SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Cloudflare is building a new public Certificate Authority for the Internet and seeks a senior technical architect to define the systems, protocols, and security architecture behind it. This role spans applied cryptography, Web PKI, distributed systems, security engineering, compliance, and Internet standards.
You will define and guide the end-to-end architecture of Cloudflare's public Certificate Authority—a high-assurance, highly available system capable of issuing conventional publicly trusted certificates at Cloudflare scale while supporting Merkle Tree Certificates (MTCs) and evolution toward post-quantum Web PKI.
Key responsibilities include:
- Define and maintain end-to-end technical architecture across certificate issuance, key management, transparency, revocation, renewal, and relying-party integration
- Design root and intermediate CA trust hierarchies, signing systems, HSM integration, key ceremonies, key rotation, backup, recovery, and key-compromise response
- Architect secure, resilient, highly available issuance services operating at Internet scale across multiple geographic and failure domains
- Design certificate lifecycle systems around ACME, domain/IP validation, CAA, Certificate Transparency, pre-issuance linting, revocation, and renewal
- Integrate Cloudflare's MTC infrastructure including CA logs, landmarks, cosigning, and relying-party interactions
- Develop practical architectures for coexistence and migration between classical X.509 certificates and post-quantum authentication mechanisms
- Define trust boundaries, security properties, and threat models covering key compromise, unauthorized issuance, supply-chain compromise, operator error, malicious insiders, infrastructure failure, split views, and cryptographic migration
- Design observable and independently verifiable CA behavior through transparency mechanisms, reproducible builds, cryptographic attestations, public telemetry, and audit controls
- Design failure containment and recovery mechanisms supporting safe certificate replacement, revocation, key rotation, and incident response
- Translate CA/Browser Forum requirements, browser/OS root-program policies, and audit criteria into concrete technical and operational controls
- Review protocols, architecture, and implementations with adversarial mindset, identifying assumptions and failure modes at Internet scale
- Work closely with cryptography, TLS, security, networking, infrastructure, compliance, product, and operations teams
- Provide architectural direction, design review, and technical mentorship to implementing engineers
- Represent Cloudflare in standards and industry work with browser vendors, root programs, researchers, auditors, and the Web PKI community
Requirements:
- Substantial experience designing or operating security-critical systems, with deep expertise in at least one of: public Certificate Authorities, Web PKI, applied cryptography, TLS and Internet security protocols, Certificate Transparency, hardware-backed key management, or large-scale distributed security systems
- Strong knowledge of certificate trust chains, issuance and validation, revocation, key lifecycle management, and security/availability implications of CA design decisions
- Experience defining system trust boundaries, threat models, security invariants, and failure-handling strategies
- Ability to reason about systems where subtle architectural or operational mistakes can affect significant Internet fractions
- Experience leading architecture across multiple engineering teams without relying solely on organizational authority
- Strong written and verbal communication, including ability to explain cryptographic and architectural tradeoffs to engineers, auditors, standards participants, and senior stakeholders
- Comfort operating with substantial autonomy in evolving technical and policy environments
