Software Engineering PMTS, Enterprise PKI
Salesforce2 days ago
Base Salary
$197k - $314k/yr
Responsibilities
- Architect and lead the implementation and evolution of EJBCA-based PKI infrastructure, including CA hierarchies, RA capabilities, OCSP responders, and CRL distribution.
- Own the technical design and delivery of a scalable, resilient, secure, and compliant PKI platform across hybrid cloud environments.
- Implement and support ACME, EST, CMP, and REST-based certificate APIs, including migration from legacy NDES/SCEP workflows.
- Build automation frameworks and APIs for certificate provisioning, renewal, revocation, monitoring, and audit logging.
- Drive certificate lifecycle management for enterprise applications, devices, internal clients, and workloads.
- Expand PKI capabilities for IoT identity, workload identity, mTLS, and post-quantum cryptography readiness.
- Integrate certificate authentication and management across enterprise platforms, CI/CD pipelines, and cloud infrastructure.
- Provide technical leadership and mentorship on cryptographic protocols, secure coding, and identity primitives.
- Lead incident response and root cause analysis for PKI outages and certificate trust failures.
- Maintain architecture documentation, operational runbooks, and PKI standards.
- Build production-grade software and evaluate human- and AI-generated code for correctness, security, quality, and performance.
- Design systems in which AI agents support human workflows and maintain shared system context for reliable AI-assisted engineering.
Requirements
- 10+ years of experience in enterprise-scale PKI design and operations.
- Hands-on expertise with EJBCA or comparable CA/RA platforms such as ADCS, Dogtag, or Vault PKI.
- Deep knowledge of X.509 certificates, asymmetric cryptography, certificate templates, key usages, trust chains, CRLs, and OCSP.
- Experience designing certificate lifecycle automation and management workflows.
- Experience with ACME, EST, CMP, REST certificate APIs, and migration from NDES/SCEP-based ADCS infrastructure.
- Demonstrated ability to lead cross-functional deployment and modernization of secure identity services.
- Experience with cloud-native PKI in AWS, Azure, and/or GCP.
- Familiarity with HSM integration, key escrow, and secure enclaves.
- Proficiency in Go and Python.
- Understanding of DevOps practices, CI/CD, monitoring, and production-system ownership.
- Familiarity with Git, Perforce, and Linux environments.
- Experience using AI development tools such as Claude Code, GitHub Copilot, Codex, or Cursor.
- Advanced prompt engineering skills and ability to develop reliable system context for AI-assisted engineering.
- Bachelor’s or master’s degree in computer science, engineering, cybersecurity, or a related field, or equivalent experience.
- Preferred experience includes PKI in Kubernetes or service mesh environments, IoT identity and attestation, TPM, Secure Boot, NIST post-quantum cryptography, NIST/ISO/SOC 2/FIPS standards, certificate lifecycle management platforms, certificate observability, Zero Trust, MFA, secrets management, OWASP Top 10, and CWE Top 25.
Benefits
- Benefits include time off programs, medical, dental, vision, mental health support, paid parental leave, life and disability insurance, 401(k), and an employee stock purchasing program.
- Salesforce provides equal employment opportunity and reasonable accommodation support during the application and recruiting process.
Tech Stack
Categories
About Salesforce
We're the #1 AI CRM—where humans with agents drive customer success together with AI, data, and Customer 360 apps on one platform. Privacy Statement: http://www.salesforce.com/company/privacy/