Certificate Management / Microsoft PKI Engineer

Role Overview

The Certificate Management / Microsoft PKI Engineer is responsible for the administration and operational support of enterprise Public Key Infrastructure (PKI) and certificate services across on-premises and cloud environments.

This is an infrastructure administration and operations role rather than a software development position. The role focuses on the day-to-day management of certificate lifecycles, including issuance, renewal, deployment, rotation, troubleshooting, and controlled automation. The successful candidate will help maintain service availability while ensuring certificate operations comply with enterprise security standards.

The position works closely with infrastructure, network, security, and application teams to ensure certificates are managed proactively and renewed or rotated on time, reducing manual effort and operational risk.

Key Responsibilities

PKI & Certificate Lifecycle Management

• Administer and support enterprise PKI and certificate management services across on-premises and cloud environments.

• Manage the full certificate lifecycle, including issuance, deployment, renewal, rotation, revocation, and troubleshooting.

• Support both internal and externally issued digital certificates.

• Monitor certificate validity and expiration to help prevent certificate-related service disruptions.

• Ensure certificate operations follow established security standards, policies, and operational procedures.

Microsoft PKI Administration

• Administer Microsoft Active Directory Certificate Services (AD CS) and/or other enterprise PKI platforms.

• Support certificate deployment and management across enterprise infrastructure environments.

• Troubleshoot certificate chains, trust relationships, TLS/HTTPS issues, and other certificate-related incidents.

• Support certificate implementation across Windows and Linux servers and relevant application or infrastructure platforms.

Certificate Deployment & Infrastructure Support

• Deploy and manage certificates across technologies such as:

  • Windows and Linux servers

  • IIS

  • Apache

  • Nginx

  • Load balancers

  • Reverse proxies

• Collaborate with infrastructure, network, security, and application teams to resolve certificate-related issues and support operational requirements.

• Ensure certificates are renewed and rotated within required timelines to maintain service continuity.

Automation & Operational Improvement

• Support controlled automation of repetitive certificate management activities to reduce manual intervention and operational risk.

• Use scripting technologies to improve certificate administration, monitoring, and lifecycle processes.

• Contribute to continuous improvement of PKI and certificate management procedures.

• Manage incidents, service requests, and operational activities using established IT service management processes and tools.

Qualifications

Required

• 5-8+ years of experience in compute, infrastructure, systems administration, or a related technical environment.

• 3-5+ years of hands-on experience managing PKI and enterprise certificate services.

• Strong background and practical experience in Windows infrastructure (Wintel) environments.

• Hands-on experience managing:

  • Certificate issuance and renewal

  • Internal and external certificates

  • Enterprise certificate lifecycle operations

• Strong understanding of:

  • X.509 certificates

  • TLS/HTTPS

  • Certificate chains

  • Trust models

• Experience administering Microsoft Active Directory Certificate Services (AD CS) and/or enterprise PKI platforms.

• Hands-on experience deploying certificates across enterprise server and application environments.

• Working knowledge of PowerShell and/or basic Python or shell scripting.

• Familiarity with IT service management tools and processes.

Relevant Technology Exposure

Experience with one or more enterprise certificate management platforms or certificate authorities, such as:

• Venafi

• Keyfactor

• AppViewX

• DigiCert

• Sectigo

Experience with ITSM platforms such as:

• ServiceNow or similar tools

Key Competencies

• PKI and certificate lifecycle administration

• Microsoft AD CS administration

• Windows infrastructure support

• Certificate deployment and troubleshooting

• TLS/HTTPS and trust model knowledge

• Infrastructure operations and incident resolution

• Scripting and operational automation

• Cross-functional technical collaboration

• Attention to detail and proactive risk management