Senior Security Engineer, PKI, Network Edge

Dentsply Sirona

. Own enterprise DNS security and domain governance, including authoritative and recursive DNS hygiene, DNSSEC, DNS firewalling and filtering, registrar and domain lifecycle controls, and anti-hijacking protections .

Posted 10/14/2026full-timeUnited StatesSenior💰 $187,000 - $198,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in enterprise DNS security, certificate lifecycle management, and WAF engineering, with a strong focus on automation and security posture improvement. Capable of leading complex security initiatives and mentoring engineering teams while ensuring compliance with industry standards.

Highest-signal resume keywords

Enterprise DNS SecurityCertificate Lifecycle ManagementWAF EngineeringSecurity AutomationCybersecurity Engineering

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

DNSSECProtective DNSRPZPKI ManagementTLSInfrastructure-as-CodeTerraformPython ScriptingEdge Security ControlsNetwork Security

Soft Skills

Clear CommunicationMentoring

Tools & Technologies

SIEMSOC OperationsHSM ProtectionACMEAPI Protection

Certifications & Qualifications

CISSPGIAC

Industry Keywords

NIST CSFNIST SP 800-53ISO 27001CybersecurityDomain Governance

Tech Stack

Tools & technologies

CloudCyber SecurityDNSFluxPythonTerraform

About the role

Key responsibilities & impact

Own enterprise DNS security and domain governance, including authoritative and recursive DNS hygiene, DNSSEC, DNS firewalling and filtering, registrar and domain lifecycle controls, and anti-hijacking protections
Design and maintain secure DNS architecture with segmentation, redundancy, and provider resilience
Implement protective DNS, response policy zones, and controls to block malicious resolution and DNS exfiltration
Partner with Security Operations to onboard DNS telemetry and build detections for tunneling, fast-flux, and newly registered or look-alike domains
Own the enterprise certificate and PKI program across issuance, renewal, revocation, discovery, inventory, automation, certificate authorities, trust stores, and cryptographic standards
Design and stand up enterprise private PKI, including CA hierarchy, ACME/EST/SCEP issuance, directory and device-management integrations, HSM protection, root key ceremonies, and custody models
Establish secure code-signing for software and device firmware
Lead WAF policy design, deployment, tuning, OWASP/API protection, rule lifecycle, exceptions, bot mitigation, CDN, and DDoS controls
Serve as a senior escalation point for complex network, edge, DNS, certificate, PKI, and WAF security issues
Define security standards, patterns, and guardrails for network, cloud, and application teams
Automate control enforcement and configuration validation using scripting and infrastructure-as-code
Lead threat modeling and architecture reviews for internet-facing services and major migrations
Define operating models, transition capabilities to Infrastructure, and mentor engineers
Improve security posture, reduce attack surface, prevent certificate-related outages, and ensure high-fidelity SIEM detections

Requirements

What you’ll need

Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field (or equivalent practical experience)
7+ years of progressive experience in cybersecurity engineering, with hands-on experience securing internet-facing infrastructure
3+ years of direct, hands-on experience across two or more of enterprise DNS security, certificate/PKI management, and WAF engineering
Proven experience designing and operating enterprise-scale edge or perimeter security controls
Experience integrating network and edge security platforms with SIEM/SOC operations
Strong knowledge of DNS and DNS security, including DNSSEC, protective DNS, RPZ, and domain/registrar governance
Deep understanding of certificate lifecycle management, PKI, TLS, cryptographic standards, ACME, and certificate discovery tooling
Hands-on WAF engineering experience on an enterprise edge or WAF platform, including rule tuning, OWASP, and API protection
Security automation and infrastructure-as-code using Terraform or equivalent, and scripting using Python or equivalent
Ability to translate risk into pragmatic engineering requirements and communicate clearly with engineering teams and senior leadership
CISSP and/or GIAC certifications relevant to web, network, or defensible architecture preferred
Vendor certifications relevant to edge security, WAF, DNS, or certificate and PKI management preferred
Familiarity with NIST CSF, NIST SP 800-53, or ISO 27001 control frameworks
Must be eligible to work in the country the position is based

Benefits

Comp & perks

Target annual incentive
Accommodation assistance for applicants with disabilities