Senior Software Engineer, PKI & Cryptographic Systems

Stack

Responsibilities

• ▹Design and build core PKI systems: certificate lifecycle management, X.509 issuance and validation logic, key parameter enforcement and policy engines aligned with industry standards including CA/Browser Forum guidance and browser root program policies
• ▹Own the cryptographic core: integrate with FIPS 140-2 Level 3 (and, where required, Level 4) HSMs via PKCS#11 and vendor-native SDKs, build key ceremony and key-lifecycle tooling, enforce strict key-usage boundaries in code
• ▹Build and evolve ACME-based issuance and renewal pipelines, short-lived certificate rotation and revocation mechanisms at Cloudflare's global scale
• ▹Integrate with Certificate Transparency, build append-only tamper-evident logging and design evidence pipelines that hold up to rigorous third-party audit
• ▹Maintain accreditation under CA/B Forum, WebTrust and root store program frameworks, including public incident disclosure and regular third-party audits
• ▹Represent Cloudflare in the WebPKI community: write public CA incident reports and serve as a primary contact
• ▹Contribute to Cloudflare's post-quantum migration, including post-quantum encryption and authentication
• ▹Own code end-to-end from design through production incident response, building the observability, runbooks and on-call posture that keep the service inside SLO
• ▹Partner with the SSL/TLS product teams, the HSM and data-centre infrastructure teams, the Cloudflare Research applied cryptography group and adjacent product teams that consume PKI as a platform
• ▹Mentor other engineers, run design reviews and establish the engineering standards, threat models and secure-development practices of the team

Requirements

• ▹5+ years of production systems software experience with a strong operational track record, including carrying a pager
• ▹Deep working knowledge of applied cryptography and PKI: X.509, ASN.1/DER, RFC 5280, CRL distribution, Certificate Transparency, ACME and the CA/Browser Forum Baseline Requirements
• ▹Familiarity with HSMs: PKCS#11 integration, key ceremonies, key-attestation flows and what FIPS 140-2/3 validation means in production
• ▹Strong systems programming background in at least one of Go, Rust or C/C++
• ▹Distributed systems fluency: building or operating globally replicated, availability-critical services with strict correctness guarantees
• ▹Experience designing and operating database schemas for high-integrity systems (Postgres or equivalent)
• ▹Security-hardened system design instincts: threat modelling, defence in depth, least privilege and secure key handling
• ▹The temperament for high-consequence work: a mis-issued or mis-revoked certificate is a public, industry-visible event

Nice to have

• ▹Direct experience working on or with a publicly-trusted or private CA, or a large-scale internal PKI (Let's Encrypt/Boulder, Google Trust Services, DigiCert, Sectigo, ISRG, Entrust, Microsoft PKI, HashiCorp Vault PKI, step-ca, CFSSL)
• ▹Experience with crypto/x509, BoringSSL, OpenSSL/AWS-LC, CFSSL or an equivalent PKI codebase
• ▹Experience with WebTrust for CAs / WebTrust BR / WebTrust Network Security audit engagements
• ▹Familiarity with post-quantum cryptography: ML-DSA, ML-KEM, hybrid signature schemes and the state of PQ signature standardisation
• ▹Familiarity with emerging browser trust-establishment proposals (e.g. Merkle Tree Certificates)
• ▹Participation in the CA/Browser Forum, IETF LAMPS/TLS/PLANTS/PQUIP working groups, the transparency.dev community or a browser root program review
• ▹Experience running or automating offline key ceremonies
• ▹Experience operating Certificate Transparency log infrastructure or CT monitoring at scale
• ▹Familiarity with formal methods, differential fuzzing or property-based testing for cryptographic protocol code
• ▹Kubernetes experience

Soft skills

What we offer

• ▹For Portugal-based hires: estimated annual salary of €66,000 - €83,000
• ▹Eligibility for Cloudflare's equity plan
• ▹Comprehensive benefits package: medical, dental and vision insurance, flexible spending accounts, fertility and family forming benefits, mental health support and Employee Assistance Program, global travel medical insurance (as described for US employees; benefits may vary elsewhere)
• ▹Short and long term disability insurance, life and accident insurance, 401(k) retirement savings plan, employee stock participation plan
• ▹Flexible paid time off, including parental, pregnancy health, medical and bereavement leave

About the company

Cloudflare runs one of the world's largest networks, accelerating and protecting millions of websites from individual bloggers to Fortune 500 companies. Its mission is to help build a better Internet.