Senior Manager, Certificates and Public Key Infrastructure – Platform Engineering

Role Summary:
The Senior Manager for Certificates and Public Key Infrastructure leads the team and the service that runs enterprise PKI and certificate lifecycle management for the firm. The role owns the internal certificate authority hierarchy, the operation of root and issuing authorities, the hardware security modules that protect private keys, and the automation that issues, renews, and revokes certificates across the estate. It is accountable for discovery and inventory of certificates wherever they are deployed, and for preventing the expiries that cause service outages. The role also owns code signing and device and user certificate services, relationships with external certificate authorities and platform vendors, and the cryptographic standards that govern approved algorithms and key lengths, including the roadmap for post-quantum migration. Success is measured on service availability, automated renewal coverage, elimination of expiry-driven incidents, and the quality of audit evidence produced for certificate authority operations.
Location: Bangalore/Kolkata, India.
Key Responsibilities:
Lead the certificate and PKI engineering team, setting priorities, on-call coverage, hiring plans, and development paths for engineers across multiple locations.
Own the internal certificate authority hierarchy and the operation of root and issuing authorities, including hardware security module key protection, documented key ceremonies, and segregation of duties.
Drive automation of certificate issuance, renewal, and revocation across applications, infrastructure, and devices, and extend discovery and inventory so that every certificate in the estate is known and monitored before it expires.
Run the code signing and the device and user certificate services as a managed offering, with clear onboarding, approval, and usage controls for the teams that consume them.
Set cryptographic standards and algorithm policy, manage external certificate authority and platform vendor relationships and budget, and produce the evidence that internal audit, external assessors, and client assurance teams require.
Qualifications/Experience/Skills:
15+ years in infrastructure or security engineering, including at least three years leading engineers as a manager or team lead.
Deep knowledge of public key infrastructure, X.509 certificate structure and validation, TLS, and applied cryptography, including certificate revocation and trust store management.
Hands-on experience with certificate platforms such as Microsoft Active Directory Certificate Services, Venafi, Keyfactor, DigiCert, Entrust, or HashiCorp Vault, and with ACME automation including Let's Encrypt.
Practical experience operating hardware security modules such as Thales or Entrust nShield, and accountability for vendor management, budget, and audit outcomes for a production service.
Certification such as CISSP, CISM, or a vendor PKI credential on a deployed certificate management platform.
Experience planning cryptographic agility and post-quantum migration, including inventory of algorithm usage and phased replacement across applications and infrastructure

Work arrangement
Hybrid