Sr. Engineer, PKI & Identity Infrastructure Tesla Motors, Inc. 140000 - 252000 USD paid holidays, flex time, 401(k) United States, California, Palo Alto Sep 25, 2026

What to Expect

We are seeking a Senior Engineer with deep expertise in Public Key Infrastructure (PKI), Key Management Services (KMS), Hardware Security Modules (HSM), and Identity and Access Management (IAM) platforms. The ideal candidate has a strong background operating enterprise PKI (EJBCA and/or Active Directory Certificate Services (ADCS)), key management and HSM services, and infrastructure access platforms such as Teleport, along with hands-on experience managing digital certificates, symmetric and asymmetric keys, and related security technologies. In this role, you will own the design, implementation, and evolution of our encryption and identity infrastructure, including enterprise certificate authorities, the Teleport access platform (database, Kubernetes, Linux, and application access), cloud and HSM-backed key management, and the integration of PKI with IAM systems. You will ensure secure identity management, access, and encryption across the organization while maintaining high availability, auditability, and compliance. As a Senior Engineer, you will set technical direction for these platforms, lead cross-functional initiatives from design to production, mentor engineers, and represent the team in vendor, architecture, and leadership discussions. What You'll Do

Own enterprise PKI architecture and operations (CA hierarchy, issuance/revocation policy, HA/scale) on EJBCA and/or ADCS

Operate and scale Teleport for secure access to databases, Kubernetes, Linux hosts, and applications (RBAC, access requests, SSO, WebAuthn/passkeys, mTLS, audit)

Design and operate key management at scale (hierarchies, envelope encryption, rotation) across cloud KMS and HSM-backed services for encryption and signing use cases

Manage production

HSMs:

key ceremonies, token provisioning/rotation, clustering/failover, FIPS 140-2/140-3 posture, and crypto DR

Own digital certificate lifecycle at fleet scale, including automated issuance (e.g., ACME), renewal, and revocation

Integrate PKI and access platforms with IAM (Active Directory, Entra ID, and other IdPs) for authentication, authorization, and encryption workflows

Implement strong access control patterns (RBAC/ABAC, zero-trust access, m

TLS/SPIFFE

where applicable) with partner security teams

Build automation and platform engineering for cert/key lifecycle using Python and/or PowerShell, CI/CD, and GitOps

Own monitoring, compliance, and incident response for PKI/KMS/HSM/Teleport (Splunk/Grafana observability, audits, 24/7 on-call, postmortems)

Lead and mentor: set standards/runbooks, drive cross-functional delivery, and manage vendor relationships (e.g., Thales, DigiCert, Teleport, SailPoint) What You'll Bring

Degree in Computer Science, Information Security, or related field; or equivalent experience

8+ years in security infrastructure, including 5+ years focused on enterprise PKI and IAM

Proven experience designing and operating enterprise PKI with EJBCA and/or ADCS (hierarchy, policy, revocation, scale)

Production experience with key management at scale (AWS KMS, Azure Key Vault, or equivalent, and/or HSM-backed services), including rotation and lifecycle

Experience managing HSMs (Thales, Entrust, or equivalent), including FIPS environments, key ceremonies, and clustering/failover

Experience operating Teleport or a comparable infrastructure access / zero-trust platform (DB/K8s/Unix access with mTLS, RBAC, audit)

Strong PKI fundamentals plus IAM platform experience (AD, Entra ID) and identity protocols (SAML, OIDC, OAuth, Kerberos)

Proficiency in PowerShell and/or Python for PKI/KMS/access automation; experience with CI/CD (GitOps preferred)

Experience supporting 24/7 global mission-critical environments; cloud/hybrid security experience preferred (Kubernetes a plus)

Track record leading cross-functional security initiatives and mentoring engineers, with strong stakeholder communication and documentation skills

Benefits Along with competitive pay, as a full-time Tesla employee, you are eligible for the following benefits at day 1 of hire: Medical plans > plan options with $0 payroll deduction

Family-building, fertility, adoption and surrogacy benefits

Dental (including orthodontic coverage) and vision plans, both have options with a $0 paycheck contribution

Company Paid (Health Savings Accounts) HSA Contribution when enrolled in the High-Deductible medical plan with HSA

Healthcare and Dependent Care Flexible Spending Accounts (FSA)

401(k) with employer match, Employee Stock Purchase Plans, and other financial benefits

Company paid Basic Life, AD&D

Short-term and long-term disability insurance (90 day waiting period)

Employee Assistance Program

Sick and Vacation time (Flex time for salary positions, Accrued hours for Hourly positions), and Paid Holidays

Back-up childcare and parenting support resources

Voluntary benefits to include: critical illness, hospital indemnity, accident insurance, theft & legal services, and pet insurance

Weight Loss and Tobacco Cessation Programs

Tesla Babies program

Commuter benefits

Employee discounts and perks program

Expected Compensation

$140,000 - $252,000/annual salary + cash and stock awards + benefits Pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. The total compensation package for this position may also include other elements dependent on the position offered. Details of participation in these benefit plans will be provided if an employee receives an offer of employment.