PKI, HSM & Certificate Services Sr. Engineer

Job Description:

3M Health Care is now Solventum

At Solventum, we enable better, smarter, safer healthcare to improve lives. As a new company with a long legacy of creating breakthrough solutions for our customers’ toughest challenges, we pioneer game-changing innovations at the intersection of health, material and data science that change patients' lives for the better while enabling healthcare professionals to perform at their best. Because people, and their wellbeing, are at the heart of every scientific advancement we pursue.

We partner closely with the brightest minds in healthcare to ensure that every solution we create melds the latest technology with compassion and empathy. Because at Solventum, we never stop solving for you.

The Impact You’ll Make in this Role

You are a hands-on cryptography and certificate services engineer supporting a next-generation Identity and Access Management team. You will help design, administer, automate, and support enterprise Public Key Infrastructure (PKI), Hardware Security Module (HSM), certificate lifecycle management, and cryptographic services across Solventum’s global environment.

You are excited about strengthening cryptographic foundations in a large global company by supporting secure certificate issuance, lifecycle automation, key protection, and platform resiliency across cloud, on-premises, third-party hosted, and co-location environments.

You are a self-driven, hands-on individual who enjoys solving complex PKI, HSM, certificate, TLS/SSL, code-signing, and key management challenges. You bring strong technical depth, operational discipline, and a continuous improvement mindset to critical security services.

As a PKI/HSM Crypto Sr. Security Engineer you will have the opportunity to tap into your curiosity and collaborate with some of the most innovative and diverse people around the world. Here, you will make an impact by:

• Designing, implementing, administering, and supporting enterprise PKI solutions, including Microsoft ADCS and Keyfactor certificate lifecycle automation platforms.
• Managing the full certificate lifecycle, including issuance, renewal, revocation, inventory management, policy enforcement, and automation for internal and external certificates.
• Administering and maintaining Thales Luna HSM platforms, including key generation, backup, recovery, partition management, firmware upgrades, and security compliance activities.
• Managing external public certificate services through Sectigo, including certificate provisioning, domain validation, organization validation, and integrations with enterprise applications and services.
• Developing and maintaining PKI architectures, cryptographic standards, and key management procedures aligned with security and regulatory requirements.
• Troubleshooting complex PKI, certificate, TLS/SSL, code-signing, and cryptographic issues across enterprise applications, network devices, cloud services, and security platforms.
• Implementing and supporting certificate automation and integrations with web servers, load balancers, network appliances, cloud platforms, DevOps pipelines, and identity solutions.
• Ensuring compliance with industry standards and security frameworks, including NIST, PCI-DSS, SOX, ISO 27001, and CA/Browser Forum requirements where applicable.
• Performing PKI risk assessments, security reviews, disaster recovery testing, key ceremonies, and operational readiness activities for critical cryptographic infrastructure.
• Collaborating with security, infrastructure, application, and cloud engineering teams to design secure cryptographic solutions and support enterprise security initiatives.

To set you up for success in this role from day one, Solventum requires (at a minimum) the following qualifications:

• Bachelor’s Degree or higher AND 7 years of enterprise PKI, certificate management, HSM, cryptography, infrastructure security, or related experience

• In addition to the above requirements, the following are also required:5+ years of hands-on experience administering enterprise PKI or certificate management environments, including certificate issuance, renewal, revocation, inventory, and lifecycle operations.
• Experience supporting Microsoft Active Directory Certificate Services (ADCS), Windows Server environments, and enterprise certificate templates or enrollment workflows.
• Experience with certificate lifecycle automation platforms such as Keyfactor, including certificate discovery, enrollment, renewal, workflow, and integration support.
• Experience administering HSM platforms or secure key management technologies, including key generation, backup, recovery, partition management, and operational controls.Strong understanding of X.509 certificates, CRL, OCSP, PKCS standards, TLS/SSL, code signing, encryption, and cryptographic key management concepts.
• Experience troubleshooting PKI, certificate chain, TLS/SSL, certificate deployment, code-signing, and cryptographic issues across enterprise applications and infrastructure.
• Willingness to participate in an on-call rotation as an escalation point for high-severity PKI, HSM, certificate, and cryptographic service issues.
• Additional qualifications that could help you succeed even further in this role include:10+ years of experience administering enterprise PKI and certificate management environments.
• Hands-on experience with Keyfactor, Sectigo Certificate Manager, and Thales Luna HSM platforms
• Experience managing public certificate services, including certificate provisioning, domain validation, organization validation, and externally trusted certificate operations.
• Experience supporting certificate automation through APIs, scripting, ACME, SCEP, ServiceNow workflows, cloud platforms, DevOps pipelines, or enterprise application integrations.
• Experience performing PKI risk assessments, disaster recovery testing, key ceremonies, operational readiness reviews, and audit or compliance support.
• Advanced scripting or automation skills, including PowerShell, Python, REST APIs, or other automation frameworks.

Work location: Bangalore (Hybrid)

Solventum is committed to maintaining the highest standards of integrity and professionalism in our recruitment process. Applicants must remain alert to fraudulent job postings and recruitment schemes that falsely claim to represent Solventum and seek to exploit job seekers.

Please note that all email communications from Solventum regarding job opportunities with the company will be from an email with a domain of @solventum.com. Be wary of unsolicited emails or messages regarding Solventum job opportunities from emails with other email domains.

Please note: your application may not be considered if you do not provide your education and work history, either by: 1) uploading a resume, or 2) entering the information into the application fields directly.

Solventum Global Terms of Use and Privacy Statement

Carefully read these Terms of Use before using this website. Your access to and use of this website and application for a job at Solventum are conditioned on your acceptance and compliance with these terms.

Please access the linked document by clicking here. Before submitting your application you will be asked to confirm your agreement with the

terms.