PKI L3 Support Engineer

Role Overview: Provide Level 3 technical support for enterprise Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) services. Own complex escalations, root cause analysis, service restoration, and preventive improvements across certificate services and automation. Work with application, infrastructure, network, security, and vendor teams to maintain reliable certificate operations.

A minimum of 10 years of relevant experience in PKI, certificate management, or related security engineering is required, including substantial hands-on enterprise PKI and advanced production support experience.

Key Responsibilities

- Provide L3 administration and support for enterprise PKI and CLM platforms, covering certificate enrollment, issuance, renewal, revocation, discovery, and inventory management.
- Configure, manage, and troubleshoot ACME (Automated Certificate Management Environment) services and clients; resolve complex automated issuance and renewal failures.
- Collaborate with application teams to implement and support ACME-based certificate automation for enterprise applications, including onboarding, integration testing, and production troubleshooting.
- Own complex certificate-related escalations across servers, applications, and network devices, including TLS/SSL handshake failures, trust-chain issues, certificate-based authentication failures, and revocation-checking problems.
- Develop and maintain PKI technical documentation, operational runbooks, troubleshooting guides, change records, and validation procedures; provide knowledge transfer and technical guidance to L1/L2 support teams.
- Analyze recurring incidents and certificate management processes; implement preventive actions and automation to reduce manual effort, expiry-related outages, and operational risk.
- Design, develop, test, and support automated certificate management workflows and integrations in ServiceNow,



including troubleshooting failed requests and lifecycle process exceptions.
- Review, validate, and maintain the accuracy, completeness, and consistency of discovered certificate data within the certificate inventory.
- Support the correlation and mapping of discovered certificates to their corresponding Configuration Items (CIs) in the ServiceNow CMDB
- Lead technical investigation and service restoration for major PKI incidents; perform root cause analysis, document corrective actions, and coordinate vendor escalations through resolution.
- Support certificate authority health, certificate templates, CRL publication, and OCSP availability; execute controlled maintenance, patching, upgrades, backup verification, and recovery testing.
- Monitor service health, certificate expiry, and automation failures; support incident, problem, and change management within agreed service levels, including on-call and planned out-of-hours support as required.

Required Skills and Experience

Minimum 10 years of relevant experience in PKI, certificate management, or related security engineering roles, including substantial hands-on experience supporting enterprise PKI services and resolving complex L3 production incidents. Required technical capabilities include:

- Implementing and managing ACME-based certificate automation.
- Advanced administration and troubleshooting of enterprise Certificate Lifecycle Management (CLM) platforms, including discovery, renewal, revocation, monitoring, and integrations.
- Understanding of certificate enrollment protocols and automated certificate issuance.
- Hands on experience with ACME clients such as Simple-ACME,



winacme, Certbot, Letsencrypt, etc.
- Demonstrated expertise in L3 troubleshooting, log analysis, root cause analysis, and resolution of complex PKI and certificate-related incidents in enterprise environments.
- Robust hands-on experience with Windows Server, Active Directory, and Microsoft AD CS, including certificate authority operations, certificate templates, enrollment permissions, and Group Policy-based enrollment.
- Strong practical knowledge of TLS/SSL, HTTPS, and certificate-based authentication, with the ability to diagnose handshake, trust-store, certificate-chain, and revocation issues.
- Strong knowledge of Public Key Infrastructure (PKI) concepts, including certificate authorities, certificate chains, digital certificates, CRLs, OCSP, and cryptographic algorithms.
- Hands-on experience with ServiceNow incident, problem, and change management, certificate workflows and integrations, and CMDB concepts, including certificate-to-CI mapping.
- Strong analytical and problem-solving skills with the ability to validate, cleanse, and maintain high-quality data.
- Proficiency in PowerShell scripting for PKI administration, certificate reporting, operational checks, and automation, with appropriate testing and error handling.
- Clear technical communication, incident ownership, cross-team coordination, and experience mentoring L1/L2 engineers and working with vendors on escalated issues.

Preferred Qualifications

- Experience supporting KeyOn TrueXtender or other enterprise PKI solutions in addition to Microsoft AD CS.
- Experience delivering certificate automation improvements across enterprise applications and transitioning solutions into operational support.
- Familiarity with security standards and frameworks, including NIST, ISO/IEC 27001, and CA/Browser Forum Baseline Requirements.
- Relevant Microsoft, security, or PKI certifications are an advantage.

📌 PKISupport Engineer (India)
🏢 Document IT
📍 India