Security Engineer

Kforce has a client that is seeking a Security Engineer in Miami, FL., The Security Engineer - II role strengthens and maintains the organization’s IT infrastructure, supporting complex PKI and IAM initiatives, conducting security assessments, and developing policies, standards, and procedures. We are seeking a PKI Infrastructure and IAM Engineer to modernize the enterprise’s cryptographic trust infrastructure and manage platforms governing access.

You will architect and execute the transition to a modern, automated, crypto-agile PKI with no disruption to production. In parallel, you will engineer and govern the IAM platform: SSO, MFA, lifecycle automation, and access certification. This is a hands-on senior role with architectural ownership. You’ll be the technical authority both when a cert outage threatens production and when an auditor asks how quarterly access reviews are evidenced.

This role will work closely with Staff Security engineers, architects, and various engineering disciplines to ensure that adequate cloud security solutions are designed, implemented, and configured appropriately.

Principal Duties and Responsibilities: PKI Migration & Modernization (Must):

• Assess the current-state CA hierarchy, trust relationships, key material, and certificate estate; Produce a gap analysis against modern standards and a phased target-state architecture
• Design and stand up the next-generation PKI: new offline root, intermediate/issuing CA tier, HSM-backed key protection, modern OCSP and CRL distribution, and defined trust boundaries between internal and public trust
• Plan and execute CA migration with zero unplanned outage - parallel trust operation, staged re-issuance, cross-signing where needed, trust store distribution, and controlled decommissioning of legacy Cas

• Bachelor’s degree required in Computer Science, Cybersecurity, Engineering, or related field
• 7 years of hands-on cybersecurity engineering experience with exposure to PKI, IAM and security architecture
• 7+ years in information security or infrastructure engineering, with 5+ years hands-on enterprise PKI and 4+ years IAM engineering
• Demonstrated experience leading a PKI migration, CA rebuild, or large-scale cryptographic uplift in a production enterprise environment - please be prepared to walk through scope, approach, and outcome
• Deep expertise with Microsoft ADCS (or equivalent CA platform) in a multi-tier, multi-forest environment
• Production experience with a certificate lifecycle management platform (Venafi, Keyfactor, AppViewX, or similar), including discovery and onboarding of an unmanaged estate
• Hands-on HSM administration (Thales Luna, Entrust nShield, or cloud KMS/CloudHSM) and participation in formal key ceremonies
• Automation proficiency: PowerShell plus Python; comfort with REST APIs and JSON
• Experience supporting regulated audits (SOX, PCI DSS, HIPAA, or similar)
• Ability to plan and communicate a migration to both engineers and executives, and to write documentation people actually follow, * Cloud PKI and key management: Azure Key Vault/Managed HSM, AWS Private CA/ACM/KMS, Google Cloud Platform Certificate Authority Service
• Workload identity: SPIFFE/SPIRE, Kubernetes cert-manager, service mesh mTLS (Istio, Linkerd)
• Secrets and privileged access adjacency: HashiCorp Vault, CyberArk, Delinea

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce’s sole discretion unless and until paid and may be modified in its discretion consistent with the law.

By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.