Cloudflare tashkilotlarga mahalliy infratuzilma, ommaviy bulutlar, SaaS platformalari va internetdagi xodimlar, qurilmalar, ilovalar, tarmoqlar hamda ma’lumotlarni himoyalash va o‘zaro bog‘lashga yordam beradigan ulanish bulutini taqdim etadi. Uning platformasi ilova xavfsizligi, tarmoq himoyasi, unumdorlikni optimallashtirish va ko‘rinuvchanlik vositalarini birlashtirib, jamoalarga texnik murakkablikni kamaytirish hamda dasturiy ta’minotni yanada samarali ishlab chiqish va yetkazib berishga yordam beradi. Cloudflare faoliyati bulut va chekka qurilmalar orqali yetkazib berish, xavfsiz tarmoqlar hamda barqaror raqamli infratuzilmani qamrab oladi. Shu sababli kompaniya kiberxavfsizlik, tarmoqlar, bulut platformalari va ilovalar unumdorligi sohalarida ishlaydigan mutaxassislar uchun dolzarbdir.
Senior Certificate Authority Architect
Design Cloudflare’s public Certificate Authority for secure, Internet-scale certificate issuance. Lead architecture across X.509, Merkle Tree Certificates, and post-quantum Web PKI.
Tavsif
- Own the end-to-end architecture for Cloudflare’s public Certificate Authority, spanning issuance, key management, transparency, revocation, renewal, and relying-party integration.
- Design root and intermediate CA trust hierarchies, signing infrastructure, HSM integration, key ceremonies, rotation, backup, recovery, migration, and compromise response.
- Architect secure, resilient, highly available certificate issuance services across geographic and failure domains at Internet scale.
- Design certificate lifecycle systems covering ACME, domain and IP validation, CAA, Certificate Transparency, pre-issuance linting, revocation, renewal, and large-scale replacement.
- Integrate Cloudflare’s Merkle Tree Certificate infrastructure, including CA logs, landmarks, cosigning or mirroring, and relying-party interactions.
- Develop migration and coexistence architectures for classical X.509 certificates and post-quantum authentication mechanisms.
- Define trust boundaries, security properties, and threat models for key compromise, unauthorized issuance, supply-chain attacks, operator error, insider threats, infrastructure failures, split views, and cryptographic migration.
- Create observable and independently verifiable CA behavior using transparency mechanisms, reproducible builds, cryptographic attestations, public telemetry, tamper-evident evidence, and audit controls.
- Design containment and recovery strategies for certificate replacement, revocation, key rotation, and incident response.
- Convert CA/Browser Forum requirements, browser and operating-system root-program policies, audit criteria, and certification requirements into technical and operational controls.
- Assess protocols, architectures, and implementations from an adversarial security perspective.
- Partner with cryptography, TLS, security, networking, infrastructure, compliance, product, and operations teams.
- Provide architectural leadership, conduct design reviews, and mentor engineers.
- Represent Cloudflare in standards and industry initiatives involving browser vendors, root programs, researchers, auditors, CA operators, and the Web PKI community.
Talablar
- Bring substantial experience designing or operating security-critical systems, with deep expertise in at least one of public Certificate Authorities, Web PKI, applied cryptography, TLS and Internet security protocols, Certificate Transparency, hardware-backed key management, or large-scale distributed security systems.
- Demonstrate strong knowledge of certificate trust chains, issuance and validation, revocation, key lifecycle management, and the security and availability consequences of CA design decisions.
- Have experience defining system trust boundaries, threat models, security invariants, and failure-handling strategies.
- Be able to reason about systems where a subtle architectural or operational error could affect a significant portion of the Internet.
- Have led architecture across multiple engineering teams without depending solely on organizational authority.
- Communicate clearly in writing and verbally, including explaining cryptographic and architectural tradeoffs to engineers, auditors, standards participants, and senior stakeholders.
- Work comfortably with substantial autonomy in a changing technical and policy environment.
- An offer may require authorization to receive software or technology controlled under U.S. export laws without sponsorship for an export license.
Imtiyozlar
- An in-person interview at a Cloudflare office or hub may be required during the offer stage.
- Cloudflare is committed to equal employment opportunity, diversity, and inclusion.
- Reasonable accommodations are available for qualified individuals with disabilities.