Senior Certificate Authority Architect

What you'll do

• Define the end-to-end technical architecture for Cloudflare's public Certificate Authority, including key management and issuance.
• Design root and intermediate CA trust hierarchies, HSM integrations, and key rotation ceremonies.
• Architect highly available issuance services capable of operating at Internet scale across multiple geographic domains.
• Design certificate lifecycle systems for ACME, domain validation, Certificate Transparency, and large-scale replacements.
• Integrate Merkle Tree Certificate (MTC) infrastructure and develop architectures for post-quantum authentication migration.
• Define threat models and security properties covering key compromise, unauthorized issuance, and infrastructure failures.
• Design systems for independent verifiability through transparency mechanisms, reproducible builds, and audit controls.
• Translate CA/Browser Forum requirements and root-program policies into concrete technical and operational controls.

What we're looking for

• Substantial experience designing or operating security-critical systems.
• Deep expertise in at least one area: public Certificate Authorities, Web PKI, applied cryptography, TLS, Certificate Transparency, hardware-backed key management, or large-scale distributed security systems.
• Strong knowledge of certificate trust chains, issuance, validation, revocation, and key lifecycle management.
• Experience defining system trust boundaries, threat models, security invariants, and failure-handling strategies.
• Experience leading architecture across multiple engineering teams without relying solely on organizational authority.
• Strong written and verbal communication skills to explain cryptographic and architectural tradeoffs to diverse stakeholders.
• Ability to operate with substantial autonomy in an evolving technical and policy environment.
• Authorization to receive software or technology controlled under U.S. export control laws.