Sr Platform Engineer, Identity and Security at PennyMac Financial Services in Westlake Village, CA

Job description

PENNYMAC Pennymac is (NYSE: PFSI) is a specialty financial services firm with a comprehensive mortgage platform and integrated business focused on the production and servicing of U.S. mortgage loans and the management of investments related to the U.S. mortgage market. At Pennymac, our people are the foundation of our success and at the heart of our dynamic work culture. Together, we work towards a unified goal of helping millions of Americans achieve aspirations of homeownership through the complete mortgage journey. A Typical Day We're looking for an experienced, forward-thinking engineer to strengthen our Platform Engineering capabilities across AWS and Windows environments, with a focus on authentication, certificate services and encryption. In this role, you'll design and automate the identity and cryptographic services that our Infrastructure and Application stack depends on, from certificate lifecycle automation at enterprise scale through to directory, authentication and key management. You'll work closely with diverse technology teams to streamline delivery, embed security best practices, and champion infrastructure-as-code. If you're passionate about automation, cloud-native patterns, and making critical services resilient, we want to hear from you. Key Responsibilities Design, implement, and manage scalable and resilient infrastructure on AWS. Design and automate the certificate lifecycle at enterprise scale, covering issuance, validation, renewal, revocation and deployment to target workloads. Design, maintain and improve the resilience of Public Key Infrastructure (PKI), including certificate authority operation, certificate inventory and expiry alerting. Build event-driven automation in AWS using services such as EventBridge, Lambda, Secrets Manager, Systems Manager and S3. Deploy and bind certificates to AWS managed services and to Windows and Linux web and application servers. Design and maintain multi-account AWS patterns, including cross-account IAM, resource policies and KMS key policies. Administer, secure and improve the resilience of Active Directory and DNS. Support and advance Windows authentication, including Kerberos, delegation and service account models. Implement encryption for data at rest and in transit, and manage keys, rotation and key access policy. Develop and maintain infrastructure-as-code (IaC) using both Terraform (OpenTofu) and AWS CloudFormation/CDK. Develop and maintain Configuration Management for Windows servers using Chef, AWS SSM or Ansible. Design, build, and optimize CI/CD pipelines using GitLab CI/CD. Implement and enforce security best practices across the infrastructure and deployment processes. Collaborate closely with development teams to understand their needs and provide Platform Engineering expertise. Troubleshoot and resolve infrastructure and application deployment issues. Implement and manage monitoring, logging and alerting to ensure system visibility and proactive issue detection. Clearly and concisely contribute to the development and documentation of Platform standards and best practices. Provide mentorship and guidance to junior team members. What You’ll Bring Required Qualifications Bachelor's degree in Computer Science, Engineering, or a related field (or equivalent experience). 7+ years of experience in a Platform Engineering, DevOps or Site Reliability Engineering (SRE) role. Extensive hands-on experience with Amazon Web Services (AWS), including ACM, KMS, Secrets Manager, Systems Manager, IAM, EventBridge, Lambda and S3. Experience designing and operating multi-account AWS environments, including cross-account IAM, resource policies and KMS key policies. Strong Public Key Infrastructure (PKI) and certificate lifecycle experience, including certificate authority operation, certificate formats, chain assembly, renewal automation and revocation. Experience deploying and binding certificates on Windows (IIS) and Linux (Nginx, Apache, Tomcat) servers. Strong Activ