Requirements

• Proven experience designing and delivering enterprise PKI environments from inception through production operation.
• Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures.
• 10+ years of experience working with enterprise PKI, trust services, or cryptographic infrastructure.
• Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance.
• Experience implementing and operating HSM-backed PKI environments.
• Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains.
• Proven experience leading PKI programmes or transformations across multiple organisations.
• Ability to engage effectively with senior stakeholders, architects, engineers, auditors, and operational teams.

Nice to haves

• Experience with Venafi, Keyfactor, DigiCert Trust Lifecycle Manager, Sectigo, EJBCA, HashiCorp Vault, or equivalent platforms.
• Experience with Microsoft Active Directory Certificate Services (AD CS) design and migration programmes.
• Experience implementing PKI within AWS, Azure, Kubernetes, and hybrid cloud environments.
• Experience supporting financial services, regulated industries, or large-scale enterprise environments.
• Relevant industry certifications in security, architecture, cloud, or cryptography.

What you'll be doing

• Design and deliver enterprise-grade PKI architecture and supporting operational model.
• Design and implement root and issuing Certificate Authority (CA) hierarchies.
• Define certificate policies, profiles, naming standards, trust models, and operational controls.
• Design resilient, highly available PKI infrastructure and supporting services.
• Lead implementation and migration of PKI platforms, tooling, and supporting infrastructure.
• Define disaster recovery, backup, recovery, and key protection requirements for PKI services.
• Design and oversee Hardware Security Module (HSM) integration and key management processes.
• Establish operational procedures for certificate issuance, renewal, revocation, recovery, and lifecycle management.
• Ensure solutions are scalable, supportable, and aligned with security and regulatory requirements.
• Serve as the organisation's recognised PKI authority and trusted advisor.
• Provide expert guidance on certificate authority design, trust models, lifecycle management, revocation strategies, and key protection.
• Advise engineering and platform teams on PKI integration requirements and best practices.
• Review proposed solutions to ensure alignment with PKI standards and architectural principles.
• Provide technical leadership for complex PKI initiatives and problem resolution.
• Develop enterprise approaches for managing machine identities at scale.
• Design and implement automated certificate issuance, renewal, rotation, and revocation processes.
• Support certificate management across infrastructure, cloud, container, networking, and application environments.
• Reduce operational risk associated with certificate expiry and trust failures.
• Define standards for certificate discovery, inventory, monitoring, and reporting.
• Work closely with infrastructure, engineering, cloud, security, risk, and operational teams.
• Translate complex PKI and cryptographic concepts into clear business and technical recommendations.
• Develop PKI standards, policies, procedures, and governance documentation.
• Support audits and regulatory reviews relating to cryptographic and PKI controls.
• Influence technical direction and ensure PKI considerations are embedded within strategic initiatives.

Perks and benefits

• Fixed Term Contract.
• Hybrid working model.
• London-based role.
• Competitive package dependent on experience.