PKI, HSM & Certificate Services Sr. Engineer

• Designing, implementing, administering, and supporting enterprise PKI solutions, including Microsoft ADCS and Keyfactor certificate lifecycle automation platforms.
• Managing the full certificate lifecycle, including issuance, renewal, revocation, inventory management, policy enforcement, and automation for internal and external certificates.
• Administering and maintaining Thales Luna HSM platforms, including key generation, backup, recovery, partition management, firmware upgrades, and security compliance activities.
• Managing external public certificate services through Sectigo, including certificate provisioning, domain validation, organization validation, and integrations with enterprise applications and services.
• Developing and maintaining PKI architectures, cryptographic standards, and key management procedures aligned with security and regulatory requirements.
• Troubleshooting complex PKI, certificate, TLS/SSL, code-signing, and cryptographic issues across enterprise applications, network devices, cloud services, and security platforms.
• Implementing and supporting certificate automation and integrations with web servers, load balancers, network appliances, cloud platforms, DevOps pipelines, and identity solutions.
• Ensuring compliance with industry standards and security frameworks, including NIST, PCI-DSS, SOX, ISO 27001, and CA/Browser Forum requirements where applicable.
• Performing PKI risk assessments, security reviews, disaster recovery testing, key ceremonies, and operational readiness activities for critical cryptographic infrastructure.
• Collaborating with security, infrastructure, application, and cloud engineering teams to design secure cryptographic solutions and support enterprise security initiatives.

To set you up for success in this role from day one, Solventum requires (at a minimum) the following qualifications:

• Bachelor’s Degree or higher AND 7 years of enterprise PKI, certificate management, HSM, cryptography, infrastructure security, or related experience

• In addition to the above requirements, the following are also required:5+ years of hands-on experience administering enterprise PKI or certificate management environments, including certificate issuance, renewal, revocation, inventory, and lifecycle operations.
• Experience supporting Microsoft Active Directory Certificate Services (ADCS), Windows Server environments, and enterprise certificate templates or enrollment workflows.
• Experience with certificate lifecycle automation platforms such as Keyfactor, including certificate discovery, enrollment, renewal, workflow, and integration support.
• Experience administering HSM platforms or secure key management technologies, including key generation, backup, recovery, partition management, and operational controls.Strong understanding of X.509 certificates, CRL, OCSP, PKCS standards, TLS/SSL, code signing, encryption, and cryptographic key management concepts.
• Experience troubleshooting PKI, certificate chain, TLS/SSL, certificate deployment, code-signing, and cryptographic issues across enterprise applications and infrastructure.
• Willingness to participate in an on-call rotation as an escalation point for high-severity PKI, HSM, certificate, and cryptographic service issues. 
• Additional qualifications that could help you succeed even further in this role include: 10+ years of experience administering enterprise PKI and certificate management environments.
• Hands-on experience with Keyfactor, Sectigo Certificate Manager, and Thales Luna HSM platforms
• Experience managing public certificate services, including certificate provisioning, domain validation, organization validation, and externally trusted certificate operations.
• Experience supporting certificate automation through APIs, scripting, ACME, SCEP, ServiceNow workflows, cloud platforms, DevOps pipelines, or enterprise application integrations.
• Experience performing PKI risk assessments, disaster recovery testing, key ceremonies, operational readiness reviews, and audit or compliance support.
• Advanced scripting or automation skills, including PowerShell, Python, REST APIs, or other automation frameworks.  

Solventum is committed to maintaining the highest standards of integrity and professionalism in our recruitment process.  Applicants must remain alert to fraudulent job postings and recruitment schemes that falsely claim to represent Solventum and seek to exploit job seekers.

Please note that all email communications from Solventum regarding job opportunities with the company will be from an email with a domain of @solventum.com. Be wary of unsolicited emails or messages regarding Solventum job opportunities from emails with other email domains.

Carefully read these Terms of Use before using this website. Your access to and use of this website and application for a job at Solventum are conditioned on your acceptance and compliance with these terms.

Please access the linked document by clicking here. Before submitting your application you will be asked to confirm your agreement with the
terms.