Description
We are seeking a Principal Engineer to design, build, automate, and improve GSK's enterprise certificate services. As a senior individual contributor, you will report to the Lead, PKI, and translate approved architecture, security standards, and service priorities into secure, resilient production capabilities.
Key Responsibilities:
- Design, build, configure, and maintain enterprise certificate authority and registration authority services.
- Engineer secure certificate issuance, renewal, revocation, and recovery processes for users, devices, applications, and workloads.
- Automate certificate discovery, inventory, issuance, renewal, revocation, and reporting using APIs, scripting, infrastructure as code, and enterprise certificate lifecycle management platforms.
- Integrate PKI with Microsoft and Linux platforms, network and security devices, cloud services, DevOps pipelines, applications, mobile and endpoint management platforms, and operational technology environments.
- Implement certificate profiles, templates, and policy controls in line with approved architecture, Certificate Policy and Certification Practice Statement requirements, security standards, and cryptographic requirements.
- Monitor service health, capacity, availability, certificate expiry, issuance quality, and control effectiveness; define actionable alerting and operational thresholds; and remediate vulnerabilities, performance constraints, or configuration drift.
- Troubleshoot complex certificate, trust-chain, revocation, protocol, and interoperability issues and provide technical leadership during incidents.
- Plan and execute upgrades, migrations, key ceremonies, backup and restoration validation, disaster recovery tests, and service improvements with appropriate change, security, and evidence controls.
- Produce and maintain engineering designs, build documentation, runbooks, test evidence, and integration guidance.
- Partner with the PKI Lead, operations, architecture, security, audit, application teams, and service partners; mentor engineers; review technical designs and changes; and communicate engineering risks, dependencies, and recommendations to technical and non-technical stakeholders.
Basic Qualifications:
- Degree in a relevant discipline, or equivalent practical experience.
- At least five years of hands-on experience engineering and supporting enterprise PKI or certificate lifecycle services, including responsibility for production design, implementation, troubleshooting, and continuous improvement.
- Strong knowledge of X.509 certificates, certificate chains and path validation, enrollment, revocation, OCSP, CRLs, key management, cryptographic algorithms, and core PKI security principles.
- Practical experience with Microsoft Active Directory Certificate Services or a comparable enterprise certificate authority platform.
- Experience integrating certificates with Windows, Linux, network devices, applications, or cloud services, including relevant dependencies on Active Directory, DNS, privileged access, and service identities.
- Ability to automate technical processes using PowerShell, Python, APIs, or infrastructure-as-code tooling.
- Experience diagnosing complex production issues and implementing sustainable corrective actions.
- Strong documentation, collaboration, and communication skills in a global engineering environment.
Preferred Qualifications:
- Experience with certificate lifecycle management platforms and automated enrollment protocols such as SCEP, EST, or ACME.
- Experience with hardware security modules, protected key operations, and formal key ceremonies.
- Knowledge of cloud-native certificate services and workload identity patterns in Azure, AWS, or Google Cloud.
- Experience supporting device, network, operational technology, or code-signing certificate use cases.
- Familiarity with cryptographic standards, audit controls, and regulated-industry requirements.
- Relevant certification in Microsoft, cloud, security, or PKI technologies.