About the company
Cloudflare runs one of the world's largest networks, powering millions of websites and Internet properties. The team is investing in the next generation of PKI and cryptographic infrastructure.
Responsibilities
- Design and build core PKI systems: certificate lifecycle management, X.509 issuance and validation, key parameter enforcement, policy engines aligned with CA/Browser Forum guidance
- Integrate with FIPS 140-2 Level 3 (and Level 4) HSMs via PKCS#11 and vendor-native SDKs; build key ceremony and key-lifecycle tooling
- Build and evolve ACME-based issuance and renewal pipelines, short-lived certificate rotation, and revocation mechanisms
- Integrate with Certificate Transparency, build append-only tamper-evident logging, and design evidence pipelines for third-party audits
- Maintain compliance under CA/B Forum, WebTrust, and root store program frameworks
- Contribute to post-quantum migration including post-quantum encryption and authentication
- Own code end-to-end from design through production incident response
- Partner with SSL/TLS product teams, HSM and data-centre infrastructure teams, and Cloudflare Research
- Mentor engineers, run design reviews, establish engineering standards and threat models
Requirements
- 5+ years of production systems software experience with strong operational track record
- Deep working knowledge of applied cryptography and PKI: X.509, ASN.1/DER, RFC 5280, CRL distribution, Certificate Transparency, ACME, CA/Browser Forum Baseline Requirements
- Ability to reason precisely about certificate profiles, key parameters, and issuance policy
Conditions
- Hybrid work in Austin, London, or Lisbon