Remote opportunity at
CloudflareSenior Certificate Authority Architect
Cloudflare is standing up a publicly trusted certificate authority to serve the Internet, and this role seeks a senior technical architect who will shape the systems,…
Career Tools
About This Role
Cloudflare is standing up a publicly trusted certificate authority to serve the Internet, and this role seeks a senior technical architect who will shape the systems, protocols and security design behind it. The company operates one of the largest networks in the world and says it protects and accelerates web properties. The posting does not state a salary or a specific office location. The architect's scope runs from applied cryptography…
Job Description
Cloudflare is standing up a publicly trusted certificate authority to serve the Internet, and this role seeks a senior technical architect who will shape the systems, protocols and security design behind it. The company operates one of the largest networks in the world and says it protects and accelerates web properties. The posting does not state a salary or a specific office location.
The architect's scope runs from applied cryptography and Web PKI through Internet standards, compliance, security engineering and distributed systems. The objective is a CA that issues conventional publicly trusted certificates at Internet scale and also creates a workable route from the current X.509 landscape to authentication that resists quantum computers, through Merkle Tree Certificates. The architect helps set the trust boundaries, key hierarchy, issuance design, auditability, failure behavior, incident response and long-range cryptographic changes.
Responsibilities include specifying the architecture across issuance, key handling, transparency logs, revocation, renewal and the interface to relying parties. The architect designs root and intermediate hierarchies, signing infrastructure, HSM integration, key ceremonies, and response to key compromise. The role also shapes certificate lifecycle tooling covering ACME flows, IP and domain checks, CAA rules, transparency logging and pre-issuance linting, along with threat modeling, failure containment, and mapping CA/Browser Forum rules into real controls.
The ideal candidate has substantial background in security-critical systems and real depth in one of several areas: public CAs, Web PKI, applied cryptography, TLS, Certificate Transparency, hardware-backed keys or large security platforms. They reason clearly about designs where one slip could affect much of the Internet, lead architecture across groups without relying on rank, and explain trade-offs to engineers, auditors and executives.
Responsibilities
- Specify the architecture across issuance, key handling, transparency logs, revocation, renewal and the interface to relying parties
- Design root and intermediate hierarchies, signing infrastructure, HSM integration, key ceremonies and response to key compromise
- Build highly available issuance services that tolerate failures across multiple regions and fault zones
- Shape certificate lifecycle tooling covering ACME flows, IP and domain checks, CAA rules, transparency logging and pre-issuance linting
- Connect Merkle Tree Certificate infrastructure to the CA design, covering logs, landmark certificates, co-signing, mirrors and relying-party behavior
- Plan a path from classical X.509 issuance to post-quantum authentication, including coexistence
- Specify trust boundaries, the security properties to uphold and invariants, and model threats against them
- Make CA behavior observable and verifiable through transparency, reproducible builds, attestations and audit trails
- Engineer failure containment and recovery paths for certificate replacement, revocation and key rotation
- Map CA/Browser Forum rules and root-program policies into technical and operational controls
- Scrutinize designs and code as an attacker would, surfacing assumptions that break at Internet scale
- Mentor implementing engineers, and represent the company in standards bodies and industry forums
Requirements
- Substantial experience designing or running security-critical platforms, with depth in at least one relevant area
- Strong grasp of certificate chains, validation, revocation and key lifecycles
- Experience drawing trust boundaries, threat models and failure-handling plans
- Capacity to reason about designs where a single mistake could touch a large share of the Internet
- Record of leading architecture across teams without depending on formal authority
- Clear writing and speaking, including explaining cryptographic trade-offs to diverse audiences
- Independence in a shifting technical and policy environment
Qualifications
- Knowledge of how browser makers and OS vendors judge CAs, plus audit and certification rules
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
The listing is marked remote. The posting does not name an office, but notes that finalists may be asked to interview in person at a Cloudflare office or hub.
What is the salary?
No salary is listed in the posting.
Are there export control requirements?
Yes. The role may involve technology covered by US export controls, and an offer may depend on the candidate being authorized to receive it without an export license the company must obtain.
What experience is needed?
The posting seeks a track record in high-stakes security engineering, with deep knowledge of at least one area such as public CAs, Web PKI or TLS.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.