Senior Software Engineer, KPI – Cryptographic Systems

Cloudflare

. Design and build core PKI systems for certificate lifecycle management, X.509 issuance and validation, key parameter enforcement, and policy engines .

Posted 9/29/2026full-timeAustin • United StatesSenior💰 €66,000 - €83,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in designing and building PKI systems, including certificate lifecycle management and applied cryptography. Proficient in integrating with HSMs and maintaining compliance with industry standards such as CA/Browser Forum and WebTrust.

Highest-signal resume keywords

PKI System DesignApplied CryptographyX.509 KnowledgeSystems Programming in Go, Rust, or C/C++HSM Integration

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Certificate Lifecycle ManagementX.509 Issuance and ValidationKey Ceremony and Key-Lifecycle ToolingACME-Based Issuance and RenewalDatabase Schema DesignSecurity-Hardened System DesignThreat ModellingFIPS 140-2/3 ValidationDistributed Systems FluencyPublic CA Incident Reporting

Soft Skills

Operational Track RecordAbility to Handle High-Consequence WorkMentoring EngineersParticipating in Public DiscourseCollaboration with Product Teams

Tools & Technologies

PKCS#11HSMsPostgresCloudflare Research Applied CryptographySSL/TLS

Industry Keywords

CA/Browser ForumWebTrustRoot Store ProgramCertificate TransparencyIncident Disclosure

Tech Stack

Tools & technologies

Distributed SystemsPostgresRustC++Go

About the role

Key responsibilities & impact

Design and build core PKI systems for certificate lifecycle management, X.509 issuance and validation, key parameter enforcement, and policy engines
Integrate with FIPS 140-2 Level 3 and, where required, Level 4 HSMs through PKCS#11 and vendor-native SDKs
Build key ceremony and key-lifecycle tooling and enforce strict key-usage boundaries
Build and evolve ACME-based issuance and renewal pipelines, short-lived certificate rotation, and revocation mechanisms at global scale
Integrate with Certificate Transparency and build append-only tamper-evident logging and audit evidence pipelines
Maintain compliance with CA/Browser Forum, WebTrust, and root store program frameworks
Adapt to policy changes, participate in public incident disclosure and discourse, and participate in regular third-party audits
Write public CA incident reports and serve as a primary contact with the WebPKI community
Contribute to Cloudflare's post-quantum migration, including post-quantum encryption and authentication
Own code from design through production incident response, including observability, runbooks, and on-call posture
Partner with SSL/TLS product teams, HSM and data-centre infrastructure teams, Cloudflare Research applied cryptography, and adjacent product teams
Mentor engineers, run design reviews, and establish engineering standards, threat models, and secure-development practices

Requirements

What you’ll need

5+ years of production systems software experience
Strong operational track record, including having carried a pager for a critical service
Deep working knowledge of applied cryptography and PKI
Knowledge of X.509, ASN.1/DER, RFC 5280, CRL distribution, Certificate Transparency, ACME, and CA/Browser Forum Baseline Requirements
Familiarity with HSMs, PKCS#11 integration, key ceremonies, key-attestation flows, and FIPS 140-2/3 validation
Strong systems programming background in at least one of Go, Rust, or C/C++
Distributed systems fluency, including globally replicated, availability-critical services with strict correctness guarantees
Experience designing and operating database schemas for high-integrity systems, such as Postgres or equivalent
Security-hardened system design knowledge, including threat modelling, defence in depth, least privilege, and secure key handling
Ability to handle high-consequence work with speed and discipline
Ability to work with Cloudflare's CA/Browser Forum, WebTrust, and root store program compliance requirements
Authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license may be required

Benefits

Comp & perks

Equity plan participation
Medical/Rx Insurance
Dental Insurance
Vision Insurance
Flexible Spending Accounts
Commuter Spending Accounts
Fertility & Family Forming Benefits
On-demand mental health support and Employee Assistance Program
Global Travel Medical Insurance
Short and Long Term Disability Insurance
Life & Accident Insurance
401(k) Retirement Savings Plan
Employee Stock Participation Plan
Flexible paid time off covering vacation and sick leave
Leave programs, including parental, pregnancy health, medical, and bereavement leave