The Senior PKI / Certificate Management Engineer will oversee the PKI infrastructure, enforce security standards, and support identity modernization efforts while working cross-functionally.
Job Description
BAE Systems, Inc. is seeking a Senior PKI / Certificate Management Engineer to join our Identity Services organization, supporting the Directory Services, Certificate Management, and Privileged Access Management (DCP) team. This strategic role focuses on defining and implementing enterprise-wide standards and best practices for PKI enterprise while collaborating across various departments and IT functions.
As a PKI Engineer, you will be responsible for the governance, engineering, and maintenance of our PKI environment. You'll lead initiatives around identity modernization, enforce security and compliance standards, and work closely with stakeholders to implement access controls and authentication mechanisms. This is a high-impact, cross-functional role for someone with deep technical expertise and strong communication skills.
The ideal candidate has deep hands-on experience with Microsoft PKI, strong Active Directory fundamentals, and a background in automating certificate lifecycle management in highly regulated environments.
Responsibilities Include:
Required Education, Experience, & Skills
Preferred Education, Experience, & Skills
Pay Information
Full-Time Salary Range: $115779 - $196825
Please note: This range is based on our market pay structures. However, individual salaries are determined by a variety of factors including, but not limited to: business considerations, local market conditions, and internal equity, as well as candidate qualifications, such as skills, education, and experience.
Employee Benefits: At BAE Systems, we support our employees in all aspects of their life, including their health and financial well-being. Regular employees scheduled to work 20+ hours per week are offered: health, dental, and vision insurance; health savings accounts; a 401(k) savings plan; disability coverage; and life and accident insurance. We also have an employee assistance program, a legal plan, and other perks including discounts on things like home, auto, and pet insurance. Our leave programs include paid time off, paid holidays, as well as other types of leave, including paid parental, military, bereavement, and any applicable federal and state sick leave. Employees may participate in the company recognition program to receive monetary or non-monetary recognition awards. Other incentives may be available based on position level and/or job specifics.
About BAE Systems, Inc.
BAE Systems, Inc. is the U.S. subsidiary of BAE Systems plc, an international defense, aerospace and security company which delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Improving the future and protecting lives is an ambitious mission, but it's what we do at BAE Systems. Working here means using your passion and ingenuity where it counts - defending national security with breakthrough technology, superior products, and intelligence solutions. As you develop the latest technology and defend national security, you will continually hone your skills on a team-making a big impact on a global scale. At BAE Systems, you'll find a rewarding career that truly makes a difference.
This position will be posted for at least 5 calendar days. The posting will remain active until the position is filled, or a qualified pool of candidates is identified.
BAE Systems, Inc. is seeking a Senior PKI / Certificate Management Engineer to join our Identity Services organization, supporting the Directory Services, Certificate Management, and Privileged Access Management (DCP) team. This strategic role focuses on defining and implementing enterprise-wide standards and best practices for PKI enterprise while collaborating across various departments and IT functions.
As a PKI Engineer, you will be responsible for the governance, engineering, and maintenance of our PKI environment. You'll lead initiatives around identity modernization, enforce security and compliance standards, and work closely with stakeholders to implement access controls and authentication mechanisms. This is a high-impact, cross-functional role for someone with deep technical expertise and strong communication skills.
The ideal candidate has deep hands-on experience with Microsoft PKI, strong Active Directory fundamentals, and a background in automating certificate lifecycle management in highly regulated environments.
Responsibilities Include:
- Design, implement, and support Active Directory Certificate Services (ADCS), including root and issuing Certificate Authorities (CAs)
- Manage and maintain PKI infrastructure, including:
- Certificate Authorities (CAs)
- Online Responders (OCSP)
- CRL distribution points
- Support external/public certificates (e.g., Sectigo, DigiCert, GoDaddy)
- Administer and integrate Hardware Security Modules (HSMs) for private key protection
- Ensure cryptographic standards and key management practices align with compliance requirements
- Leverage strong Active Directory expertise to support PKI operations:
- Certificate templates
- Group Policy
- Auto-enrollment
- Service accounts and permissions
- Troubleshoot complex identity and authentication issues related to certificates and smart cards
- Administer and enhance Venafi Trust Protection Platform / CyberArk Certificate Manager
- Support certificate discovery, policy enforcement, and automation
- Integrate certificate management platforms with enterprise tooling
- Support smart card infrastructure and credential issuance
- Administer Intercede MyID Credential Management System (CMS)
- Participate in incident response, root cause analysis, and continuous improvement efforts
- Ensure PKI operations align with CMMC, NIST (800-53, 800-171), and other regulatory frameworks
- Support audits and compliance reviews related to cryptographic services
Required Education, Experience, & Skills
- 5+ years of hands-on experience supporting Microsoft ADCS / PKI
- Strong Active Directory administration experience (GPOs, permissions, service accounts)
- Experience managing OCSP responders and CRLs
- Hands-on experience with Hardware Security Modules (HSMs)
- Experience with certificate lifecycle management
- Strong written and verbal communication skills; capable of working with cross-functional teams.
- Bachelor's degree in CS, IT or an Engineering discipline
Preferred Education, Experience, & Skills
- PowerShell scripting experience for automation and operational efficiency
- Experience with implementing monitoring, alerting, and reporting using Splunk
- Visio experience for architecture and process documentation
- Experience operating in regulated or compliance-driven environments
- Experience with Venafi Trust Protection Platform / CyberArk Certificate Manager
- Experience with Intercede MyID or other smart card CMS platforms
- External/public certificate management (Sectigo, DigiCert, GoDaddy)
- GoDaddy domain registration and DNS fundamentals
- Experience using ServiceNow for incident/change/request workflows
- Familiarity with CMMC, NIST, or similar compliance frameworks
- Experience supporting Windows Hello for Business, smart card logon, or certificate-based authentication
- Experience with Azure Key Vault
- Experience modernizing or automating legacy PKI environments
- Proficiency in utilizing tools such as Certutil and/or OpenSSL to create, analyze, and manage digital certificates, Certificate Revocation Lists (CRLs), and Online Certificate Status Protocol (OCSP) responses, including configuration and management of distribution points.
- Interfacing with internally hosted Certificate Authorities and upgrading and deploying PKI to all environments
- CompTIA Security+ or CISSP
- Master's degree in CS, IT or an Engineering discipline
Pay Information
Full-Time Salary Range: $115779 - $196825
Please note: This range is based on our market pay structures. However, individual salaries are determined by a variety of factors including, but not limited to: business considerations, local market conditions, and internal equity, as well as candidate qualifications, such as skills, education, and experience.
Employee Benefits: At BAE Systems, we support our employees in all aspects of their life, including their health and financial well-being. Regular employees scheduled to work 20+ hours per week are offered: health, dental, and vision insurance; health savings accounts; a 401(k) savings plan; disability coverage; and life and accident insurance. We also have an employee assistance program, a legal plan, and other perks including discounts on things like home, auto, and pet insurance. Our leave programs include paid time off, paid holidays, as well as other types of leave, including paid parental, military, bereavement, and any applicable federal and state sick leave. Employees may participate in the company recognition program to receive monetary or non-monetary recognition awards. Other incentives may be available based on position level and/or job specifics.
About BAE Systems, Inc.
BAE Systems, Inc. is the U.S. subsidiary of BAE Systems plc, an international defense, aerospace and security company which delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Improving the future and protecting lives is an ambitious mission, but it's what we do at BAE Systems. Working here means using your passion and ingenuity where it counts - defending national security with breakthrough technology, superior products, and intelligence solutions. As you develop the latest technology and defend national security, you will continually hone your skills on a team-making a big impact on a global scale. At BAE Systems, you'll find a rewarding career that truly makes a difference.
This position will be posted for at least 5 calendar days. The posting will remain active until the position is filled, or a qualified pool of candidates is identified.
Top Skills
Active Directory
Active Directory Certificate Services
Azure Key Vault
Certutil
Cyberark Certificate Manager
Hardware Security Modules
Microsoft Pki
Openssl
Servicenow
Splunk
Venafi Trust Protection Platform
BAE Systems, Inc. Austin, Texas, USA Office
825 E. Howard Lane, Austin, TX, United States, 78753
Similar Jobs at BAE Systems, Inc.
Aerospace • Hardware • Information Technology • Security • Software • Cybersecurity • Defense
The Lead Entra ID Engineer will manage Microsoft's Entra ID environment, enforce security standards, automate tasks, and mentor junior engineers. Responsibilities also include implementing identity controls and ensuring compliance with regulations.
Top Skills:
Active DirectoryAzure AdMicrosoft Entra IdMicrosoft Graph ApiPowershellServicenowSplunkVisio
Aerospace • Hardware • Information Technology • Security • Software • Cybersecurity • Defense
Responsibilities include training in FMV tradecraft, producing graphic reports, inputting data from sensors, and briefing government personnel. Candidates should excel in a fast-paced environment and have intelligence operations experience.
Top Skills:
FmvGeointMS Office
Aerospace • Hardware • Information Technology • Security • Software • Cybersecurity • Defense
This role involves managing a team of business analysts for engineering tools, overseeing application operations, stakeholder communication, and ensuring technical compliance.
Top Skills:
Servicenow
What you need to know about the Austin Tech Scene
Austin has a diverse and thriving tech ecosystem thanks to home-grown companies like Dell and major campuses for IBM, AMD and Apple. The state’s flagship university, the University of Texas at Austin, is known for its engineering school, and the city is known for its annual South by Southwest tech and media conference. Austin’s tech scene spans many verticals, but it’s particularly known for hardware, including semiconductors, as well as AI, biotechnology and cloud computing. And its food and music scene, low taxes and favorable climate has made the city a destination for tech workers from across the country.
Key Facts About Austin Tech
- Number of Tech Workers: 180,500; 13.7% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Dell, IBM, AMD, Apple, Alphabet
- Key Industries: Artificial intelligence, hardware, cloud computing, software, healthtech
- Funding Landscape: $4.5 billion in VC funding in 2024 (Pitchbook)
- Notable Investors: Live Oak Ventures, Austin Ventures, Hinge Capital, Gigafund, KdT Ventures, Next Coast Ventures, Silverton Partners
- Research Centers and Universities: University of Texas, Southwestern University, Texas State University, Center for Complex Quantum Systems, Oden Institute for Computational Engineering and Sciences, Texas Advanced Computing Center
