Security Engineer - PKI/CLM Implementation - Inside IR35 - Up to £700 per day

Security Engineer - PKI/CLM Implementation

• Inside IR35 - Up to £700 per day
• Hybrid in Central London
• 6-Month Initial Contract

The role
A leading financial services organisation is looking for a senior, hands-on PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across its EMEA entities. You'll set up automated certificate discovery and lifecycle controls, integrate the platform with the enterprise PKI estate, and support post-quantum cryptography (PQC) risk assessment and remediation over the next 1 to 3 years.

Key responsibilities

• Lead the CLM rollout from design and pilot through to production and operational handover.
• Build and maintain a central inventory of certificates, keys, trust stores, CAs, owners and dependencies.
• Integrate CLM with Microsoft AD CS, public CAs, HSMs, load balancers, network devices, servers, cloud, Kubernetes and DevOps pipelines.
• Automate the certificate lifecycle (request through to decommissioning) using ACME, SCEP, EST, APIs and agents.
• Design the CLM architecture, RBAC, security controls and operating processes in line with change governance.
• Plan onboarding waves with stakeholders, and remediate orphaned, expired, weak or manually managed certificates.
• Define monitoring, alerting, dashboards, audit evidence and KPIs/KRIs.
• Support cryptographic discovery for PQC, identify quantum-vulnerable algorithms and help shape migration plans.
• Produce HLDs, LLDs, runbooks and handover documentation, and act as PKI/CLM SME for teams across EMEA.

Essential experience

• Substantial hands-on PKI/CLM implementation in complex enterprise environments, beyond BAU certificate administration.
• Proven delivery of an enterprise CLM platform across multiple business units, entities or regions.
• Strong PKI knowledge: root and issuing CAs, Microsoft AD CS, templates, CRL, OCSP, trust chains and HSM integration.
• Certificate lifecycle automation across Windows, Linux, network, cloud, container and DevOps environments.
• Experience with at least one leading CLM product (Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi, AppViewX or equivalent).
• Knowledge of X.509, TLS/mTLS, PKCS standards and key stores, with ACME, SCEP, EST and REST API integration.
• Working knowledge of crypto-agility, cryptographic inventory and PQC migration planning (NIST standards).
• Experience in regulated financial services or similarly controlled environments.

Infrastructure and cloud skills
Active Directory, Entra ID, Windows Server, Linux and OpenSSL; Azure, AWS and GCP key management; Kubernetes and cert-manager; CI/CD and Git workflows; HSMs, KMS and secrets management.

Highly desired

• Scripting in PowerShell, Python and Bash, plus Terraform or Ansible.
• CLM vendor certification, and AD CS expertise (such as Windows Server Hybrid Administrator).
• CISSP, CCSP, CISM or SABSA, and cloud or Kubernetes certification (CKA, CKS)