domain Name System (DNS), Knowledge Management, Machine Learning, Network Load Balancing, Public Key Infrastructure, X.509, Windows PowerShell, Servicenow
- **Published:** October 20, 2026
- **Apply:** https://www.builtincolorado.com/job/sr-pki-engineer/11759699?handler=ApplyRedirect

## About the Role

* Strong hands-on experience operating Microsoft AD CS in an enterprise environment, including NDES.
 * Experience administering Venafi Trust Protection Platform or Keyfactor Command.
 * Working knowledge of Fortanix Data Security Manager or comparable HSM solutions, including how PKI services use protected keys. Direct responsibility for administering the HSM platform is not required.
 * Strong understanding of X.509 certificates, certificate chains, enrollment, revocation, TLS, and private key protection.
 * PowerShell scripting and troubleshooting skills.
 * Ability to work with Active Directory, DNS, networking, application, and key management teams to resolve certificate issues.
 * Understanding of cryptographic management in Microsoft Azure or Amazon AWS.
 * Understanding and experience with certificate configuration and management on content delivery networks, web application firewalls, network load balancers and azure application gateways.
 * Experience with change control, operational documentation, and production support.
 * Experience and knowledge of offline root CA ceremonies and maintenance processes associated with an ORCA

Preferred qualifications

 * Experience supporting code signing or publicly trusted TLS certificates.
 * Familiarity with PKI backup, recovery, and audit requirements.

Stay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube

## Description

* Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services (including autoenrollment), Network Device Enrollment Service (NDES), and CRL publication.
 * Operate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command. Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations.
 * Use Fortanix Data Security Manager and other HSM-backed services as part of PKI operations. Work with the team that owns those services to resolve access, connectivity, and key usage issues.
 * Investigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues.
 * Perform routine PKI health checks, patching, maintenance, backups, and recovery testing.
 * Respond to certificate expiration alerts and coordinate renewals with application and infrastructure owners.
 * Maintain existing PowerShell scripts, scheduled tasks, reports, and PKI automation.
 * Maintain CLM/CLaaS infrastructure.
 * Keep documentation, runbooks, and certificate records accurate. Support audits, change management, and incident response.
 * The immediate goal of this role is to keep established PKI services secure, available, documented, and running smoothly., Develop and operate CrowdStrike's internal cloud management platform and mission-critical CI/CD pipelines. Build APIs and UIs using Go and TypeScript, improve developer productivity, integrate tooling, maintain cloud-native infrastructure, and support secure, highly available software delivery systems. Collaborate with development, infrastructure, security, and SRE teams, ensure SOC2-aware processes, and participate in on-call operations.
Top Skills: AlertmanagerArgo CdArgo WorkflowsCi/CdDebianDockerGoGoreleaserGrafanaHelmJavaScriptJenkinsKubernetesKustomizeLinuxPrometheusPulumiPypiTemporalTerraformTypescript
PNC Bank