Sr. PKI Engineer

Blackbaud is looking for a Sr PKI Engineer to operate and maintain our existing public key infrastructure and certificate management services. This is a high-impact, highly visible role that will also continue to drive automation and expansion of the Cryptographic Services Program across the enterprise. This role supports our Microsoft AD CS environment, certificate lifecycle platform, third-party trusted certificate authorities such as Sectigo or DigiCert, and integrations with enterprise key management services. Responsibilities Administer and maintain Microsoft Active Directory Certificate Services (AD CS), including issuing CAs, certificate templates, enrollment services (including autoenrollment), Network Device Enrollment Service (NDES), and CRL publication. Operate our certificate lifecycle platform, such as Venafi Trust Protection Platform or Keyfactor Command. Monitor certificate inventory, process requests, support renewals, and troubleshoot integrations. Use Fortanix Data Security Manager and other HSM-backed services as part of PKI operations. Work with the team that owns those services to resolve access, connectivity, and key usage issues. Investigate and resolve certificate issuance, renewal, trust chain, revocation, NDES enrollment, and key access issues. Perform routine PKI health checks, patching, maintenance, backups, and recovery testing. Respond to certificate expiration alerts and coordinate renewals with application and infrastructure owners. Maintain ex