Senior Certificate Authority Architect
Core
Define and guide the end-to-end architecture of Cloudflare's public Certificate Authority, a high-assurance, highly available system for issuing conventional and post-quantum certificates at Internet scale.
Role type
Senior IC security architect (public CA/Web PKI)
Builds
A public Certificate Authority operating safely at Internet scale with support for Merkle Tree Certificates (MTCs) and post-quantum authentication.
Domain
Internet security, applied cryptography, Web PKI, distributed systems, compliance.
Required skills
public Certificate Authority design, Web PKI, applied cryptography, TLS and Internet security protocols, Certificate Transparency, hardware-backed key management, large-scale distributed security systems, system trust boundaries, threat modeling, failure-handling strategies, architectural leadership, technical communication.
Preferred skills
experience leading architecture across multiple engineering teams, operating with substantial autonomy in evolving policy environments.
Technologies
X.509, Merkle Tree Certificates (MTCs), ACME, Certificate Transparency, HSM, CA/Browser Forum standards.
Responsibilities
Define and maintain end-to-end technical architecture for certificate issuance, key management, transparency, revocation, and relying-party integration; Design root and intermediate CA trust hierarchies, signing systems, HSM integration, key ceremonies, rotation, backup, recovery, and key-compromise response; Architect secure, resilient, and highly available issuance services; Design certificate lifecycle systems around ACME, domain/IP validation, CAA, and large-scale certificate replacement; Integrate MTC infrastructure including CA logs, landmarks, cosigning, and interactions with relying parties; Develop architectures for coexistence and migration between X.509 and post-quantum mechanisms; Define trust boundaries, security properties, and threat models; Design systems for observability and independent verification via transparency and audit controls; Design failure containment and recovery mechanisms; Translate CA/Browser Forum requirements into technical and operational controls; Review protocols and implementations with an adversarial mindset; Provide architectural direction and mentorship to engineering teams; Represent Cloudflare in standards and industry work.
Seniority
Senior, hands-on IC with architectural leadership.
