Sr. Engineer, PKI & Identity Infrastructure

What To Expect We are seeking a Senior Engineer with deep expertise in Public Key Infrastructure (PKI), Key Management Services (KMS), Hardware Security Modules (HSM), and Identity and Access Management (IAM) platforms. The ideal candidate has a strong background operating enterprise PKI (EJBCA and/or Active Directory Certificate Services (ADCS)), key management and HSM services, and infrastructure access platforms such as Teleport, along with hands-on experience managing digital certificates, symmetric and asymmetric keys, and related security technologies. In this role, you will own the design, implementation, and evolution of our encryption and identity infrastructure, including enterprise certificate authorities, the Teleport access platform (database, Kubernetes, Linux, and application access), cloud and HSM-backed key management, and the integration of PKI with IAM systems. You will ensure secure identity management, access, and encryption across the organization while maintaining high availability, auditability, and compliance. As a Senior Engineer, you will set technical direction for these platforms, lead cross-functional initiatives from design to production, mentor engineers, and represent the team in vendor, architecture, and leadership discussions. What You'll Do Own enterprise PKI architecture and operations (CA hierarchy, issuance/revocation policy, HA/scale) on EJBCA and/or ADCSOperate and scale Teleport for secure access to databases, Kubernetes, Linux hosts, and applications (RBAC, access requests, SSO, WebAuthn/passkeys, mTLS, audit)Design and operate key management at scale (hierarchies, envelope encryption, rotation) across cloud KMS and HSM-backed services for encryption and signing use casesManage production HSMs: key ceremonies, token provisioning/rotation, clustering/failover, FIPS 140-2/140-3 posture, and crypto DROwn digital certificate lifecycle at fleet scale, including automated issuance (e.g., ACME), renewal, and revocationIntegrate PKI and access platforms with IAM (Active Directory, Entra ID, and other IdPs) for authentication, authorization, and encryption workflowsImplement strong access control patterns (RBAC/ABAC, zero-trust access, mTLS/SPIFFE where applicable) with partner security teamsBuild automation and platform engineering for cert/key lifecycle using Python and/or PowerShell, CI/CD, and GitOpsOwn monitoring, compliance, and incident response for PKI/KMS/HSM/Teleport (Splunk/Grafana observability, audits, 24/7 on-call, postmortems)Lead and mentor: set standards/runbooks, drive cross-functional delivery, and manage vendor relationships (e.g., Thales, DigiCert, Teleport, SailPoint) What You'll Bring Degree in Computer Science, Information Security, or related field; or equivalent experience8+ years in security infrastructure, including 5+ years focused on enterprise PKI and IAMProven experience designing and operating enterprise PKI with EJBCA and/or ADCS (hierarchy, policy, revocation, scale)Production experience with key management at scale (AWS KMS, Azure Key Vault, or equivalent, and/or HSM-backed services), including rotation and lifecycleExperience managing HSMs (Thales, Entrust, or equivalent), including FIPS environments, key ceremonies, and clustering/failoverExperience operating Teleport or a comparable infrastructure access / zero-trust platform (DB/K8s/Unix access with mTLS, RBAC, audit)Strong PKI fundamentals plus IAM platform experience (AD, Entra ID) and identity protocols (SAML, OIDC, OAuth, Kerberos)Proficiency in PowerShell and/or Python for PKI/KMS/access automation; experience with CI/CD (GitOps preferred)Experience supporting 24/7 global mission-critical environments; cloud/hybrid security experience preferred (Kubernetes a plus)Track record leading cross-functional security initiatives and mentoring engineers, with strong stakeholder communication and documentation skills Benefits Compensation and Benefits Along with competitive pay, as a full-time Tesla employee, you are eligible for the following benefits at day 1 of hire: Medical plans > plan options with $0 payroll deduction Family-building, fertility, adoption and surrogacy benefits Dental (including orthodontic coverage) and vision plans, both have options with a $0 paycheck contribution Company Paid (Health Savings Accounts) HSA Contribution when enrolled in the High-Deductible medical plan with HSA Healthcare and Dependent Care Flexible Spending Accounts (FSA) 401(k) with employer match, Employee Stock Purchase Plans, and other financial benefits Company paid Basic Life, AD&D Short-term and long-term disability insurance (90 day waiting period) Employee Assistance Program Sick and Vacation time (Flex time for salary positions, Accrued hours for Hourly positions), and Paid Holidays Back-up childcare and parenting support resources Voluntary benefits to include: critical illness, hospital indemnity, accident insurance, theft & legal services, and pet insurance Weight Loss and Tobacco Cessation Programs Tesla Babies program Commuter benefits Employee discounts and perks program Expected Compensation $140,000 - $252,000/annual salary + cash and stock awards + benefits Pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. The total compensation package for this position may also include other elements dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment. , Tesla