PKI Security Engineer / CLM Implementation Engineer

Purpose of Role

looking for a highly experienced PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across EMEA. This will establish automated certificate discovery and lifecycle controls, integrate the platform with enterprise PKI and technology services, and progressively support post-quantum cryptography (PQC) risk assessment and remediation over the next 1-3 years.

What will this person be doing?

* Lead the end-to-end implementation and phased rollout of the selected CLM platform across EMEA, from design & pilot through production deployment & operational handover.

* Create & maintain a central inventory of certificates, keys, trust stores, issuing CAs, owners, dependencies, environments and associated business services.

* Integrate CLM with Microsoft AD CS, approved public CAs, HSMs, load balancers, network devices, Windows and Linux servers, cloud services, containers, Kubernetes, DevOps pipelines and enterprise applications.

* Automate certificate request, approval, issuance, deployment, renewal, revocation and decommissioning using ACME, SCEP, EST, APIs, agents and native connectors where appropriate.

* Design CLM architecture, trust boundaries, RBAC, service accounts, resilient components, security controls & operating processes aligned with our standards and change governance.

* Plan discovery and onboarding waves with application, infrastructure and entity stakeholders; identify certificate ownership & remediate orphaned, expired, weak or manually managed certificates.

* Define monitoring, alerting, dashboards, audit evidence, KPIs/KRIs and integration with security monitoring and IT service-management processes.

* Perform technical evaluation, testing and troubleshooting of CLM capabilities, connectors and integrations, including production-readiness and scalability assurance.

* Support cryptographic discovery and inventory for PQC, identify quantum-vulnerable algorithms and dependencies, maintain a risk-based remediation backlog and help develop migration plans over the next 1-3 years.

* Assess vendor and product crypto-agility, certificate and protocol dependencies, and readiness for NIST-standardised PQC algorithms & hybrid transition patterns.

* Produce & maintain HLD, LLD, runbooks, support procedures, standards, onboarding patterns, knowledge articles and operational handover documentation.

* Provide PKI/CLM SME guidance to application, infrastructure, cloud, DevOps, security, risk, audit & entity teams across EMEA.

Essential

Expected background

* Senior PKI / CLM engineer with substantial hands-on implementation experience in complex enterprise environments, not only BAU certificate administration.

* Proven delivery of an enterprise CLM platform across multiple business units, legal entities or regions, including discovery, pilot, rollout, integration & operational transition.

* Strong knowledge of PKI architecture and operations: root and issuing CAs, Microsoft AD CS, certificate templates, enrollment, CRL, OCSP, AIA/CDP, trust chains, key protection and HSM integration.

* Hands-on experience automating the X.509 certificate lifecycle across Windows, Linux, network, cloud, container, Kubernetes, application & DevOps environments.

* Experience integrating CLM through ACME, SCEP, EST, REST APIs, agents, connectors and CI/CD tooling.

* Working knowledge of cryptographic discovery, inventory, crypto-agility, CBOM concepts and risk-based migration planning for PQC.

* Experience in regulated financial-services or similarly controlled environments with strong audit, risk, change, resilience and segregation-of-duties requirements.

* Ability to coordinate technical delivery across entities, suppliers, application owners, infrastructure teams & security governance stakeholders.

Core PKI and CLM Technical Skills (Essential)

* Enterprise CLM implementation and administration: discovery, inventory, ownership, policy, enrollment, deployment, renewal, revocation and reporting.

* Microsoft Active Directory Certificate Services (AD CS), enterprise CA hierarchy, certificate templates, auto-enrollment and CA security.

* X.509, TLS/mTLS, certificate chains, CSR, SAN, EKU, key usage, CRL, OCSP, AIA/CDP, PKCS standards and PEM/PFX/JKS/key stores.

* CLM product experience with at least one leading platform such as Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi TLS Protect, AppViewX or equivalent.

* Public and private CA integration; HSM and key-management integration; secure key generation, storage, backup & recovery.

* Certificate deployment across IIS, Apache, NGINX, Java, databases, load balancers, firewalls, proxies, network appliances and enterprise applications.

* ACME, SCEP, EST, REST API & agent/connector-based certificate automation.

* Operational monitoring, expiry alerting, service resilience, troubleshooting, audit evidence & lifecycle reporting.

Infra & Cloud Skills

* Active Directory, Entra ID, Windows Server and Group Policy.

* Linux administration and OpenSSL/key-store troubleshooting.

* Azure, AWS & GCP certificate and key-management services.

* Kubernetes, containers, ingress controllers, service identities and cert-manager or equivalent.

* DevOps and CI/CD integration, including Git-based workflows, pipelines, APIs and secrets handling.

* Network and application platforms such as load balancers, reverse proxies, firewalls, web servers and databases.

* HSMs, KMS, secrets-management platforms & privileged access controls.

* High availability, disaster recovery, monitoring, logging & IT service-management integration.

Qualifications

* Essential or strongly preferred: relevant vendor implementation certification for the selected CLM platform, such as Keyfactor, DigiCert, Venafi or AppViewX administration/engineering certification.

* Highly desirable: Microsoft Windows Server Hybrid Administrator or equivalent demonstrable AD CS expertise.

* Highly desirable: CISSP, CCSP, CISM, SABSA or equivalent security/architecture qualification.

* Desirable: cloud certification in Azure, AWS or GCP.

* Desirable: Kubernetes certification such as CKA or CKS, where container certificate automation is in scope.

* Desirable: PKI, HSM or cryptography-focused professional training/certification.

* PQC-specific formal certification is not mandatory; practical knowledge of NIST PQC standards, crypto-agility, discovery and migration planning is required.

Automation & Integration Skills (Highly Desired)

* PowerShell, Python and Bash scripting.

* REST APIs, JSON, OAuth/service authentication & secure automation patterns.

* Infrastructure as Code and configuration automation, such as Terraform, Ansible etc

* CI/CD platforms & Git-based source control.

* SQL/reporting & data analysis for certificate inventory, ownership & risk tracking.

Key behaviours/competencies

* Hands-on delivery focus with the ability to move from architecture and design into implementation & troubleshooting.

* Proactive, risk-based & security-focused approach.

* Strong stakeholder management across EMEA entities & cross-region teams.

* Ability to translate technical PKI, certificate and PQC risks into clear business impact and remediation priorities.

* Strong written and verbal communication, including technical workshops and senior stakeholder updates.

* Good planning, prioritisation and dependency management across multiple onboarding waves.

* High-quality technical documentation and knowledge transfer.