PKI Security Engineer / CLM Implementation Engineer @ Harvey Nash

Salary: £33,000 - 65,000 per year

Requirements

• Substantial hands-on experience as a senior PKI or CLM engineer implementing solutions in complex enterprise environments, beyond BAU certificate administration.
• Proven delivery of an enterprise CLM platform across multiple business units, legal entities, or regions, including discovery, pilot, rollout, integration, and operational transition.
• Strong knowledge of PKI architecture and operations, including root and issuing CAs, Microsoft AD CS, certificate templates, enrollment, CRL, OCSP, AIA/CDP, trust chains, key protection, and HSM integration.
• Hands-on experience automating the X.509 certificate lifecycle across Windows, Linux, network, cloud, container, Kubernetes, application, and DevOps environments.
• Experience integrating CLM through ACME, SCEP, EST, REST APIs, agents, connectors, and CI/CD tooling.
• Working knowledge of cryptographic discovery, inventory, crypto-agility, CBOM concepts, and risk-based migration planning for PQC.
• Experience in regulated financial services or similarly controlled environments, with audit, risk, change, resilience, and segregation-of-duties requirements.
• Ability to coordinate technical delivery across entities, suppliers, application owners, infrastructure teams, and security governance stakeholders.
• Enterprise CLM implementation and administration skills, including discovery, inventory, ownership, policy, enrollment, deployment, renewal, revocation, and reporting.
• Knowledge of Microsoft Active Directory Certificate Services (AD CS), enterprise CA hierarchies, certificate templates, auto-enrollment, and CA security.
• Knowledge of X.509, TLS/mTLS, certificate chains, CSR, SAN, EKU, key usage, CRL, OCSP, AIA/CDP, PKCS standards, and PEM/PFX/JKS/keystores.
• Experience with at least one leading CLM platform, such as Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi TLS Protect, AppViewX, or equivalent.
• Experience integrating public and private CAs, HSMs, and key-management systems, including secure key generation, storage, backup, and recovery.
• Experience deploying certificates across IIS, Apache, NGINX, Java, databases, load balancers, firewalls, proxies, network appliances, and enterprise applications.
• Experience with ACME, SCEP, EST, REST APIs, and agent- or connector-based certificate automation.
• Knowledge of operational monitoring, expiry alerting, service resilience, troubleshooting, audit evidence, and lifecycle reporting.
• Experience with Active Directory, Entra ID, Windows Server, and Group Policy.
• Linux administration and OpenSSL/keystore troubleshooting skills.
• Knowledge of Azure, AWS, and GCP certificate and key-management services.
• Experience with Kubernetes, containers, ingress controllers, service identities, and cert-manager or equivalent.
• Experience integrating DevOps and CI/CD, including Git-based workflows, pipelines, APIs, and secrets handling.
• Knowledge of network and application platforms, including load balancers, reverse proxies, firewalls, web servers, and databases.
• Knowledge of HSMs, KMS, secrets-management platforms, privileged access controls, high availability, disaster recovery, monitoring, logging, and IT service-management integration.
• Relevant vendor implementation certification for the selected CLM platform is essential or strongly preferred; examples include Keyfactor, DigiCert, Venafi, or AppViewX administration/engineering certification.
• Microsoft Windows Server Hybrid Administrator certification or equivalent demonstrable AD CS expertise is highly desirable.
• CISSP, CCSP, CISM, SABSA, or equivalent security/architecture qualification is highly desirable.
• Azure, AWS, or GCP cloud certification is desirable.
• Kubernetes certification such as CKA or CKS is desirable where container certificate automation is in scope.
• PKI-, HSM-, or cryptography-focused professional training or certification is desirable.
• Formal PQC-specific certification is not mandatory; practical knowledge of NIST PQC standards, crypto-agility, discovery, and migration planning is required.
• PowerShell, Python, and Bash scripting skills are highly desired.
• Experience with REST APIs, JSON, OAuth/service authentication, and secure automation patterns is highly desired.
• Experience with Infrastructure as Code and configuration automation, such as Terraform and Ansible, is highly desired.
• Experience with CI/CD platforms, Git-based source control, SQL/reporting, and data analysis for certificate inventory, ownership, and risk tracking is highly desired.
• Hands-on delivery focus, with the ability to move from architecture and design into implementation and troubleshooting.
• Proactive, risk-based, and security-focused approach.
• Strong stakeholder management across EMEA entities and cross-region teams.
• Ability to translate technical PKI, certificate, and PQC risks into clear business impact and remediation priorities.
• Strong written and verbal communication skills, including technical workshops and senior stakeholder updates.
• Good planning, prioritisation, and dependency management across multiple onboarding waves.
• High-quality technical documentation and knowledge-transfer skills.

Responsibilities

• Lead the end-to-end implementation and phased rollout of the selected CLM platform across EMEA, from design and pilot through production deployment and operational handover.
• Create and maintain a central inventory of certificates, keys, trust stores, issuing CAs, owners, dependencies, environments, and associated business services.
• Integrate CLM with Microsoft AD CS, approved public CAs, HSMs, load balancers, network devices, Windows and Linux servers, cloud services, containers, Kubernetes, DevOps pipelines, and enterprise applications.
• Automate certificate request, approval, issuance, deployment, renewal, revocation, and decommissioning using ACME, SCEP, EST, APIs, agents, and native connectors where appropriate.
• Design CLM architecture, trust boundaries, RBAC, service accounts, resilient components, security controls, and operating processes aligned with our standards and change governance.
• Plan discovery and onboarding waves with application, infrastructure, and entity stakeholders; identify certificate ownership and remediate orphaned, expired, weak, or manually managed certificates.
• Define monitoring, alerting, dashboards, audit evidence, KPIs/KRIs, and integration with security monitoring and IT service-management processes.
• Perform technical evaluation, testing, and troubleshooting of CLM capabilities, connectors, and integrations, including production-readiness and scalability assurance.
• Support cryptographic discovery and inventory for PQC; identify quantum-vulnerable algorithms and dependencies; maintain a risk-based remediation backlog; and help develop migration plans over the next 1–3 years.
• Assess vendor and product crypto-agility, certificate and protocol dependencies, and readiness for NIST-standardised PQC algorithms and hybrid transition patterns.
• Produce and maintain HLDs, LLDs, runbooks, support procedures, standards, onboarding patterns, knowledge articles, and operational handover documentation.
• Provide PKI/CLM subject-matter expertise to application, infrastructure, cloud, DevOps, security, risk, audit, and entity teams across EMEA.

Technologies

• AWS
• Active Directory
• Ansible
• Azure
• Bash
• CI/CD
• Cloud
• Cryptography
• DevOps
• GCP
• Git
• HSM
• Support
• JSON
• Java
• Kubernetes
• Linux
• Network
• Nginx
• OAuth
• PowerShell
• Python
• REST
• RBAC
• SQL
• Security
• Terraform
• Web
• Windows
• API

More

We are a global banking business offering the opportunity to join our EMEA-focused security work. In this role, you will lead the implementation of a Certificate Lifecycle Management platform and support cryptographic risk assessment and post-quantum cryptography remediation over the next 1–3 years.

last updated 46 week of 2026