PKI Architect

Contract DV Cleared PKI Architect - Secure Platforms

Location: Fulltime onsite at a secure UK Site (Farnborough, Erskine or Newcastle with Two days a week in Corsham p/w)

Contract: Initial 7 Months - £96 p/h Inside IR35

Clearance: Active DV Clearance Required

We are seeking an experienced DV cleared PKI Architect to lead the design, implementation and assurance of enterprise PKI services within highly secure, air-gapped environments.

This is an opportunity to work on a critical UK Government programme, delivering the cryptographic trust services that underpin secure communications, authentication and identity across mission-critical infrastructure.

You'll provide technical leadership throughout the full life cycle of a secure PKI implementation, from architecture and design through to deployment, governance and operational assurance, working closely with infrastructure, security and engineering teams in high-assurance environments.

Essential Experience

• Proven experience as a PKI Architect or senior PKI Engineer within large enterprise environments.
• Strong experience designing and implementing PKI within secure or air-gapped environments.
• Excellent knowledge of: X.509 certificates, Certificate chains and trust models, Certificate life cycle management, CRL and OCSP architectures and Cryptographic policy and governance
• Experience designing secure operational models including dual control, separation of duties and privileged administration.
• Experience producing technical documentation including HLDs, LLDs, SOPs and operational runbooks.
• Strong understanding of cryptographic principles and secure key management.
• Experience working within environments aligned to UK Government and MOD security standards would be highly beneficial, including familiarity with: JSP 440, JSP 604, NCSC Security Design Principles, Secure by Design methodologies and Risk and assurance documentation supporting accreditation activities

Key Responsibilities

• Travel to Corsham site Two days per week
• Lead the architecture, design and implementation of enterprise PKI solutions within secure offline (air-gapped) environments.
• Design and implement PKI components including Offline Root CAs, Issuing CAs and Registration Authorities.
• Develop secure certificate life cycle processes covering issuance, renewal, revocation and recovery.
• Design secure certificate distribution and revocation mechanisms suitable for disconnected networks.
• Define cryptographic governance including Certificate Policies (CP), Certificate Practice Statements (CPS) and operational standards.
• Design secure key management processes including generation, storage, backup, recovery and destruction.
• Produce High Level Designs (HLDs), Low Level Designs (LLDs), operational procedures and technical documentation.
• Integrate PKI services with enterprise technologies including Microsoft Active Directory Certificate Services (AD CS), Group Policy, 802.1X, VPN, TLS, code signing and device identity services.
• Provide technical leadership during troubleshooting, incident response and continuous service improvement.
• Work closely with security architects, infrastructure teams and stakeholders to ensure solutions meet security and compliance requirements.

If you are an experienced PKI Architect looking to work on one of the UK's most technically challenging secure infrastructure programmes, we'd like to hear from you.