Senior Security Engineer, PKI & Network Edge

Requistion ID: 83899

Dentsply Sirona is the world’s largest manufacturer of professional dental products and technologies, with over a century of innovation and service to the dental industry and patients worldwide. Dentsply Sirona develops, manufactures, and markets a comprehensive solutions offering including dental and oral health products as well as other consumable medical devices under a strong portfolio of world class brands. Dentsply Sirona’s products provide innovative, high-quality, and effective solutions to advance patient care and deliver better and safer dental care. Dentsply Sirona’s headquarter is located in Charlotte, North Carolina. The company’s shares are listed in the United States on NASDAQ under the symbol XRAY. Visit www.dentsplysirona.com for more information about Dentsply Sirona and its products.

Dentsply Sirona is looking for a Senior Security Engineer, PKI & Network Edge professional to join our team  This is a senior-level individual contributer position within Dentsply Sirona's Security Architecture and Engineering organization.

This role is the enterprise technical owner for the security of three foundational internet-facing services: Domain Name System (DNS), digital certificates and Public Key Infrastructure (PKI), and Web Application Firewall (WAF). These services define and protect the boundary between Dentsply Sirona and the public internet, and this engineer is accountable for keeping that boundary trustworthy, available, and resilient.

As the build-and-govern owner, the role designs, selects, and stands up these capabilities, then sets the standards and guardrails by which they run. It owns the design, engineering, and continuous improvement of controls across DNS resolution and domain governance, the full certificate lifecycle and enterprise PKI, and web application and edge protection. Day-to-day operation transitions to a partner Infrastructure run-and-maintain function, while this role retains design authority, standards, and risk governance. The engineer partners closely with Infrastructure and Operations, Network Engineering, Cloud Engineering, Product Security, Application Development, and Security Operations to reduce attack surface, prevent outages caused by expired or misissued certificates, and ensure web-facing assets are protected against modern application-layer threats.

Operating with minimal direction, the Senior Engineer leads complex initiatives end to end, acts as the senior escalation point for DNS, certificate, and WAF issues, and serves as a trusted advisor to both engineering teams and security leadership. The role also provides senior-level support to Security Operations by ensuring high-quality telemetry and detection coverage across DNS, certificate, and WAF data sources.

Role Scope Includes:

• Owning enterprise DNS security and domain governance: authoritative and recursive DNS hygiene, DNSSEC, DNS firewalling and filtering, registrar and domain lifecycle controls, and anti-hijacking protections.
• Owning the enterprise certificate and PKI program: certificate lifecycle automation, discovery and inventory, TLS standards, internal and external certificate authorities, and prevention of expiry-driven outages.
• Owning WAF and edge protection: policy design, rule tuning, OWASP coverage, bot and abuse mitigation, and coordination of CDN and DDoS edge controls.
• Acting as a senior escalation point for complex network, edge, and trust-service security issues.
• Driving security posture improvement, risk reduction, and operational maturity across all internet-facing services.

Responsibilities for Employment:

DNS Security & Domain Governance

• Design and maintain secure DNS architecture across authoritative and recursive resolution, including segmentation, redundancy, and provider resilience.
• Implement and operate DNSSEC, DNS firewalling, protective DNS, and response policy zones (RPZ) to block malicious resolution and exfiltration over DNS.
• Establish domain and registrar governance: registrar lock, ownership of the domain portfolio, anti-hijacking controls, and standards for new domain provisioning and retirement.
• Partner with Security Operations to onboard DNS telemetry and build detections for tunneling, fast-flux, and newly registered or look-alike domains.

Certificate Lifecycle & Enterprise PKI

• Own the enterprise certificate program end to end: issuance, renewal, revocation, and automated lifecycle management (including ACME-based automation) to eliminate expiry-driven outages.
• Maintain continuous certificate discovery and inventory across cloud, on-premises, and product environments, with clear ownership and alerting ahead of expiration.
• Define and enforce TLS and cryptographic standards (protocol versions, cipher suites, key strength, and key protection) aligned to the DS internal encryption standard.
• Design and stand up enterprise private PKI: the certificate authority hierarchy (root and issuing CAs), automated issuance (ACME/EST/SCEP), and integration with directory and device-management systems.
• Govern internal and external certificate authorities and trust stores, and define hardware key protection (HSM) for CA and code-signing keys, including the root key ceremony and custody model.
• Establish secure code-signing for software and device firmware, with signing keys protected in hardware.

Web Application Firewall & Edge Protection

• Lead the design, deployment, and tuning of WAF policies across enterprise and product web applications, balancing strong protection with low false-positive rates.
• Maintain OWASP Top 10 and API protection coverage, manage rule lifecycle and exceptions, and tune signatures based on observed traffic and threat intelligence.
• Coordinate CDN, DDoS mitigation, and bot management controls at the edge, and partner with application teams on safe onboarding and tuning.
• Partner with Security Operations to ensure WAF events feed detection and response workflows with high-fidelity, actionable telemetry.

Engineering Enablement & Continuous Improvement

• Define security standards, patterns, and guardrails that let network, cloud, and application teams consume DNS, certificate, and WAF services securely by default.
• Automate control enforcement and configuration validation using scripting and infrastructure-as-code, reducing manual effort and configuration drift.
• Lead threat modeling and architecture reviews for new internet-facing services and major migrations; document decisions and required controls.
• Define the operating model and transition built capabilities to the Infrastructure run-and-maintain function, and mentor engineers as a technical leader across Security Architecture and Engineering initiatives.

Success Metrics / KPIs (Senior IC Expectations)

• Outage prevention: Zero unplanned outages caused by expired or misissued certificates, supported by full certificate visibility and automated renewal.
• Attack surface reduction: Measurable reduction in exposed or unmanaged DNS records, domains, and certificates through discovery, governance, and cleanup.
• Protection effectiveness: Improved WAF coverage of internet-facing applications with a controlled and declining false-positive rate.
• Detection coverage: DNS, certificate, and WAF telemetry onboarded to the SIEM with tuned, high-fidelity detections.

Stretch Goal (Beyond KPIs)

• Deliver a unified edge and trust-services security blueprint (DNS, certificates, and WAF) with automated lifecycle management and standardized protection patterns adopted broadly across enterprise and product environments, with results presented to senior security leadership and used as a model for future investment.

Education:  Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related field (or equivalent practical experience)

Experience:

• 7+ years of progressive experience in cybersecurity engineering, with hands-on experience securing internet-facing infrastructure.
• 3+ years of direct, hands-on experience across two or more of: enterprise DNS security, certificate/PKI management, and WAF engineering.
• Proven experience designing and operating enterprise-scale edge or perimeter security controls.
• Experience integrating network and edge security platforms with SIEM/SOC operations.

Key Skills & Knowledge

• Strong knowledge of DNS and DNS security (DNSSEC, protective DNS, RPZ) and domain/registrar governance.
• Deep understanding of certificate lifecycle management, PKI, TLS, and cryptographic standards, including certificate automation (ACME) and discovery tooling.
• Hands-on WAF engineering experience on an enterprise edge or WAF platform, including rule tuning and OWASP and API protection.
• Security automation and infrastructure-as-code (Terraform or equivalent) and scripting (Python or equivalent).
• Ability to translate risk into pragmatic engineering requirements and to communicate clearly with both engineering teams and senior leadership.

Certifications Preferred (globally recognized)

• CISSP and/or GIAC certifications relevant to web, network, or defensible architecture (for example GWEB, GCIA, GDSA).
• Vendor certifications relevant to the role (for example in edge security, WAF, DNS, or certificate and PKI management).
• Familiarity with NIST CSF / NIST SP 800-53 / ISO 27001 control frameworks.

Workforce Alignment

• Responsibilities align to the NIST NICE Framework Secure Infrastructure and Network/Edge Security engineering work roles, supporting standardized career progression and workforce planning.

The base salary and target annual incentive for this role is between $187,000 - $198,000. Actual compensation is influenced by a wide array of factors including but not limited to skill set, level of experience, and specific office location.

Equal Opportunity Employer: Dentsply Sirona is an Equal Opportunity Employer. All qualified applicants will be considered without unlawful discrimination or regard for race, color, religion, sex, sexual orientation, sexual or gender identity, national or ethnic origin, age, marital status, disability, genetic factors, military and veteran status, or any other characteristics protected by applicable local law. Eligibility: All successful applicants must be eligible to work in the country the position is based. Assistance: If you need assistance with completing the online application due to a disability, please send an accommodation request to accommodationrequest@dentsplysirona.com. Agencies: Please note that Dentsply Sirona does not accept or respond to unsolicited requests or applications submitted by Recruitment Agencies/ Search Firms. Notice on Fraudulent Job Offers: Unfortunately, we are aware of third parties that pretend to represent our company offering unauthorized employment opportunities. If you think a fraudulent source is offering you a job, please have a look at the following information: careers.dentsplysirona.com.