PKI Engineer

At Landis+Gyr, we're helping shape the future of energy-making it more intelligent, resilient, and sustainable.

As a global energy technology leader, we're accelerating the energy evolution through purposeful innovation and trusted partnerships. Trusted by more than 2,000 utilities worldwide, our intelligent solutions connect devices, data, and decisions across the grid, helping customers modernize infrastructure, optimize operations, and deliver energy that is more reliable, resilient, accessible, safe, and sustainable.

Behind every solution is a team of approximately 3,300 employees across more than 40 countries who are passionate about solving complex challenges, driving innovation, and making a meaningful impact for our utility customers and the communities they serve.

Join Team Green and help shape the future of intelligent energy.

Job Summary

The Security PKI Engineer exists to operate and support the companies symmetric and asymmetric encryption solutions and offerings. This person will have responsibility for the Global PKI Program, including enforcing global PKI policies and procedures, supporting a global PKI environment, and working with development and support teams to ensure PKI services are utilized appropriately and are available. This person is also responsible for supporting other key and secret services, including Cloud based key and secret policies, procedures, and solutions globally.

Key Responsibilities

• Design, implement, administer, and support enterprise Public Key Infrastructure (PKI) solutions, including Microsoft AD CS, EJBCA, and cloud-based PKI services.
• Manage the complete certificate lifecycle, including certificate discovery, enrolment, issuance, renewal, revocation, replacement, validation, and reporting across internal, external, customer, manufacturing, and cloud environments.
• Support and maintain Certificate Lifecycle Management (CLM) platforms such as Keyfactor, Venafi, AppViewX, or equivalent solutions.
• Implement and maintain certificate automation using ACME, EST, SCEP, REST APIs, PowerShell, Python, and other automation frameworks.
• Manage public certificate services, including Domain Validation (DV), Organization Validation (OV), Extended Validation (EV), code-signing certificates, and public trust relationships.
• Perform certificate discovery and inventory assessments across servers, applications, cloud environments, load balancers, network devices, containers, and DevOps platforms.
• Troubleshoot and resolve complex PKI, certificate chain, TLS/SSL, code-signing, cryptographic, OCSP, CRL, and trust-store related issues.
• Develop and maintain PKI architecture standards, certificate policies, lifecycle processes, operational runbooks, and governance documentation.
• Collaborate with infrastructure, cloud, application, DevOps, IAM, and security teams to deploy and maintain secure cryptographic solutions.
• Support disaster recovery exercises, PKI operational readiness reviews, backup validation, key ceremonies, and business continuity requirements.
• Conduct cryptographic risk assessments and identify weak algorithms, unmanaged certificates, and non-compliant cryptographic implementations.
• Participate in PKI modernization initiatives, including CLM migrations, PKI platform upgrades, cloud PKI adoption, and post-quantum cryptography readiness activities.
• Participate in operational support and on-call rotations for critical PKI, certificate, and cryptographic service incidents.

Company Values

• Supports and adheres to Company's core values.
• Performs other duties or responsibilities as assigned or required.
• Supports and adheres to Company's Code of Conduct and Ethics Policy.
• Represents Company in a positive, professional manner when working with both internal and external customers.

Education & Experience

• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent knowledge /training.
• 5+ years of hands-on experience in PKI, Certificate Management, Cryptography, Infrastructure Security, or a related cybersecurity domain.
• Experience administering enterprise PKI environments and Certificate Lifecycle Management platforms.
• Experience with public certificate authorities, code-signing certificates, and certificate automation frameworks.
• Preferred certifications: CISSP, CISM, Microsoft Security Certifications, Keyfactor Certified Professional, or equivalent.

Preferred Qualifications

• Strong understanding of Public Key Infrastructure (PKI), cryptography, certificate trust models, X.509 certificates, TLS/SSL, PKCS standards, CRL, OCSP, and cryptographic key management.
• Hands-on experience with enterprise PKI platforms such as Microsoft AD CS, EJBCA, Entrust, DigiCert, and Certificate Lifecycle Management solutions including Keyfactor, Venafi, or AppViewX.
• Experience managing certificate lifecycle operations, including issuance, renewal, revocation, discovery, validation, automation, and public certificate services.
• Strong knowledge of Windows/Linux environments, Active Directory, LDAP, DNS, web servers, load balancers, and cloud-native certificate services.
• Experience with Azure, AWS, or GCP certificate and key management services.
• Proficiency in automation and scripting using PowerShell, Python, Bash, REST APIs, ACME, SCEP, EST, and CI/CD integrations.
• Ability to troubleshoot complex PKI, TLS/SSL, certificate chain, code-signing, and cryptographic issues across enterprise environments.
• Experience developing operational procedures, runbooks, standards, compliance documentation, and audit support activities.
• Strong analytical, problem-solving, communication, and stakeholder management skills.

Working Conditions/Physical Requirements

• Working Conditions: Typical indoor office environment with the majority of time spent sitting and working on a computer using keyboard, mouse, and monitor. Occasional use of other devices such as: phone, copier/printer/fax, etc.
• Physical Requirements: Typical office setting. Required to stand; walk; crouch; or handle objects. Lift and/or move up to 10 pounds. Ability to sit and view computer screen for long periods of time. The ability to see, hear, & speak in English. Reasonable accommodation is provided for individuals with disabilities to perform the essential functions.
• Personal Protection Equipment/Other OHSAS Safety Requirements: Ensure the continued efforts and assist in achieving annual goals of health, safety, and environmental policies. Must be current with available OSHA/Safety Training provided by the Company. If required, must be able to work while wearing safety equipment such as hard hats, work boots, gloves, hearing protection, and others.

As a part of the Landis+Gyr family, employees are offered a comprehensive and competitive package of benefits including medical, dental and vision coverage, life insurance, and a 401(k)-retirement plan featuring a generous company match incentive. Additionally, we offer three (3) weeks of Paid Time Off (PTO) as well as eleven (11) paid holidays. We also offer a tuition reimbursement program, optional pet insurance, supplemental medical coverage and a host of other perks to ensure the health, wellness, and enrichment of our team members.

Pay is in the range of $111,200 - $147,725 per year. The actual base salary offered depends on a variety of factors, which may include, as applicable, the qualifications of the individual applicant for the position, years of relevant experience, specific and unique skills, level of education attained, and certifications or other professional licenses held. All candidates are encouraged to apply.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

We're committed to shaping a better future for everyone. Join Team Green and be part of what's next in energy. #TeamGreen