{"id":2882642,"url":"https://alion.io/job/blackbaud-sr-pki-engineer","title":"Sr. PKI Engineer","company":{"id":36535,"name":"Blackbaud","domain":"blackbaud.com","url":"https://alion.io/company/blackbaud","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":4,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":28,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":101900,"max":132800,"currency":"USD","period":"year","gross":null,"usd_annual":132800},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"PKI","optional":false},{"name":"PowerShell","optional":false}],"status":"live","first_seen_at":"2026-10-19T23:15:53Z","employer_posted_date":"2026-10-19","last_verified_at":"2026-10-27T00:43:45Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":7},"description":"Blackbaud is looking for a Sr PKI Engineer to operate and maintain our existing public key infrastructure and certificate management services. This is a high-impact, highly visible role that will also continue to drive automation and expansion of the Cryptographic Services Program across the enterprise.This role supports our Microsoft AD CS environment, certificate lifecycle platform, third-party trusted certificate authorities such as Sectigo or DigiCert, and integrations with enterprise key management services.\nResponsibilities\nAdminister and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services (including autoenrollment), Network Device Enrollment Service (NDES), and CRL publication.\nOperate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command. Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations.\nUse Fortanix Data Security Manager and other HSM-backed services as part of PKI operations. Work with the team that owns those services to resolve access, connectivity, and key usage issues.\nInvestigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues.\nPerform routine PKI health checks, patching, maintenance, backups, and recovery testing.\nRespond to certificate expiration alerts and coordinate renewals with application and infrastructure owners.\nMaintain existing PowerShell scripts, scheduled tasks, reports, and PKI automation.\nMaintain CLM/CLaaS infrastructure.\nKeep documentation, runbooks, and certificate records accurate. Support audits, change management, and incident response.\nThe immediate goal of this role is to keep established PKI services secure, available, documented, and running smoothly.\nRequired qualifications\nStrong hands-on experience operating Microsoft AD CS in an enterprise environment, including NDES.\nExperience administering Venafi Trust Protection Platform or Keyfactor Command.\nWorking knowledge of Fortanix Data Security Manager or comparable HSM solutions, including how PKI services use protected keys. Direct responsibility for administering the HSM platform is not required.\nStrong understanding of X.509 certificates, certificate chains, enrollment, revocation, TLS, and private key protection.\nPowerShell scripting and troubleshooting skills.\nAbility to work with Active Directory, DNS, networking, application, and key management teams to resolve certificate issues.\nUnderstanding of cryptographic management in Microsoft Azure or Amazon AWS.\nUnderstanding and experience with certificate configuration and management on content delivery networks, web application firewalls, network load balancers and azure application gateways.\nExperience with change control, operational documentation, and production support.\nExperience and knowledge of offline root CA ceremonies and maintenance processes associated with an ORCA\nPreferred qualifications\nExperience supporting code signing or publicly trusted TLS certificates.\nFamiliarity with PKI backup, recovery, and audit requirements.\nStay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube\nBlackbaud powers social impact through purpose-driven technology and responsible AI. Guided by our Intelligence for Good® vision, we’re building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world.\nBlackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.\nThe starting base pay is $101,900.00 to $132,800.00. Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.Benefits Include:\nMedical, dental, and vision insurance\n\nRemote-flexible workforce\n\nWellness Programs\n\n401(k) program with employer match\n\nFlexible paid time off\n\nGenerous Parental Leave\n\nDonations for Doers\n\nPet insurance, legal and identity protection\n\nTuition reimbursement program","description_format":"text","description_chars":4443,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Parental leave","Vision insurance","Wellness"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Domain Registrars & Registries","EdTech Platforms","Payment Processing & Gateways","Nonprofit, Church & Membership Software"],"lifecycle":[{"event":"open","at":"2026-10-19T23:15:53Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":7,"expected_fill_days":28,"reasons":["conf:5","velocity","win:early"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":132800,"is_top_pay":false},"html_url":"https://alion.io/job/blackbaud-sr-pki-engineer","json_url":"https://alion.io/job/blackbaud-sr-pki-engineer.json","meta":{"generated_at":"2026-10-27T07:48:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8508,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":36535},"rest":"https://alion.io/mcp/rest/get_company?id=36535"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblackbaud-sr-pki-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblackbaud-sr-pki-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblackbaud-sr-pki-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blackbaud-sr-pki-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblackbaud-sr-pki-engineer"}]}