About the Role
PKI L3 Analyst –

Job Description
(JD) Job Title: Public Key Infrastructure (PKI) L3 Analyst Role Overview The PKI L3 Analyst is responsible for providing advanced technical support, administration, troubleshooting, and engineering for enterprise Public Key Infrastructure (PKI) services. The role focuses on managing Certificate Authorities (CAs), digital certificates, certificate lifecycle management, cryptographic services, and security compliance across enterprise environments. The analyst handles complex escalations from L1/L2 teams, resolves critical PKI incidents, performs root cause analysis, and ensures high availability and security of certificate services. Responsibilities
•

Key Responsibilities
• 1. PKI Infrastructure Management
• Administer and support enterprise PKI infrastructure, including Root CA, Intermediate CA, and Issuing CA.
• Manage Microsoft Active Directory Certificate Services (AD CS) and enterprise certificate authorities.
• Support offline Root CA, subordinate CA, and certificate hierarchy management.
• Configure and maintain certificate templates, certificate policies, and enrollment services.
• Manage CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) services.
• Troubleshoot CA availability, replication, and certificate issuance issues.
•
• 2. Certificate Lifecycle Management
• Manage the complete certificate lifecycle:
• issuance
• renewal
• revocation
• and replacement.
•
• Troubleshoot SSL/TLS certificate issues across web servers, applications, load balancers, and network devices.
• Support certificate enrollment through:
• auto-enrollment
• SCEP
• EST
• ACME
• and manual processes where applicable.
•
• Investigate expired, revoked, mismatched, and untrusted certificates.
• Manage certificate inventory, expiry monitoring, and renewal automation.




• Support public and private certificates issued by internal and external CAs.
•
• 3. L3 Incident Management and Troubleshooting
• Handle complex P1/P2 incidents escalated by L1 and L2 support teams.
• Perform root cause analysis (RCA) and provide permanent fixes for recurring issues.
• Troubleshoot certificate chain validation, trust-store problems, TLS handshake failures, and revocation-check failures.
• Analyze Windows Event Viewer logs, CA database records, application logs, and network traces.
• Support major incident management and participate in post-incident reviews.
• Create technical documentation, knowledge articles, and troubleshooting runbooks.
•
• 4. Cryptography and Security
• Demonstrate knowledge of cryptographic algorithms, including RSA, ECC, AES, and SHA-2.
• Support key generation, key protection, key rotation, and secure key storage.
• Manage Hardware Security Modules (HSMs), where applicable.
• Support certificate signing requests (CSRs), public/private key pairs, and certificate chain validation.
• Ensure compliance with enterprise security policies and cryptographic standards.
• Support certificate revocation and key-compromise response procedures.
•
• 5. PKI Engineering and Automation
• Develop and maintain PowerShell scripts for certificate discovery, renewal, monitoring, and troubleshooting.
• Automate certificate expiry reporting and operational activities.
• Support PKI upgrades, migrations, CA renewals, and infrastructure changes.




• Participate in certificate management platform integrations and automation initiatives.
• Work with application, infrastructure, network, cloud, and security teams to resolve certificate-related dependencies.
•
• 6. Governance and Compliance
• Maintain PKI policies, Certificate Practice Statements (CPS), and operational procedures.
• Support audits and compliance requirements related to certificate issuance and cryptographic controls.
• Review CA configurations, access controls, audit logs, and certificate templates.
• Ensure secure handling of CA private keys and privileged administrative access.
• Qualifications
• Experience and Qualifications
• Typically 5–8+ years of experience in PKI, certificate management, Windows infrastructure, or information security.
• Solid hands-on experience in enterprise PKI administration and L3 troubleshooting.
• Experience supporting production environments and critical security services.
• Knowledge of ITIL processes and incident/problem management.
• Relevant certifications in Microsoft technologies, security, or cryptography are advantageous.
• Required Skills
• Required Technical Skills
• Skill Area Required Knowledge
• PKI fundamentals CA hierarchy, Root CA, Subordinate CA, trust chains
• Microsoft PKI AD CS, certificate templates, auto-enrollment
• Certificate management SSL/TLS, X.509, CSR, renewal, revocation
• Revocation services CRL, delta CRL, OCSP
• Troubleshooting TLS handshake, chain validation, certificate errors
• Cryptography RSA, ECC, SHA-256, key management
• Operating systems Windows Server, Active Directory, DNS
• Scripting PowerShell; Python is an advantage
• Security HSM, key protection, access control, audit compliance
• ITSM Incident, problem, change, and major incident management
•
• Preferred Skills
• Preferred Tools and Technologies
• Microsoft Active •

📌 PKIAnalyst (India)
🏢 CosMicIT
📍 India