Sr. PKI Engineer
- Pay
- $101,900 – $132,800 per year
- Location
- Remote (US)
- Job type
- Full-time
- Level
- Lead / Staff
- Listed
- 18 days ago
Skills & highlights for this role
- Microsoft Active Directory Certificate Services (AD CS)
- Network Device Enrollment Service (NDES)
- Venafi Trust Protection Platform or Keyfactor Command
- Fortanix Data Security Manager or comparable HSM solutions
- X.509 certificates
- Certificate chains
- Certificate enrollment and revocation
- TLS
- Private key protection
- PowerShell scripting
- Active Directory
- DNS
- Networking
- Cryptographic management in Microsoft Azure or Amazon AWS
Also useful
- Code signing certificate management
- Publicly trusted TLS certificate management
- PKI backup, recovery, and audit requirements
Pay and benefits
Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services (including autoenrollment), Network Device Enrollment Service (NDES), and CRL publication. Operate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command.
Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations. Use Fortanix Data Security Manager and other HSM-backed services as part of PKI operations. Work with the team that owns those services to resolve access, connectivity, and key usage issues. Investigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues.
Perform routine PKI health checks, patching, maintenance, backups, and recovery testing. Respond to certificate expiration alerts and coordinate renewals with application and infrastructure owners. Maintain existing PowerShell scripts, scheduled tasks, reports, and PKI automation. Maintain CLM/CLaaS infrastructure. Keep documentation, runbooks, and certificate records accurate.
Support audits, change management, and incident response. The immediate goal of this role is to keep established PKI services secure, available, documented, and running smoothly. Required qualifications Strong hands-on experience operating Microsoft AD CS in an enterprise environment, including NDES. Experience administering Venafi Trust Protection Platform or Keyfactor Command.
Working knowledge of Fortanix Data Security Manager or comparable HSM solutions, including how PKI services use protected keys. Direct responsibility for administering the HSM platform is not required. Strong understanding of X.509 certificates, certificate chains, enrollment, revocation, TLS, and private key protection. PowerShell scripting and troubleshooting skills.
Ability to work with Active Directory, DNS, networking, application, and key management teams to resolve certificate issues. Understanding of cryptographic management in Microsoft Azure or Amazon AWS. Understanding and experience with certificate configuration and management on content delivery networks, web application firewalls, network load balancers and azure application gateways.
Experience with change control, operational documentation, and production support. Experience and knowledge of offline root CA ceremonies and maintenance processes associated with an ORCA Preferred qualifications Experience supporting code signing or publicly trusted TLS certificates. Familiarity with PKI backup, recovery, and audit requirements.
Stay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube Blackbaud powers social impact through purpose-driven technology and responsible AI. Guided by our Intelligence for Good® vision, we're building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world. The starting base pay is $101,900.00 to $132,800.00.
Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.
Benefits
Include: Medical, dental, and vision insurance Remote-flexible workforce Wellness Programs 401(k) program with employer match Flexible paid time off Generous Parental Leave Donations for Doers Pet insurance, legal and identity protection Tuition reimbursement program
About Blackbaud
Blackbaud is looking for a Sr PKI Engineer to operate and maintain our existing public key infrastructure and certificate management service s. This is a high-impact, highly visible role that will also continue to drive automation and expansion of the Cryptographic Services Program across the enterprise. This role supports our Microsoft AD CS environment, certificate lifecycle platform, third-party trusted certificate authorities such as Sectigo or DigiCert, and integrations with enterprise key management services.
Equal opportunity and legal notices
Blackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.
From Blackbaud's careers page, first listed on Rolev.ai on October 22, 2026. Rolev.ai is not the employer.
How Rolev.ai helps with this application
Rolev.ai is a job search and application tool for US job seekers. For this Sr. PKI Engineer role at Blackbaud, it shows how your resume fits, tailors your resume to the posting, and prepares the application for you to review.
See how you fit
Openings from employer career sites are ranked against your whole resume—and searchable inside Claude, ChatGPT, and Cursor via Rolev.ai MCP.
Tailor without inventing
Every change to your resume is checked against your original. New experience goes in only with your yes—zero fabricated claims.
Draft the full kit
Tailored and Full Match resumes, role-specific cover letters, and answers to employer screening questions are prepared in seconds.
1-Click Extension Autofill
The Chrome extension fills the employer's Greenhouse, Workday, Lever, or Ashby form in 1 click. You review it and press Submit.
Common questions
What is the salary for the Sr. PKI Engineer role at Blackbaud?
The Sr. PKI Engineer posting at Blackbaud states compensation of $101,900 – $132,800 per year. It is listed as a full-time position. Final pay may depend on location, experience, and interview evaluation on Blackbaud's official career site.
Where is the Sr. PKI Engineer job at Blackbaud located?
Yes, this Sr. PKI Engineer opening at Blackbaud is listed as Remote (US). Always check Blackbaud's application page for specific state eligibility or relocation policies.
What qualifications are required for Sr. PKI Engineer at Blackbaud?
For the Sr. PKI Engineer role, Blackbaud highlights experience with Microsoft Active Directory Certificate Services (AD CS), Network Device Enrollment Service (NDES), Venafi Trust Protection Platform or Keyfactor Command, Fortanix Data Security Manager or comparable HSM solutions, X.509 certificates, Certificate chains. Rolev.ai can score your existing resume against these requirements and show any skill gaps before you apply.
How do I apply for the Sr. PKI Engineer position at Blackbaud?
This listing links directly to Blackbaud's Workday application page. You can apply directly on Blackbaud's site, or use Rolev.ai to check your resume fit, generate a zero-hallucination tailored resume and cover letter for this posting, and autofill the Workday application form in 1 click with the Rolev.ai Chrome extension. You always review the form and press Submit yourself.