> Markdown version of [/jobs/ext/4660412-security-engineer](https://www.wearedevelopers.com/jobs/ext/4660412-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** Kforce Inc.
- **Location:** Miami, FL, United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Cloud Computing, Cloud Computing Security, Cyber Security, Identity and Access Management, JSON, Python (Programming Language), Key Management, PCI Data Security Standards, Public Key Infrastructure, Windows PowerShell, Cyberark, Istio, Kubernetes, Information Technology, Hashicorp, Linkerd (Service Mesh), Restful APIs
- **Published:** November 10, 2026
- **Apply:** https://www.kforce.com/find-work/search-jobs/#/detail/MTY5Nn5FUUd-MjE5Mzg0NFQxfjk5/

## About the Role

* Bachelor's degree required in Computer Science, Cybersecurity, Engineering, or related field
 * 7 years of hands-on cybersecurity engineering experience with exposure to PKI, IAM and security architecture
 * 7+ years in information security or infrastructure engineering, with 5+ years hands-on enterprise PKI and 4+ years IAM engineering
 * Demonstrated experience leading a PKI migration, CA rebuild, or large-scale cryptographic uplift in a production enterprise environment - please be prepared to walk through scope, approach, and outcome
 * Deep expertise with Microsoft ADCS (or equivalent CA platform) in a multi-tier, multi-forest environment
 * Production experience with a certificate lifecycle management platform (Venafi, Keyfactor, AppViewX, or similar), including discovery and onboarding of an unmanaged estate
 * Hands-on HSM administration (Thales Luna, Entrust nShield, or cloud KMS/CloudHSM) and participation in formal key ceremonies
 * Automation proficiency: PowerShell plus Python; comfort with REST APIs and JSON
 * Experience supporting regulated audits (SOX, PCI DSS, HIPAA, or similar)
 * Ability to plan and communicate a migration to both engineers and executives, and to write documentation people actually follow, * Cloud PKI and key management: Azure Key Vault/Managed HSM, AWS Private CA/ACM/KMS, GCP Certificate Authority Service
 * Workload identity: SPIFFE/SPIRE, Kubernetes cert-manager, service mesh mTLS (Istio, Linkerd)
 * Secrets and privileged access adjacency: HashiCorp Vault, CyberArk, Delinea

## Description

Kforce has a client that is seeking a Security Engineer in Miami, FL. Summary: The Security Engineer - II role strengthens and maintains the organization's IT infrastructure, supporting complex PKI and IAM initiatives, conducting security assessments, and developing policies, standards, and procedures. We are seeking a PKI Infrastructure and IAM Engineer to modernize the enterprise's cryptographic trust infrastructure and manage platforms governing access. You will architect and execute the transition to a modern, automated, crypto-agile PKI with no disruption to production. In parallel, you will engineer and govern the IAM platform: SSO, MFA, lifecycle automation, and access certification. This is a hands-on senior role with architectural ownership. You'll be the technical authority both when a cert outage threatens production and when an auditor asks how quarterly access reviews are evidenced. This role will work closely with Staff Security engineers, architects, and various
engineering disciplines to ensure that adequate cloud security solutions are designed, implemented, and configured appropriately. Principal Duties and Responsibilities: PKI Migration & Modernization (Must):

 * Assess the current-state CA hierarchy, trust relationships, key material, and certificate estate; Produce a gap analysis against modern standards and a phased target-state architecture
 * Design and stand up the next-generation PKI: new offline root, intermediate/issuing CA tier, HSM-backed key protection, modern OCSP and CRL distribution, and defined trust boundaries between internal and public trust
 * Plan and execute CA migration with zero unplanned outage - parallel trust operation, staged re-issuance, cross-signing where needed, trust store distribution, and controlled decommissioning of legacy Cas