Sr Platform Engineer, Identity and Security

PENNYMAC Pennymac is (NYSE: PFSI) is a specialty financial services firm with a comprehensive mortgage platform and integrated business focused on the production and servicing of U.S. mortgage loans and the management of investments related to the U.S. mortgage market. At Pennymac, our people are the foundation of our success and at the heart of our dynamic work culture. Together, we work towards a unified goal of helping millions of Americans achieve aspirations of homeownership through the complete mortgage journey. A Typical Day We're looking for an experienced, forward-thinking engineer to strengthen our Platform Engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services and encryption. In this role, you'll design and automate the identity and cryptographic services that our Infrastructure and Application stack depends on, from certificate lifecycle automation at enterprise scale through to directory, authentication and key management. You'll work closely with diverse technology teams to streamline delivery, embed security best practices, and champion infrastructure-as-code. If you're passionate about automation, cloud-native patterns, and making critical services resilient, we want to hear from you. Key Responsibilities Design, implement, and manage scalable and resilient infrastructure on AWS. Design and automate the certificate lifecycle at enterprise scale, covering issuance, validation, renewal, revocation and deployment to target workloads. Design, maintain and improve the resilience of Public Key Infrastructure (PKI), including certificate authority operation, certificate inventory and expiry alerting. Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager and S3. Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers. Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies and KMS key policies. Administer, secure and improve the resilience of Active Directory and DNS. Support and advance Windows authentication, including Kerberos, delegation and service account models. Implement encryption for data at rest and in transit, and manage keys, rotation and key access policy. Develop and maintain infrastructure-as-code (IaC) using both Terraform (OpenTofu) and AWS CloudFormation/CDK. Develop and maintain Configuration Management for Windows servers using Chef, AWS SSM or Ansible. Design, build, and optimize CI/CD pipelines using GitLab CI/CD. Implement and enforce security best practices across the infrastructure and deployment processes. Collaborate closely with development teams to understand their needs and provide Platform Engineering expertise. Troubleshoot and resolve infrastructure and application deployment issues. Implement and manage monitoring, logging and alerting to ensure system visibility and proactive issue detection. Clearly and concisely contribute to the development and documentation of Platform standards and best practices. Provide mentorship and guidance to junior team members. What You’ll Bring Required Qualifications Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience). 7+ years of experience in a Platform Engineering, DevOps or Site Reliability Engineering (SRE) role. Extensive hands-on experience with Amazon Web Services (AWS), including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3. Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies and KMS key policies. Strong Public Key Infrastructure (PKI) and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation and revocation. Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers. Strong Active Directory experience, including replication, FSMO roles, trust relationships and AD-integrated DNS. Strong understanding of Windows authentication protocols, specifically Kerberos and NTLM, including service principal names, delegation, supported encryption types and service account models. Practical experience with encryption at rest and in transit, and with key management services. Solid understanding of Windows Server administration and integration with cloud environments. Proven experience with infrastructure-as-code (IaC) tools, specifically Terraform (OpenTofu) and AWS CDK. Strong experience designing and implementing CI/CD pipelines using GitLab CI/CD. Deep understanding of security best practices and their implementation in cloud infrastructure and CI/CD pipelines. Solid understanding of networking principles (TCP/IP, DNS, load balancing, firewalls) in cloud environments. Experience with monitoring and logging tools (e.g., NewRelic, CloudWatch, Cloud Logging, Prometheus). Strong scripting skills, with PowerShell at an advanced level, plus Python or Bash. Experience with configuration management tools, such as Chef, AWS SSM, or Ansible. Excellent problem-solving and troubleshooting skills. Strong communication and collaboration skills. Preferred Qualifications AWS Certified Security – Specialty, or other relevant AWS certifications, are a plus. Experience with certificate automation protocols and tooling (e.g., ACME, cert-manager or equivalent). Experience operating a private certificate authority. Experience with multi-tenant platforms and namespace isolation. Experience hardening Active Directory against credential attacks. Experience with Microsoft Entra ID and hybrid identity integration is a plus. Experience with disaster recovery design for critical services, including defined RTO and RPO targets. Strong background with AWS EC2 features and Services (Autoscaling and WarmPools) Understanding of Windows server Build process using tools like Chocolatey for packages and Packer for AMI/Image generation. Solid experience with the Windows server operating system and server tools such as IIS. Experience with containerization & orchestration technologies (e.g., Docker, Kubernetes) is a plus. Why You Should Join As one of the top mortgage lenders in the country, Pennymac has helped over 4 million lifetime homeowners achieve and sustain their aspirations of home. Our vision is to be the most trusted partner for home. Together, 4,000 Pennymac team members across the country are guided by our core values: to be Accountable, Reliable and Ethical in all that we do. Pennymac is committed to conducting a business that makes positive contributions and promotes long-term sustainable growth and to fostering an equitable and inclusive environment, where all employees and customers feel valued, respected and supported. Benefits That Bring It Home: Whether you're looking for flexible benefits for today, setting up short-term goals for tomorrow, or planning for long-term success and retirement, Pennymac's benefits have you covered. Some key benefits include: Comprehensive Medical, Dental, and Vision Paid Time Off Programs including vacation, holidays, illness, and parental leave Wellness Programs, Employee Recognition Programs, and onsite gyms and cafe style dining (select locations) Retirement benefits, life insurance, 401k match, and tuition reimbursement Philanthropy Programs including matching gifts, volunteer grants, charitable grants and corporate sponsorships We value the hard work and dedication of our employees. In addition to a competitive salary, positions may offer bonus opportunities. To learn more about our benefits visit: For residents with state required benefit information, additional information can be found at: Compensation: Individual salary may vary based on multiple factors including specific role, geographic location / market data, and skills and experience as defined below: Lower in range - Building skills and experience in the role Mid-range - Experience and skills align with proficiency in the role Higher in range - Experience and skills add value above typical requirements of the role Some roles may be eligible for performance-based compensation and/or stock-based incentives awarded to employees based on company and individual performance. Salary $110,000 - $170,000 Work Model OFFICE
We're looking for an experienced, forward-thinking engineer to strengthen our Platform Engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services and encryption. In this role, you'll design and automate the identity and cryptographic services that our Infrastructure and Application stack depends on, from certificate lifecycle automation at enterprise scale through to directory, authentication and key management. You'll work closely with diverse technology teams to streamline delivery, embed security best practices, and champion infrastructure-as-code. If you're passionate about automation, cloud-native patterns, and making critical services resilient, we want to hear from you. Key Responsibilities Design, implement, and manage scalable and resilient infrastructure on AWS. Design and automate the certificate lifecycle at enterprise scale, covering issuance, validation, renewal, revocation and deployment to target workloads. Design, maintain and improve the resilience of Public Key Infrastructure (PKI), including certificate authority operation, certificate inventory and expiry alerting. Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager and S3. Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers. Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies and KMS key policies. Administer, secure and improve the resilience of Active Directory and DNS. Support and advance Windows authentication, including Kerberos, delegation and service account models. Implement encryption for data at rest and in transit, and manage keys, rotation and key access policy. Develop and maintain infrastructure-as-code (IaC) using both Terraform (OpenTofu) and AWS CloudFormation/CDK. Develop and maintain Configuration Management for Windows servers using Chef, AWS SSM or Ansible. Design, build, and optimize CI/CD pipelines using GitLab CI/CD. Implement and enforce security best practices across the infrastructure and deployment processes. Collaborate closely with development teams to understand their needs and provide Platform Engineering expertise. Troubleshoot and resolve infrastructure and application deployment issues. Implement and manage monitoring, logging and alerting to ensure system visibility and proactive issue detection. Clearly and concisely contribute to the development and documentation of Platform standards and best practices. Provide mentorship and guidance to junior team members.
Required Qualifications Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience). 7+ years of experience in a Platform Engineering, DevOps or Site Reliability Engineering (SRE) role. Extensive hands-on experience with Amazon Web Services (AWS), including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3. Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies and KMS key policies. Strong Public Key Infrastructure (PKI) and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation and revocation. Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers. Strong Active Directory experience, including replication, FSMO roles, trust relationships and AD-integrated DNS. Strong understanding of Windows authentication protocols, specifically Kerberos and NTLM, including service principal names, delegation, supported encryption types and service account models. Practical experience with encryption at rest and in transit, and with key management services. Solid understanding of Windows Server administration and integration with cloud environments. Proven experience with infrastructure-as-code (IaC) tools, specifically Terraform (OpenTofu) and AWS CDK. Strong experience designing and implementing CI/CD pipelines using GitLab CI/CD. Deep understanding of security best practices and their implementation in cloud infrastructure and CI/CD pipelines. Solid understanding of networking principles (TCP/IP, DNS, load balancing, firewalls) in cloud environments. Experience with monitoring and logging tools (e.g., NewRelic, CloudWatch, Cloud Logging, Prometheus). Strong scripting skills, with PowerShell at an advanced level, plus Python or Bash. Experience with configuration management tools, such as Chef, AWS SSM, or Ansible. Excellent problem-solving and troubleshooting skills. Strong communication and collaboration skills. Preferred Qualifications AWS Certified Security – Specialty, or other relevant AWS certifications, are a plus. Experience with certificate automation protocols and tooling (e.g., ACME, cert-manager or equivalent). Experience operating a private certificate authority. Experience with multi-tenant platforms and namespace isolation. Experience hardening Active Directory against credential attacks. Experience with Microsoft Entra ID and hybrid identity integration is a plus. Experience with disaster recovery design for critical services, including defined RTO and RPO targets. Strong background with AWS EC2 features and Services (Autoscaling and WarmPools) Understanding of Windows server Build process using tools like Chocolatey for packages and Packer for AMI/Image generation. Solid experience with the Windows server operating system and server tools such as IIS. Experience with containerization & orchestration technologies (e.g., Docker, Kubernetes) is a plus.