Security Engineer - PKI​/CLM Implementation - IR35

Position: Security Engineer - PKI/CLM Implementation - Inside IR35 - Up to ?700
Location: City Of London

Security Engineer – PKI/CLM Implementation

• Inside IR35 – Up to GBP
  700 per day
• Hybrid in Central London
• 6–Month Initial Contract

The role

A leading financial services organisation is looking for a senior, hands–on PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across its EMEA entities. You'll set up automated certificate discovery and lifecycle controls, integrate the platform with the enterprise PKI estate, and support post–quantum cryptography (PQC) risk assessment and remediation over the next 1 to 3 years.

Key

responsibilities

• Lead the CLM rollout from design and pilot through to production and operational handover.
• Build and maintain a central inventory of certificates, keys, trust stores, CAs, owners and dependencies.
• Integrate CLM with Microsoft AD CS, public CAs, HSMs, load balancers, network devices, servers, cloud, Kubernetes and Dev Ops pipelines.
• Automate the certificate lifecycle (request through to decommissioning) using ACME, SCEP, EST, APIs and agents.
• Design the CLM architecture, RBAC, security controls and operating processes in line with change governance.
• Plan onboarding waves with stakeholders, and remediate orphaned, expired, weak or manually managed certificates.
• Define monitoring, alerting, dashboards, audit evidence and KPIs/KRIs.
• Support cryptographic discovery for PQC, identify quantum–vulnerable algorithms and help shape migration plans.
• Produce HLDs, LLDs, runbooks and handover documentation, and act as PKI/CLM SME for teams across EMEA.

Essential experience

• Substantial hands–on PKI/CLM implementation in complex enterprise environments, beyond BAU certificate administration.
• Proven delivery of an enterprise CLM platform across multiple business units, entities or regions.
• Strong PKI knowledge: root and issuing CAs, Microsoft AD CS, templates, CRL, OCSP, trust chains and HSM integration.
• Certificate lifecycle automation across Windows, Linux, network, cloud, container and Dev Ops environments.
• Experience with at least one leading CLM product (Keyfactor Command, Digi Cert Trust Lifecycle Manager, Venafi, AppViewX or equivalent).
• Knowledge of X.509, TLS/mTLS, PKCS standards and key stores, with ACME, SCEP, EST and REST API integration.
• Working knowledge of crypto–agility, cryptographic inventory and PQC migration planning (NIST standards).
• Experience in regulated financial services or similarly controlled environments.

Infrastructure and cloud skills

Active Directory, Entra , Windows Server, Linux and OpenSSL;
Azure, AWS and GCP key management;
Kubernetes and cert–manager; CI/CD and Git workflows; HSMs, KMS and secrets management.

Highly desired

• Scripting in Power Shell, Python and Bash, plus Terraform or Ansible.
• CLM vendor certification, and AD CS expertise (such as Windows Server Hybrid Administrator).
• CISSP, CCSP, CISM or SABSA, and cloud or Kubernetes certification (CKA, CKS)