Senior Software Engineer, PKI & Cryptographic Systems

About the role

Locations and working arrangement

• Available locations are Austin, London, or Lisbon; the posting specifies hybrid work.

Responsibilities

• Design PKI systems for certificate lifecycle management, X.509 issuance and validation, key parameters, and policy engines aligned with industry standards.
• Integrate with FIPS-validated HSMs, build key ceremony and key lifecycle tooling, and enforce key-usage boundaries in code.
• Build ACME issuance and renewal pipelines, short-lived certificate rotation, and global-scale revocation mechanisms.
• Integrate Certificate Transparency, tamper-evident logging, and audit evidence pipelines.
• Maintain compliance with CA/Browser Forum, WebTrust, and root store frameworks; adapt to policy changes and participate in third-party audits.
• Write public CA incident reports and serve as a primary contact with the WebPKI community.
• Contribute to the post-quantum migration, including encryption and authentication work.
• Own code through production incident response; build observability, runbooks, and on-call practices to maintain SLOs.
• Partner with SSL/TLS product, HSM, data-centre infrastructure, research, and adjacent product teams.
• Mentor engineers, lead design reviews, and establish standards, threat models, and secure-development practices.

Desirable skills, knowledge, and experience

• The posting lists 5+ years of production systems software experience and a strong operational track record as desirable.
• Desirable PKI and cryptography knowledge includes X.509, ASN.1/DER, RFC 5280, CRLs, Certificate Transparency, ACME, and CA/Browser Forum requirements.
• Desirable HSM familiarity includes PKCS#11, key ceremonies, key attestation, and understanding of FIPS validation in production.
• A strong systems programming background in at least one of Go, Rust, or C/C++ is listed as desirable.
• Distributed systems experience operating globally replicated, availability-critical services is listed as desirable.
• Database schema experience for high-integrity systems, security-hardened design, threat modeling, defense in depth, least privilege, and secure key handling are listed as desirable.
• The description emphasizes careful judgment for high-consequence work; clear technical writing is core to the role.

Bonus points

• Bonus experience includes work with a public or private CA or large-scale PKI, PKI codebases, WebTrust audits, or post-quantum cryptography.
• Other bonuses include browser trust proposals, participation in standards or root-program groups, offline key ceremonies, Certificate Transparency infrastructure, formal methods, fuzzing, property-based testing, and Kubernetes.

Compensation

• For Portugal-based hires, estimated annual salary is €66,000–€83,000.
• The role is eligible for Cloudflare's equity plan.

Benefits

• Cloudflare describes health, welfare, financial, and time-off benefits; the listed benefits are for U.S. employees and may vary outside the U.S.