Senior Software Engineer, PKI & Cryptographic SystemsNew€66K–€83K

Cloudflare
Apply now

The opportunity

TLS is the connective tissue of the Internet, and Cloudflare terminates a large fraction of it. Every day our network handles tens of millions of certificate operations across products like Universal SSL, SSL for SaaS, Origin CA, Cloudflare Access, and Cloudflare Tunnel — and…

What you'll do

  • Design and build core PKI systems: certificate lifecycle management, X.509 issuance and validation logic, key parameter enforcement, and policy engines aligned with industry standards including CA/Browser Forum guidance and browser root program policies.

  • Own the cryptographic core. Integrate with FIPS 140-2 Level 3 (and, where: required, Level 4) HSMs via PKCS#11 and vendor-native SDKs; build key ceremony and key-lifecycle tooling; enforce strict key-usage boundaries in code.

  • Automate at scale. Build and evolve ACME-based issuance and renewal: pipelines, short-lived certificate rotation, and revocation mechanisms that serve at Cloudflare’s global scale.

  • Instrument transparency and audit trails. Integrate with Certificate: Transparency, build append-only tamper-evident logging, and design evidence pipelines that hold up to rigorous third-party audit.

  • Maintain accreditation and respond to a changing compliance landscape. PKI: operations must maintain compliance under CA/B Forum, WebTrust, and root store program frameworks. You will be aware of, and adapt to, changes in relevant policies, participate in public incident disclosure and discourse, and participate in regular third-party audits.

  • Represent Cloudflare in the WebPKI community. Write public CA incident: reports and serve as a primary contact with the WebPKI community; clear technical writing is core to this role.

What they're looking for

  • Ship the post-quantum future. Contribute to Cloudflare’s ongoing: post-quantum migration — including work on post-quantum encryption and authentication — so that Cloudflare’s cryptographic infrastructure stays ahead of the transition.
  • Own code end-to-end from design through production incident response.: Cryptographic infrastructure cannot silently fail; you will build the observability, runbooks, and on-call posture that keep the service inside SLO.
  • Partner across the org: with the SSL/TLS product teams, the HSM and data-centre infrastructure teams, the Cloudflare Research applied cryptography group, and adjacent product teams that consume PKI as a platform.
  • Raise the bar. Mentor other engineers joining an early-stage team, run: design reviews, and establish the engineering standards, threat models, and secure-development practices this team will operate under for years.