PKI Security Engineer/CLM Implementation Engineer

looking for a highly experienced PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across EMEA. This will establish automated certificate discovery and life cycle controls, integrate the platform with enterprise PKI and technology services, and progressively support post-quantum cryptography (PQC) risk assessment and remediation over the next 1-3 years.

What will this person be doing?

• Lead the end-to-end implementation and phased rollout of the selected CLM platform across EMEA, from design & pilot through production deployment & operational handover.

• Create & maintain a central inventory of certificates, keys, trust stores, issuing CAs, owners, dependencies, environments and associated business services.

• Integrate CLM with Microsoft AD CS, approved public CAs, HSMs, load balancers, network devices, Windows and Linux Servers, cloud services, containers, Kubernetes, DevOps pipelines and enterprise applications.

• Automate certificate request, approval, issuance, deployment, renewal, revocation and decommissioning using ACME, SCEP, EST, APIs, agents and native connectors where appropriate.

• Design CLM architecture, trust boundaries, RBAC, service accounts, resilient components, security controls & operating processes aligned with our standards and change governance.

• Plan discovery and onboarding waves with application, infrastructure and entity stakeholders; identify certificate ownership & remediate orphaned, expired, weak or manually managed certificates.

• Define monitoring, alerting, dashboards, audit evidence, KPIs/KRIs and integration with security monitoring and IT service-management processes.

• Perform technical evaluation, testing and troubleshooting of CLM capabilities, connectors and integrations, including production-readiness and scalability assurance.

• Support cryptographic discovery and inventory for PQC, identify quantum-vulnerable algorithms and dependencies, maintain a risk-based remediation backlog and help develop migration plans over the next 1-3 years.

• Assess vendor and product crypto-agility, certificate and protocol dependencies, and readiness for NIST-standardised PQC algorithms & hybrid transition patterns.

• Produce & maintain HLD, LLD, runbooks, support procedures, standards, onboarding patterns, knowledge articles and operational handover documentation.

• Provide PKI/CLM SME guidance to application, infrastructure, cloud, DevOps, security, risk, audit & entity teams across EMEA.

• Senior PKI/CLM engineer with substantial hands-on implementation experience in complex enterprise environments, not only BAU certificate administration.

• Proven delivery of an enterprise CLM platform across multiple business units, legal entities or regions, including discovery, pilot, rollout, integration & operational transition.

• Strong knowledge of PKI architecture and operations: root and issuing CAs, Microsoft AD CS, certificate templates, enrollment, CRL, OCSP, AIA/CDP, trust chains, key protection and HSM integration.

• Hands-on experience automating the X.509 certificate life cycle across Windows, Linux, network, cloud, container, Kubernetes, application & DevOps environments.

• Experience integrating CLM through ACME, SCEP, EST, REST APIs, agents, connectors and CI/CD tooling.

• Working knowledge of cryptographic discovery, inventory, crypto-agility, CBOM concepts and risk-based migration planning for PQC.

• Experience in regulated financial-services or similarly controlled environments with strong audit, risk, change, resilience and segregation-of-duties requirements.

• Ability to coordinate technical delivery across entities, suppliers, application owners, infrastructure teams & security governance stakeholders.

Core PKI and CLM Technical Skills (Essential)

• Enterprise CLM implementation and administration: discovery, inventory, ownership, policy, enrollment, deployment, renewal, revocation and reporting.

• Microsoft Active Directory Certificate Services (AD CS), enterprise CA hierarchy, certificate templates, auto-enrollment and CA security.

• X.509, TLS/mTLS, certificate chains, CSR, SAN, EKU, key usage, CRL, OCSP, AIA/CDP, PKCS standards and PEM/PFX/JKS/key stores.

• CLM product experience with at least one leading platform such as Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi TLS Protect, AppViewX or equivalent.

• Public and private CA integration; HSM and key-management integration; secure key generation, storage, backup & recovery.

• Certificate deployment across IIS, Apache, NGINX, Java, databases, load balancers, Firewalls, proxies, network appliances and enterprise applications.

• ACME, SCEP, EST, REST API & agent/connector-based certificate automation.

• Operational monitoring, expiry alerting, service resilience, troubleshooting, audit evidence & life cycle reporting.

Infra & Cloud Skills

• Active Directory, Entra ID, Windows Server and Group Policy.

• Linux administration and OpenSSL/key-store troubleshooting.

• Azure, AWS & GCP certificate and key-management services.

• Kubernetes, containers, ingress controllers, service identities and cert-manager or equivalent.

• DevOps and CI/CD integration, including Git-based workflows, pipelines, APIs and secrets handling.

• Network and application platforms such as load balancers, reverse proxies, Firewalls, web Servers and databases.

• HSMs, KMS, secrets-management platforms & privileged access controls.

• High availability, disaster recovery, monitoring, logging & IT service-management integration.

Qualifications

• Essential or strongly preferred: relevant vendor implementation certification for the selected CLM platform, such as Keyfactor, DigiCert, Venafi or AppViewX administration/engineering certification.

• Highly desirable: Microsoft Windows Server Hybrid Administrator or equivalent demonstrable AD CS expertise.

• Highly desirable: CISSP, CCSP, CISM, SABSA or equivalent security/architecture qualification.

• Desirable: cloud certification in Azure, AWS or GCP.

• Desirable: Kubernetes certification such as CKA or CKS, where container certificate automation is in scope.

• Desirable: PKI, HSM or cryptography-focused professional training/certification.

• PQC-specific formal certification is not mandatory; practical knowledge of NIST PQC standards, crypto-agility, discovery and migration planning is required.

Automation & Integration Skills (Highly Desired)

• PowerShell, Python and Bash Scripting.

• REST APIs, JSON, OAuth/service authentication & secure automation patterns.

• Infrastructure as Code and configuration automation, such as Terraform, Ansible etc

• CI/CD platforms & Git-based source control.

• SQL/reporting & data analysis for certificate inventory, ownership & risk tracking.

Key behaviours/competencies

• Hands-on delivery focus with the ability to move from architecture and design into implementation & troubleshooting.

• Proactive, risk-based & security-focused approach.

• Strong stakeholder management across EMEA entities & cross-region teams.

• Ability to translate technical PKI, certificate and PQC risks into clear business impact and remediation priorities.

• Strong written and verbal communication, including technical workshops and senior stakeholder updates.

• Good planning, prioritisation and dependency management across multiple onboarding waves.

• High-quality technical documentation and knowledge transfer.