Cloudflare
Senior Certificate Authority Architect
Hybrid +1 · Senior · Full-time · Posted Oct 9, 2026
- Location
- Hybrid
Austin, TX, United States - Experience
- Substantial experience required; no number of years stated.
- Visa sponsorship
- An offer may be conditioned on authorization to receive technology controlled under U.S. export laws without sponsorship for an export license.
About the job
Define and guide the architecture of Cloudflare’s public Certificate Authority, enabling secure, reliable certificate issuance at Internet scale and a transition toward post-quantum Web PKI.
What you'll do
- Design CA architecture for issuance, key management, transparency, revocation, renewal, and relying-party integration.
- Establish trust hierarchies, security controls, threat models, and resilient recovery and incident-response systems.
- Lead architecture across teams and contribute to standards and industry work on Web PKI and post-quantum authentication.
What they ask for
- Substantial experience designing or operating security-critical systems, with deep expertise in at least one listed area such as public CAs, Web PKI, applied cryptography, TLS, Certificate Transparency, hardware-backed key management, or distributed security systems.
- Strong knowledge of certificate trust chains, issuance and validation, revocation, and key lifecycle management.
- Experience defining trust boundaries, threat models, security invariants, and failure-handling strategies.
- Experience leading architecture across multiple engineering teams.
Tools
ACME, HSM, Certificate Transparency, X.509, Merkle Tree Certificates (MTCs), TLS, CAA
AI focus
The posting describes an AI-native culture and encourages using AI tools to build and ship solutions; no specific AI work is stated for this role.
Model-written summary · the original posting is authoritative