Yes, and in fact this is generally how risk gets minimized in large deployments. What you're describing is a two-tier PKI hierarchy. Typically, it starts with the ROOT CA at the top, which serves as the "trust anchor," or the one CA which everything in your domain is going to ultimately trust. Typically, this machine NEVER touches a network in its lifetime. You'll have it generate a self-signed certificate (in the process, it will have generated its own private key with which to sign other certificates).
Then you build what will be a suboordinate (or "online") CA. This one can be network-attached. Generate a key pair (Certificate Signing Request), and place the resulting CSR on some removable media. Sneakernet that media onto the ROOT CA, and have it sign the CSR. The resulting certificate is what gets installed back on the suboordinate CA.
Meanwhile, all your client machines should have the public certificates of each CA (the ROOT CA at minimum) in its "Certificate Trust Store." This is the only way clients will know what to trust.
From this point, you could create as many suboordinate CAs in the same manner described above, and assign them to support whatever you wish... a department, a line of business, a type of device or user account object, a data classification, external partner trust relationships (you can create a sub-Ca specifically for the purpose of signing another organization's sub-CA to create a limited realm of trust between the two networks).