PKI Security Engineer / CLM Implementation Engineer

Project overview

Fantastic opportunity to join a global banking business.

Purpose of Role

looking for a highly experienced PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across EMEA. This will establish automated certificate discovery and lifecycle controls, integrate the platform with enterprise PKI and technology services, and progressively support post-quantum cryptography (PQC) risk assessment and remediation over the next 1-3 years.

What will this person be doing?

Person Specification

Essential

Expected background

Core PKI and CLM Technical Skills (Essential)

Infra & Cloud Skills

• Lead the end-to-end implementation and phased rollout of the selected CLM platform across EMEA, from design & pilot through production deployment & operational handover.
• Create & maintain a central inventory of certificates, keys, trust stores, issuing CAs, owners, dependencies, environments and associated business services.
• Integrate CLM with Microsoft AD CS, approved public CAs, HSMs, load balancers, network devices, Windows and Linux servers, cloud services, containers, Kubernetes, DevOps pipelines and enterprise applications.
• Automate certificate request, approval, issuance, deployment, renewal, revocation and decommissioning using ACME, SCEP, EST, APIs, agents and native connectors where appropriate.
• Design CLM architecture, trust boundaries, RBAC, service accounts, resilient components, security controls & operating processes aligned with our standards and change governance.
• Plan discovery and onboarding waves with application, infrastructure and entity stakeholders; identify certificate ownership & remediate orphaned, expired, weak or manually managed certificates.
• Define monitoring, alerting, dashboards, audit evidence, KPIs/KRIs and integration with security monitoring and IT service-management processes.
• Perform technical evaluation, testing and troubleshooting of CLM capabilities, connectors and integrations, including production-readiness and scalability assurance.
• Support cryptographic discovery and inventory for PQC, identify quantum-vulnerable algorithms and dependencies, maintain a risk-based remediation backlog and help develop migration plans over the next 1-3 years.
• Assess vendor and product crypto-agility, certificate and protocol dependencies, and readiness for NIST-standardised PQC algorithms & hybrid transition patterns.
• Produce & maintain HLD, LLD, runbooks, support procedures, standards, onboarding patterns, knowledge articles and operational handover documentation.
• Provide PKI/CLM SME guidance to application, infrastructure, cloud, DevOps, security, risk, audit & entity teams across EMEA.
• Senior PKI / CLM engineer with substantial hands-on implementation experience in complex enterprise environments, not only BAU certificate administration.
• Proven delivery of an enterprise CLM platform across multiple business units, legal entities or regions, including discovery, pilot, rollout, integration & operational transition.
• Strong knowledge of PKI architecture and operations: root and issuing CAs, Microsoft AD CS, certificate templates, enrollment, CRL, OCSP, AIA/CDP, trust chains, key protection and HSM integration.
• Hands-on experience automating the X.509 certificate lifecycle across Windows, Linux, network, cloud, container, Kubernetes, application & DevOps environments.
• Experience integrating CLM through ACME, SCEP, EST, REST APIs, agents, connectors and CI/CD tooling.
• Working knowledge of cryptographic discovery, inventory, crypto-agility, CBOM concepts and risk-based migration planning for PQC.
• Experience in regulated financial-services or similarly controlled environments with strong audit, risk, change, resilience and segregation-of-duties requirements.
• Ability to coordinate technical delivery across entities, suppliers, application owners, infrastructure teams & security governance stakeholders.
• Enterprise CLM implementation and administration: discovery, inventory, ownership, policy, enrollment, deployment, renewal, revocation and reporting.
• Microsoft Active Directory Certificate Services (AD CS), enterprise CA hierarchy, certificate templates, auto-enrollment and CA security.
• X.509, TLS/mTLS, certificate chains, CSR, SAN, EKU, key usage, CRL, OCSP, AIA/CDP, PKCS standards and PEM/PFX/JKS/key stores.
• CLM product experience with at least one leading platform such as Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi TLS Protect, AppViewX or equivalent.
• Public and private CA integration; HSM and key-management integration; secure key generation, storage, backup & recovery.
• Certificate deployment across IIS, Apache, NGINX, Java, databases, load balancers, firewalls, proxies, network appliances and enterprise applications.
• ACME, SCEP, EST, REST API & agent/connector-based certificate automation.
• Operational monitoring, expiry alerting, service resilience, troubleshooting, audit evidence & lifecycle reporting.
• Active Directory, Entra ID, Windows Server and Group Policy.
• Linux administration and OpenSSL/key-store troubleshooting.
• Azure, AWS & GCP certificate and key-management services.
• Kubernetes, containers, ingress controllers, service identities and cert-manager or equivalent.
• DevOps and CI/CD integration, including Git-based workflows, pipelines, APIs and secrets handling.
• Network and application platforms such as load balancers, reverse proxies, firewalls, web servers and databases.
• HSMs, KMS, secrets-management platforms & privileged access controls.
• High availability, disaster recovery, monitoring, logging & IT service-management integration.

Requirements

Automation & Integration Skills (Highly Desired)

Key behaviours/competencies

• Essential or strongly preferred: relevant vendor implementation certification for the selected CLM platform, such as Keyfactor, DigiCert, Venafi or AppViewX administration/engineering certification.
• Highly desirable: Microsoft Windows Server Hybrid Administrator or equivalent demonstrable AD CS expertise.
• Highly desirable: CISSP, CCSP, CISM, SABSA or equivalent security/architecture qualification.
• Desirable: cloud certification in Azure, AWS or GCP.
• Desirable: Kubernetes certification such as CKA or CKS, where container certificate automation is in scope.
• Desirable: PKI, HSM or cryptography-focused professional training/certification.
• PQC-specific formal certification is not mandatory; practical knowledge of NIST PQC standards, crypto-agility, discovery and migration planning is required.
• PowerShell, Python and Bash scripting.
• REST APIs, JSON, OAuth/service authentication & secure automation patterns.
• Infrastructure as Code and configuration automation, such as Terraform, Ansible etc
• CI/CD platforms & Git-based source control.
• SQL/reporting & data analysis for certificate inventory, ownership & risk tracking.
• Hands-on delivery focus with the ability to move from architecture and design into implementation & troubleshooting.
• Proactive, risk-based & security-focused approach.
• Strong stakeholder management across EMEA entities & cross-region teams.
• Ability to translate technical PKI, certificate and PQC risks into clear business impact and remediation priorities.
• Strong written and verbal communication, including technical workshops and senior stakeholder updates.
• Good planning, prioritisation and dependency management across multiple onboarding waves.
• High-quality technical documentation and knowledge transfer.

Project details

• Start: flexible
• Remote: hybrid
• Location: City of London, London, GB
• Rate: 75-88 EUR/h