Software Engineering Architect, PKI & Trust Services

Description

The company runs a global, multi-cloud platform, and every service on it rests on trust. The systems that issue certificates, set up identity for workloads and AI agents, and protect cryptographic keys let services verify each other.

The role sets strategy and technical direction for this foundation as certificate lifetimes shorten, lifecycle management becomes fully automated, and post-quantum cryptography arrives.

This is a hands-on architecture role for a distributed-systems leader with strong security depth. Experience with PKI and key management is a real advantage, but distributed-systems and security judgment matter most.

Responsibilities

• Set the target architecture and multi-year plan for certificate lifecycle, trust distribution, and cryptographic identity for workloads and AI agents, then see it through to production.
• Design trust infrastructure that stays highly available and scales globally, with measurable Service Level Objectives (SLOs) and automatic certificate renewal across the whole fleet.
• Favor automation and cost efficiency: zero-touch lifecycle operations, migrations with no downtime, and build-or-buy decisions based on data.
• Set architecture and security standards for the interfaces between the trust platform and the infrastructure that depends on it, and help teams work through hard design trade-offs.
• Keep building: prototype, write critical-path code, and check architecture against live systems.
• Present investment and architecture proposals to senior leaders, mentor engineering leads, and spread technical expertise across the organization.

Requirements

• 12+ years designing and running large-scale distributed systems or infrastructure services, with a record of taking multi-team technical strategy into production.
• Deep knowledge of distributed-systems architecture, reliability, and performance at scale.
• Hands-on experience running mission-critical, highly available services on a public cloud such as Amazon Web Services (AWS) or Google Cloud Platform (GCP), including Kubernetes and service mesh.
• Security experience in identity and authorization, applied cryptography, or infrastructure security.
• Working knowledge of PKI, X.509 certificates, mutual Transport Layer Security (mTLS), and key management.
• Proven ability to align cross-organization initiatives without direct authority.
• Strong communication skills, including a record of writing architecture proposals that were adopted and presenting clearly to engineers and executives.
• A genuinely AI-first approach to engineering: you use AI to move faster, learn across the stack, and contribute beyond your main specialty.
• Experience using AI tools such as Claude Code, GitHub Copilot, Codex, or Cursor in development work.
• A related technical degree.
• Even better if: you have built or run certificate, identity, or key-management services at scale.
• Even better if: you know workload identity standards such as SPIFFE and short-lived credentials.
• Even better if: you know post-quantum cryptography standards such as ML-KEM, ML-DSA, and hybrid key exchange in TLS 1.3, plus approaches like Merkle Tree Certificates and crypto-agility design principles.
• Even better if: you have contributed to standards bodies such as the IETF, the CA/Browser Forum, or NIST, or to major open-source projects.

Benefits

• The company offers benefits and resources aimed at helping you balance work and life.