Senior Certificate Authority ArchitectActive

Define and guide the end-to-end architecture of Cloudflare's public Certificate Authority: a high-assurance, highly available system capable of issuing conventional publicly trusted certificates at Cloudflare scale while supporting Merkle Tree Certificates (MTCs) and the evolution toward a post-quantum Web PKI.

What you'll do

• Define and maintain the end-to-end technical architecture of Cloudflare's: public CA across certificate issuance, key management, transparency, revocation, renewal, and relying-party integration.

• Design root and intermediate CA trust hierarchies, signing systems, HSM: integration, key ceremonies, key rotation, backup, recovery, migration, and key-compromise response.

• Architect secure, resilient, and highly available issuance services capable: of operating at Internet scale and across multiple geographic and failure domains.

• Design certificate lifecycle systems around ACME, domain and IP validation,: CAA, Certificate Transparency, pre-issuance linting, revocation, renewal, and large-scale certificate replacement.

• Integrate Cloudflare’s MTC infrastructure, including CA logs, landmarks,,: cosigning or mirroring, and interactions with relying parties.

• Develop practical architectures for coexistence and migration between: classical X.509 certificates and post-quantum authentication mechanisms.

What they're looking for

• Define trust boundaries, security properties, and threat models covering key: compromise, unauthorized issuance, software supply-chain compromise, operator error, malicious insiders, infrastructure failure, split views, and cryptographic migration.
• Design systems that make CA behavior observable and independently verifiable: through transparency mechanisms, reproducible builds, cryptographic attestations, public operational telemetry, tamper-evident evidence, and audit controls.
• Design failure containment and recovery mechanisms that support safe: certificate replacement, revocation, key rotation, and incident response without creating avoidable Internet availability failures.
• Translate CA/Browser Forum requirements, browser and operating-system: root-program policies, audit criteria, and certification requirements into concrete technical and operational controls.