Senior Certificate Authority Architect
Cloudflare, Hybrid +1
What you will do
- Define and maintain the end-to-end technical architecture of Cloudflare's public CA across certificate issuance, key management, transparency, revocation, renewal, and relying-party integration.
- Design root and intermediate CA trust hierarchies, signing systems, HSM integration, key ceremonies, key rotation, backup, recovery, migration, and key-compromise response.
- Architect secure, resilient, and highly available issuance services capable of operating at Internet scale and across multiple geographic and failure domains.
- Design certificate lifecycle systems around ACME, domain and IP validation, CAA, Certificate Transparency, pre-issuance linting, revocation, renewal, and large-scale certificate replacement.
- Integrate Cloudflare’s MTC infrastructure, including CA logs, landmarks,, cosigning or mirroring, and interactions with relying parties.
- Develop practical architectures for coexistence and migration between classical X.509 certificates and post-quantum authentication mechanisms.
- Define trust boundaries, security properties, and threat models covering key compromise, unauthorized issuance, software supply-chain compromise, operator error, malicious insiders, infrastructure failure, split views, and cryptographic migration.