Certificate Services / PKI / PowerShell Architect

Job Title: Certificate Services / PKI / PowerShell Architect
Location: India (Remote)
Employment Type: Contract
Duration: 6 months
Role Summary
The PKI & PowerShell Architect designs, implements, and governs enterprise Public Key Infrastructure (PKI), certificate services, and automation tooling. The role provides technical leadership for secure CA hierarchies, certificate lifecycle automation, PowerShell-based tooling, and adherence to security and compliance standards across hybrid environments.
Required Skills
• Deep expertise in AD CS, PKI internals, X.509, certificate chain building, CRL/OCSP, templates, EKUs/OIDs.
• Advanced PowerShell (modules, DSC, Pester, APIs, automation at scale).
• Experience with HSMs (SafeNet, Thales, nCipher) and certificate management tools (Venafi, Keyfactor, AppViewX).
• Knowledge of Windows Server, Active Directory, Azure, Linux OpenSSL, load balancers, web servers, Kubernetes TLS.
Key Responsibilities
Architecture & Governance
• Architect enterprise PKI (Root/Sub-CA hierarchy, OCSP, CRL, SCEP/NDES, HSM integration).
• Define PKI standards, certificate templates, issuance policies, and CP/CPS documentation.
• Drive crypto-agility, secure key management, and alignment with zero-trust principles.
• Establish governance for certificate usage across servers, devices, applications, and cloud.
Preferred Experience
• 8–12+ years in identity/security/infrastructure roles; 3–5+ years in PKI architecture.
• Certifications: Microsoft (SC-100/SC-300/Azure Architect), CISSP/CCSP, RHCE, ITIL.
• Experience with Azure Key Vault certificates, cloud PKI integrations, DevOps pipelines.
Implementation & Engineering
• Deploy, harden, and manage AD CS, OCSP responders, CRL distribution, enrollment services.
• Integrate certificates with Windows, Linux, network devices, Wi-Fi/VPN, IIS/Apache, load balancers, Kubernetes mTLS, and cloud.
• Lead migrations: legacy PKI upgrades, SHA-1 remediation, RSA→ECC transitions.
External Certificate Management
• Manage relationships and accounts with External Certificate Authorities (e.g., DigiCert, Sectigo, Entrust).
• Oversee the procurement, installation, and renewal of public-facing SSL/TLS certificates (OV, EV, and Wildcard).
• Ensure seamless domain control validation (DCV) for external web properties.
Automation (PowerShell-focused)
• Build PowerShell automation for certificate issuance, renewal, revocation, monitoring, and template management.
• Develop reusable modules, CI/CD pipelines, and scripts for large-scale certificate lifecycle operations.
• Implement automated discovery and alerting for expiring/invalid certificates.
Security, Compliance & Operations
• Ensure CA security (air-gapped Root, HSM-backed keys, audit logging, role separation).
• Maintain compliance with NIST, CIS, ISO 27001, and internal audit requirements.
• Design HA/DR for issuing CAs and OCSP; maintain runbooks and operational standards.
• Troubleshoot enterprise certificate outages and perform RCA.
Stakeholder & Leadership
• Act as PKI SME for architecture, security, cloud, and application teams.
• Lead technical reviews, risk assessments, and approval of certificate-dependent solutions.
• Mentor engineers on PKI, cryptography, AD CS internals, and PowerShell automation.

Work arrangement
Yes