Certificate authority, enrollment lifecycles, key custody, and identity infrastructure. Why this roleYou will work directly with the CTO and founding team to shape identity infrastructure without an inherited legacy system or accumulated compromise. What you will own- Root and intermediate CA design, offline root custody, issuance policy, rotation, revocation, and recovery.- Distinct sponsor, human, agent, device, service, and network authorization lifecycles.- Attributable protected paths with evidence an auditor can read.- Key custody that keeps long-lived keys outside application and agent reasoning environments. What we need- Experience designing and operating a production certificate authority.- Fluency in mTLS, X.509, certificate enrollment, FIDO/WebAuthn, OAuth 2.0, and OpenID Connect.- Sound judgment on cryptographic keys, credential custody, access control, and auditability.- Production Linux and container infrastructure experience. Compensation$130K–$170K. Potential equity, 401(k), and 100% paid family medical, dental, vision, and life insurance.