Senior Security Engineer

Job Overview

We are looking for an experienced Senior Security Engineer with strong hands-on expertise in Machine Identity, PKI, certificate lifecycle management, and cryptographic key management.

The role involves extending enterprise certificate and key-management tooling, supporting machine-identity discovery, populating ServiceNow CMDB, and implementing certificate/key lifecycle controls across a defined technical scope.

Key Responsibilities

• Support discovery of machine identities, including certificates and cryptographic keys.
  
• Extend machine-identity discovery processes and capture ownership and internal/external classification.
  
• Populate and maintain machine-identity asset information in ServiceNow CMDB.
  
• Work with the ServiceNow team on tooling and configuration changes.
  
• Support Venafi certificate inventory and lifecycle-management activities.
  
• Implement controls around certificate renewal versus cryptographic key rekey/rotation.
  
• Support Key Owner / Custodian registry development and data modelling.
  
• Work with PKI and certificate lifecycle processes including issuance, renewal, revocation, rotation and rekey.
  
• Develop scripts and automation for discovery and tooling integration using Python, PowerShell and REST APIs.
  
• Support integration with security platforms and certificate/key-management tools.
  

Mandatory Skills

• 6+ years of experience in platform, infrastructure or security engineering.
  
• Hands-on experience with Machine Identity.
  
• Strong experience in Cryptographic Key Management.
  
• Strong understanding of PKI and cryptography fundamentals.
  
• Experience with X.509 certificates, CSR, PGP/GPG key pairs and cryptoperiods.
  
• Hands-on certificate lifecycle management – issuance, renewal, revocation, rotation/rekey.
  
• Experience with Venafi / Certificate Management.
  
• Experience with ServiceNow CMDB and ITSM data modelling.
  
• Experience with REST APIs and scripting/automation.
  
• Ability to work on defined, time-bound technical deliverables.
  

Good to Have

• CyberArk Certificate Management / CyberArk Vault
  
• DigiCert
  
• Oasis Security
  
• HashiCorp Vault
  
• Azure Key Vault
  
• IBM Sterling File Gateway / Secure Proxy
  
• SFTP and PGP onboarding
  
• ServiceNow renewal-ticket workflow
  
• GCP exposure