PKI Security Engineer

Our client, a real estate company in Dallas, TX, is in need of a PKI Security Engineer for an initial six-month contract. Working in a hybrid model, The Security Engineer strengthens and maintains the organization’s IT infrastructure, supporting complex PKI and IAM initiatives, conducting security assessments, and developing policies, standards, and procedures. This position will modernize the client’s cryptographic trust infrastructure and manage platforms governing access.

The Security Engineer will architect and execute the transition to a modern, automated, crypto-agile PKI with no disruption to production. In parallel, this role will engineer and govern the IAM platform: SSO, MFA, lifecycle automation, and access certification. This is a hands-on senior role with architectural ownership.

• 7+ years in information security or infrastructure engineering, with 4+ years hands-on enterprise PKI and 4+ years IAM engineering
• Demonstrated experience leading a PKI migration, CA rebuild, or large-scale cryptographic uplift in a production enterprise environment
• Deep expertise with Microsoft ADCS (or equivalent CA platform) in a multi-tier, multi-forest environment
• Production experience with a certificate lifecycle management platform (Venafi, Keyfactor, AppViewX, or similar), including discovery and onboarding of an unmanaged estate
• Hands-on HSM administration (Thales Luna, Entrust nShield, or cloud KMS/CloudHSM) and participation in formal key ceremonies
• Strong command of X.509, ASN.1, TLS/mTLS, asymmetric and symmetric cryptography, hashing, and key management practices
• Production experience administering a major IdP (Entra ID, Okta, or Ping) including federation and conditional access design
• Automation proficiency: PowerShell plus Python; comfort with REST APIs and JSON
• Experience supporting regulated audits (SOX, PCI DSS, HIPAA, or similar)

Preferred skills:

• Cloud PKI and key management: Azure Key Vault / Managed HSM, AWS Private CA / ACM / KMS, GCP Certificate Authority Service
• Workload identity: SPIFFE/SPIRE, Kubernetes cert-manager, service mesh mTLS (Istio, Linkerd)
• Secrets and privileged access adjacency: HashiCorp Vault, CyberArk, Delinea

We offer excellent benefits and compensation packages. The expected hourly rate range for this role is $54-78 per hour. The posted range is an estimate, the actual compensation offer will be based on the candidate’s experience, skills, qualifications and will be in line with internal equity.