PKI Architect

PKI Architect

We are seeking a hands-on PKI and Certificate Lifecycle Management CLM specialist to lead enterprise certificate modernisation while operating and improving a production CLM service. The role combines architecture platform engineering lifecycle automation integration operational governance and delivery leadership

Responsibilities

• The role must be equally comfortable designing a target state architecture administering AppViewX integrating with ServiceNow and Certificate Authorities writing automation troubleshooting incidents building runbooks and leading the controlled transfer of repeatable activities to a distributed delivery team

• Primary Outcomes

• Automate certificate discovery ownership request issuance renewal deployment revocation and evidence generation to reduce expiry risk and manual effort

• Establish an enterprise certificate inventory and reconciliation model across CLM platforms Certificate Authorities endpoints and the corporate CMDB

• Operate stabilise and continuously improve AppViewX while remaining capable of assessing and integrating other enterprise CLM and PKI technologies

• Deliver an MVP for priority public TLS certificate use cases and evolve the service toward a strategic internal and external PKI capability

• Create sustainable operating procedures automation controls service measures backup coverage and knowledge transfer so the service does not depend on one individual

Key Responsibilities

• 1 PKI and CLM Architecture

• Lead currentstate assessment and targetstate design across public and private PKI Certificate Authorities CLM platforms trust models cryptographic policies and operational processes

• Define reference patterns for X509 certificate discovery enrolment issuance renewal regeneration deployment revocation trustchain validation and audit

• Design phased delivery covering an immediate publiccertificate MVP and a broader strategic capability for internal PKI machine identities cloud device and IoT use cases

• Translate business application and infrastructure requirements into architecture decisions implementation roadmaps integration designs and prioritised backlogs

• Assess fit of existing investments before recommending new tooling identify capability gaps using evidence technical scenarios and proofofcapability testing

• 2 AppViewX Platform Engineering and Operations

• Administer AppViewX groups owners roles RBAC policies workflows notifications reports discovery settings and automation configurations

• Monitor platform health connector status expiry risk failed renewals failed deployments ownership gaps inventory exceptions and integration failures

• Configure layered discovery using Certificate Authorities managed devices and controlled network scans with filtering and reconciliation to prevent unmanaged inventory growth

• Implement controlled enrolment renewal and deployment workflows with approvals maintenance windows prechecks backup validation rollback and postchange evidence

• Triage incidents and service requests perform rootcause analysis coordinate remediation and maintain service records in approved enterprise systems

• 3 Integration and Automation

• Design and support bidirectional integration with ServiceNow for requests approvals incidents changes CMDB relationships ownership and lifecycle records

• Integrate CLM services with Microsoft ADCS DigiCert and other approved publicprivate CAs using secure service accounts APIs and controlled credential ownership

• Build and maintain automation using REST APIs PowerShell Python or Bash with version control peer review testing logging error handling and rollback

• Enable certificate automation for WindowsIIS Linux F5load balancers DNS validation cloud services API gateways KubernetesOpenShift certmanager Vault and managed certificate services

• Integrate operational and audit events with monitoring and SIEM platforms and use privileged credential retrieval patterns rather than unmanaged static credentials

• 4 Security Governance and Risk

• Apply least privilege segregation of duties controlled privileged access secure privatekey handling and auditable administration

• Translate approved cryptographic standards into enforceable CA and lifecycle policies covering algorithms key sizes validity naming CSR parameters and exception handling

• Maintain architecture decisions RACI risks dependencies control evidence and technical documentation escalate expiry ownership resilience compliance and security risks

• Ensure deployment automation preserves approval change testing rollback audit and operational support requirements

• Support audit evidence production for certificate activity administrative access policy compliance approvals changes deployment and revocation

• Required Skills and Experience

• 10 years of experience across PKI cybersecurity architecture infrastructure security platform engineering DevSecOps or enterprise security operations

• Deep practical knowledge of X509 PKI TLSSSL trust chains Certificate Authorities CSRs key pairs certificate profiles revocation and cryptographic controls

• Demonstrated handson AppViewX Keyfactor Venafi DigiCert administration and engineering experience Experience with Venafi Keyfactor DigiCert Sectigo or similar platforms is valuable

• Experience designing and operating certificate discovery inventory ownership enrolment issuance renewal deployment revocation monitoring and audit processes

• Strong ServiceNow experience covering ITSM workflows Change Incident Request CMDBCSDM integration and lifecycle traceability

• Handson automation using REST APIs and at least one of PowerShell Python or Bash sound SDLC sourcecontrol testing and supporthandover practices

• Working knowledge of Microsoft ADCS SCEP NDES ACME certmanager OAuth 2.0 RBAC service accounts and secrets credential-management patterns

• Experience across hybrid infrastructure including WindowsIIS Linux F5 or comparable load balancers DNS cloud platforms and enterprise monitoringSIEM

• Experience with Kubernetes OpenShift cloud certificate services and Infrastructure as Code such as Terraform

• Proven ability to lead enterprise workshops architecture reviews technical delivery troubleshooting and distributedteam capability transfer

• Additional information

• Cognizant reserves the right to modify this information at any time, subject to applicable law.

• Cognizant is an equal opportunity employer. Your application and candidacy will not be considered based on protected characteristics.

• The company may require candidates to attend interviews in person or by video conference.