Senior Security Engineer, PKI & Network Edge

Requisition

Dentsply Sirona is the world's largest manufacturer of professional dental products and technologies, with over a century of innovation and service to the dental industry and patients worldwide. Dentsply Sirona develops, manufactures, and markets a comprehensive solutions offering including dental and oral health products as well as other consumable medical devices under a strong portfolio of world class brands.

Dentsply Sirona's products provide innovative, high-quality, and effective solutions to advance patient care and deliver better and safer dental care. Dentsply Sirona's headquarter is located in Charlotte, North Carolina. The company's shares are listed in the United States on NASDAQ under the symbol XRAY. Visit  for more information about Dentsply Sirona and its products.

Dentsply Sirona is looking for a Senior Security Engineer, PKI & Network Edge professional to join our team This is a senior-level individual contributer position within Dentsply Sirona's Security Architecture and Engineering organization.

This role is the enterprise technical owner for the security of three foundational internet-facing services:
Domain Name System (DNS), digital certificates and Public Key Infrastructure (PKI), and Web Application Firewall (WAF). These services define and protect the boundary between Dentsply Sirona and the public internet, and this engineer is accountable for keeping that boundary trustworthy, available, and resilient.

As the build-and-govern owner, the role designs, selects, and stands up these capabilities, then sets the standards and guardrails by which they run. It owns the design, engineering, and continuous improvement of controls across DNS resolution and domain governance, the full certificate lifecycle and enterprise PKI, and web application and edge protection. Day-to-day operation transitions to a partner Infrastructure run-and-maintain function, while this role retains design authority, standards, and risk governance.

The engineer partners closely with Infrastructure and Operations, Network Engineering, Cloud Engineering, Product Security, Application Development, and Security Operations to reduce attack surface, prevent outages caused by expired or misissued certificates, and ensure web-facing assets are protected against modern application-layer threats.

Operating with minimal direction, the Senior Engineer leads complex initiatives end to end, acts as the senior escalation point for DNS, certificate, and WAF issues, and serves as a trusted advisor to both engineering teams and security leadership. The role also provides senior-level support to Security Operations by ensuring high-quality telemetry and detection coverage across DNS, certificate, and WAF data sources.

• Owning enterprise DNS security and domain governance: authoritative and recursive DNS hygiene, DNSSEC, DNS firewalling and filtering, registrar and domain lifecycle controls, and anti-hijacking protections.
• Owning the enterprise certificate and PKI program: certificate lifecycle automation, discovery and inventory, TLS standards, internal and external certificate authorities, and prevention of expiry-driven outages.
• Owning WAF and edge protection: policy design, rule tuning, OWASP coverage, bot and abuse mitigation, and coordination of CDN and DDoS edge controls.
• Acting as a senior escalation point for complex network, edge, and trust-service security issues.
• Driving security posture improvement, risk reduction, and operational maturity across all internet-facing services.

• Design and maintain secure DNS architecture across authoritative and recursive resolution, including segmentation, redundancy, and provider resilience.
• Implement and operate DNSSEC, DNS firewalling, protective DNS, and response policy zones (RPZ) to block malicious resolution and exfiltration over DNS.
• Establish domain and registrar governance: registrar lock, ownership of the domain portfolio, anti-hijacking controls, and standards for new domain provisioning and retirement.
• Partner with Security Operations to onboard DNS telemetry and build detections for tunneling, fast-flux, and newly registered or look-alike domains.

• Own the enterprise certificate program end to end: issuance, renewal, revocation, and automated lifecycle management (including ACME-based automation) to eliminate expiry-driven outages.
• Maintain continuous certificate…