Senior PKI Engineer

Your Opportunity At Schwab, you’re empowered to make an impact on your career. Here, innovative thought meets creative problem solving, helping us “challenge the status quo” and transform the finance industry together.

We believe in the importance of in-office collaboration and fully intend for the selected candidate for this role to work on site in the specified location(s).

At Schwab, you’re empowered to make an impact on your career. Here, innovative thought meets creative problem solving, helping us challenge the status quo and transform the finance industry together. Schwab’s Cybersecurity organization is the first line of defense for the Firm, and the Senior Security Engineer on the Public Key Infrastructure PKI team will play a key role in designing, implementing, and maintaining enterprise PKI controls that reduce risk and support Schwab’s security policies and standards.

We are looking for a senior, hands-on security engineer with strong experience in Public Key Infrastructure, certificate lifecycle management, trust models, automation, and enterprise security engineering. This role will support PKI capabilities across on-prem, SaaS, and IaaS cloud-based environments, with responsibility for managing and improving Certificate Authorities CAs, Registration Authorities RAs, Hardware Security Modules HSMs, and X.509 certificate lifecycle processes across a large enterprise environment.

This is a senior engineering role focused on building reliable, scalable, and automated PKI services that other teams depend on. The right candidate will bring strong technical judgment around certificate lifecycle risks, trust chains, validation, renewal failure modes, and system integrations, while also being able to partner across cybersecurity, infrastructure, application, and engineering teams to deliver secure and reliable PKI solutions.

Architect, deploy, maintain, and enhance enterprise PKI infrastructure, including Certificate Authorities CAs, Registration Authorities RAs, Hardware Security Modules HSMs, and related certificate services. Implement and maintain issuance, renewal, revocation, and lifecycle management processes for digital certificates used by users, servers, applications, services, and devices across the organization. Design and build automation that improves PKI reliability, reduces manual effort, and scales certificate lifecycle management across enterprise environments. Apply PKI, certificate, and trust concepts when designing or reviewing system architectures, platform integrations, authentication flows, access control mechanisms, and security automation. Integrate PKI solutions with security systems, applications, infrastructure platforms, developer workflows, and enterprise technology services. Identify and address trust failures, certificate lifecycle risks, validation gaps, automation issues, and potential sources of outages or security exposure. Conduct security assessments and audits of PKI systems to identify vulnerabilities, operational risks, and opportunities for improvement. Drive complex technical initiatives from design through delivery using cybersecurity practices, software engineering principles, agile delivery methods, and strong stakeholder engagement. Partner closely with Data Protection, Cybersecurity, infrastructure, application, developer, and engineering teams to ensure PKI services meet business, security, and operational needs. Translate technical PKI and trust requirements into practical, repeatable engineering patterns that can be adopted across teams.

What you have Required Qualifications

5+ years of hands-on experience in network security, data security, PKI, certificate management, or other cybersecurity-related controls and technologies. Strong understanding of Public Key Infrastructure PKI principles, including certificate lifecycle management, trust chains, validation, renewal, revocation, and common failure modes.