Sr. Software Engineer, Public Key Infrastructure at Tesla · Austin

We are seeking a Senior Engineer with deep expertise in Public Key Infrastructure (PKI), Key Management Services (KMS), Hardware Security Modules (HSM), and Identity and Access Management (IAM) platforms. The ideal candidate has a strong background operating enterprise PKI (EJBCA and/or Active Directory Certificate Services (ADCS)), key management and HSM services, and infrastructure access platforms such as Teleport, along with hands-on experience managing digital certificates, symmetric and asymmetric keys, and related security technologies.

In this role, you will own the design, implementation, and evolution of our encryption and identity infrastructure, including enterprise certificate authorities, the Teleport access platform (database, Kubernetes, Linux, and application access), cloud and HSM-backed key management, and the integration of PKI with IAM systems. You will ensure secure identity management, access, and encryption across the organization while maintaining high availability, auditability, and compliance.

As a Senior Engineer, you will set technical direction for these platforms, lead cross-functional initiatives from design to production, mentor engineers, and represent the team in vendor, architecture, and leadership discussions.

Responsibilities

• Own enterprise PKI architecture and operations (CA hierarchy, issuance/revocation policy, HA/scale) on EJBCA and/or ADCS
• Operate and scale Teleport for secure access to databases, Kubernetes, Linux hosts, and applications (RBAC, access requests, SSO, WebAuthn/passkeys, mTLS, audit)
• Design and operate key management at scale (hierarchies, envelope encryption, rotation) across cloud KMS and HSM-backed services for encryption and signing use cases
• Manage production HSMs: key ceremonies, token provisioning/rotation, clustering/failover, FIPS 140-2/140-3 posture, and crypto DR
• Own digital certificate lifecycle at fleet scale, including automated issuance (e.g., ACME), renewal, and revocation
• Integrate PKI and access platforms with IAM (Active Directory, Entra ID, and other IdPs) for authentication, authorization, and encryption workflows
• Implement strong access control patterns (RBAC/ABAC, zero-trust access, mTLS/SPIFFE where applicable) with partner security teams
• Build automation and platform engineering for cert/key lifecycle using Python and/or PowerShell, CI/CD, and GitOps
• Own monitoring, compliance, and incident response for PKI/KMS/HSM/Teleport (Splunk/Grafana observability, audits, 24/7 on-call, postmortems)
• Lead and mentor: set standards/runbooks, drive cross-functional delivery, and manage vendor relationships (e.g., Thales, DigiCert, Teleport, SailPoint)

Requirements

• Degree in Computer Science, Information Security, or related field; or equivalent experience
• 8+ years in security infrastructure, including 5+ years focused on enterprise PKI and IAM
• Proven experience designing and operating enterprise PKI with EJBCA and/or ADCS (hierarchy, policy, revocation, scale)
• Production experience with key management at scale (AWS KMS, Azure Key Vault, or equivalent, and/or HSM-backed services), including rotation and lifecycle
• Experience managing HSMs (Thales, Entrust, or equivalent), including FIPS environments, key ceremonies, and clustering/failover
• Experience operating Teleport or a comparable infrastructure access / zero-trust platform (DB/K8s/Unix access with mTLS, RBAC, audit)
• Strong PKI fundamentals plus IAM platform experience (AD, Entra ID) and identity protocols (SAML, OIDC, OAuth, Kerberos)
• Proficiency in PowerShell and/or Python for PKI/KMS/access automation; experience with CI/CD (GitOps preferred)
• Experience supporting 24/7 global mission-critical environments; cloud/hybrid security experience preferred (Kubernetes a plus)
• Track record leading cross-functional security initiatives and mentoring engineers, with strong stakeholder communication and documentation skills

Compensation and benefits