Senior Certificate Authority Architect

📋 Description

• Define and maintain the end-to-end technical architecture of Cloudflare's public CA across
• Design root and intermediate CA trust hierarchies, signing systems, HSM integration, key
• Architect secure, resilient, and highly available issuance services capable of operating at
• Design certificate lifecycle systems around ACME, domain and IP validation, CAA, Certificate
• Integrate Cloudflare's MTC infrastructure, including CA logs, landmarks, cosigning or mirroring
• Develop practical architectures for coexistence and migration between classical X.509 certificates

🎯 Requirements

• Substantial experience designing or operating security-critical systems, with deep expertise in at
• Strong knowledge of certificate trust chains, issuance and validation, revocation, key lifecycle
• Experience defining system trust boundaries, threat models, security invariants, and
• Ability to reason about systems in which a subtle architectural or operational mistake can affect a
• Experience leading architecture across multiple engineering teams without relying solely on
• Strong written and verbal communication, including the ability to explain cryptographic and

🎁 Benefits

• Mission to help build a better Internet
• Protecting the free and open Internet
• Project Galileo: equipping journalism and civil society organizations with tools to defend against
• Athenian Project: providing protection and reliability for state and local government election
• 1.1.1.1: building a faster, more secure and privacy-centric public DNS resolver
• Equal opportunity employer