22587-Cybersecurity Infrastructure SpecialistMettler Toledo

PKI & Certificate Lifecycle ManagementLifecycle Automation: Own the end-to-end lifecycle (request, issuance, validation, deployment, renewal, and revocation) of all digital certificates, including SSL/TLS, SSH keys, and code-signing certificates. CA & Microsoft PKI Governance: Maintain, audit, and optimize internal and external Certificate Authorities (CAs) to ensure absolute compliance with global cryptographic standards and corporate security policies. Oversee the comprehensive management of Microsoft PKI, including Certificate Revocation Lists (CRL), Online Certificate Status Protocol (OCSP), WebCA deployment, and SCEP/NDES integration with Microsoft Intune. Certificate Management Environments: Operate and scale enterprise Certificate Management Environments to track, monitor, and remediate expiring or non-compliant certificates, successfully preventing operational outages. ACME Protocol Management: Comprehend the deep underpinnings of the ACME protocol, managing its associated configuration, deployment, and the secure revocation of the service. Hardware Security Module (HSM) Operations: Manage and maintain Luna Network HSM solutions. Direct key management operations within network HSM environments and demonstrate a firm understanding of HSM Partition functionality versus HSM Keyring functionality across High Availability (HA) and Cluster environments. Privileged Access Management (PAM)Platform Governance & JIT Adoption: Manage and optimize core enterprise tier-1 PAM solutions. Drive the engineering adoption of Just-in-Time (JIT) provisioning, secure remote access, privilege containment, and zero-standing privilege workflows across the ecosystem. Identity Lifecycle Automation: Supervise privileged account onboarding/offboarding and birthright access roles, while utilizing discovery checklists to identify unmanaged credentials and third-party accounts. Collaborate with architecture teams to implement automated self-service capabilities via identity governance (e.g.: Saviynt) and IT service management platform integrations (e.g., ServiceNow). Secrets & Server owners/Application Owners: Secure the engineering footprint by enforcing automatic password rotation policies, defining practices for secure PowerShell scripting, and eliminating hardcoded or un-hashed system passwords across cloud workloads and containerized systems. Enforce password complexity rules and automated credential rotation immediately after use. Change Control & Infrastructure Maintenance: Act as the internal escalation point for platform engineering health alerts, platform monitoring anomalies, software patching, and major environment upgrades. Coordinate infrastructure changes with business stakeholders and the Change Advisory Board (CAB) using established systems of record. Audit, Compliance & SOC Integration: Configure session recording, isolation, and logging capabilities to provide a centralized view of privileged access. Utilize these detective controls to satisfy global governance frameworks (such as PCI-DSS v4.0 and SOX), regional compliance mandates (such as the China Cybersecurity Law), and operational root-cause analysis (RCA). Partner with the SOC to integrate PAM telemetry for enhanced tracking of malicious activity. DevSecOps & CI/CD Pipeline IntegrationSecure Pipeline Injection: Collaborate tightly with the AppSec and DevOps teams to seamlessly inject automated certificate management, token management, and cryptographic vaulting natively into our software deployment pipelines (such as Azure DevOps or GitHub Actions).