PKI Security Engineer / CLM Implementation Engineer

PKI Security Engineer / CLM Implementation Engineer in City of London (EC1), EC1 | Harvey Nash Find a job Post a job Sign up Never miss an opportunity. We’ll find jobs that fit Get Started Search These jobs were popular with other job seekers Mac Infrastructure Engineer Invitise Ltd City of London (EC1A) Up to £700 per day 23 hours ago NEW Contract Cyber Security Engineer Coburg Banks Limited Birmingham (B1), B1 £450 - £500 per day 22 hours ago NEW Azure Infrastructure Engineer DGH Recruitment City of London (EC1), EC1 £65000 - £75000 per annum + Benefits 21 hours ago NEW Infrastructure Engineer Xcede London £550 - £600 per day 1 day ago Platform Engineer (DV) - £440 per day Inside IR35 - Wiltshire (Hybrid) Exalto Consulting ltd Wiltshire Up to £440 per day Inside IR35 22 hours ago NEW Senior Linux Systems Administrator-LAMP Morson Edge Brompton, South West London (SW10), SW10 0AA £450 - 500 per day 1 day ago AD Engineer Xcede London Competitive 1 day ago Solutions Architect Lynx Recruitment Limited South West London (SW1E) From £60,000 to £80,000 per annum 1 day ago Infrastructure Engineer TXP London £500 - £501 per day 2 days ago Infrastructure Engineer VIQU IT Recruitment The City, City of London (EC2), EC1Y 1BE £450 - 550 per day 1 day ago PKI Security Engineer / CLM Implementation Engineer Harvey Nash City of London (EC1), EC1 Temporary Contract; Hybrid Published: 22 hours ago £600 - £700 per day Apply Save PKI Security Engineer / CLM Implementation Engineer Harvey Nash Apply Fantastic opportunity to join a global banking business. Purpose of Role looking for a highly experienced PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across EMEA. This will establish automated certificate discovery and lifecycle controls, integrate the platform with enterprise PKI and technology services, and progressively support post-quantum cryptography (PQC) risk assessment and remediation over the next 1-3 years. What will this person be doing? * Lead the end-to-end implementation and phased rollout of the selected CLM platform across EMEA, from design & pilot through production deployment & operational handover. * Create & maintain a central inventory of certificates, keys, trust stores, issuing CAs, owners, dependencies, environments and associated business services. * Integrate CLM with Microsoft AD CS, approved public CAs, HSMs, load balancers, network devices, Windows and Linux servers, cloud services, containers, Kubernetes, DevOps pipelines and enterprise applications. * Automate certificate request, approval, issuance, deployment, renewal, revocation and decommissioning using ACME, SCEP, EST, APIs, agents and native connectors where appropriate. * Design CLM architecture, trust boundaries, RBAC, service accounts, resilient components, security controls & operating processes aligned with our standards and change governance. * Plan discovery and onboarding waves with application, infrastructure and entity stakeholders; identify certificate ownership & remediate orphaned, expired, weak or manually managed certificates. * Define monitoring, alerting, dashboards, audit evidence, KPIs/KRIs and integration with security monitoring and IT service-management processes. * Perform technical evaluation, testing and troubleshooting of CLM capabilities, connectors and integrations, including production-readiness and scalability assurance. * Support cryptographic discovery and inventory for PQC, identify quantum-vulnerable algorithms and dependencies, maintain a risk-based remediation backlog and help develop migration plans over the next 1-3 years. * Assess vendor and product crypto-agility, certificate and protocol dependencies, and readiness for NIST-standardised PQC algorithms & hybrid transition patterns. * Produce & maintain HLD, LLD, runbooks, support procedures, standards, onboarding patterns, knowledge articles and operational handover documentation. * Provide PKI/CLM SME guidance to application, infrastructure, cloud, DevOps, security, risk, audit & entity teams across EMEA. Person Specification Essential Expected background * Senior PKI / CLM engineer with substantial hands-on implementation experience in complex enterprise environments, not only BAU certificate administration. * Proven delivery of an enterprise CLM platform across multiple business units, legal entities or regions, including discovery, pilot, rollout, integration & operational transition. * Strong knowledge of PKI architecture and operations: root and issuing CAs, Microsoft AD CS, certificate templates, enrollment, CRL, OCSP, AIA/CDP, trust chains, key protection and HSM integration. * Hands-on experience automating the X.509 certificate lifecycle across Windows, Linux, network, cloud, container, Kubernetes, application & DevOps environments. * Experience integrating CLM through ACME, SCEP, EST, REST APIs, agents, connectors and CI/CD tooling. * Working knowledge of cryptographic discovery, inventory, crypto-agility, CBOM concepts and risk-based migration planning for PQC. * Experience in regulated financial-services or similarly controlled environments with strong audit, risk, change, resilience and segregation-of-duties requirements. * Ability to coordinate technical delivery across entities, suppliers, application owners, infrastructure teams & security governance stakeholders. Core PKI and CLM Technical Skills (Essential) * Enterprise CLM implementation and administration: discovery, inventory, ownership, policy, enrollment, deployment, renewal, revocation and reporting. * Microsoft Active Directory Certificate Services (AD CS), enterprise CA hierarchy, certificate templates, auto-enrollment and CA security. * X.509, TLS/mTLS, certificate chains, CSR, SAN, EKU, key usage, CRL, OCSP, AIA/CDP, PKCS standards and PEM/PFX/JKS/key stores. * CLM product experience with at least one leading platform such as Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi TLS Protect, AppViewX or equivalent. * Public and private CA integration; HSM and key-management integration; secure key generation, storage, backup & recovery. * Certificate deployment across IIS, Apache, NGINX, Java, databases, load balancers, firewalls, proxies, network appliances and enterprise applications. * ACME, SCEP, EST, REST API & agent/connector-based certificate automation. * Operational monitoring, expiry alerting, service resilience, troubleshooting, audit evidence & lifecycle reporting. Infra & Cloud Skills * Active Directory, Entra ID, Windows Server and Group Policy. * Linux administration and OpenSSL/key-store troubleshooting. * Azure, AWS & GCP certificate and key-management services. * Kubernetes, containers, ingress controllers, service identities and cert-manager or equivalent. * DevOps and CI/CD integration, including Git-based workflows, pipelines, APIs and secrets handling. * Network and application platforms such as load balancers, reverse proxies, firewalls, web servers and databases. * HSMs, KMS, secrets-management platforms & privileged access controls. * High availability, disaster recovery, monitoring, logging & IT service-management integration. Qualifications * Essential or strongly preferred: relevant vendor implementation certification for the selected CLM platform, such as Keyfactor, DigiCert, Venafi or AppViewX administration/engineering certification. * Highly desirable: Microsoft Windows Server Hybrid Administrator or equivalent demonstrable AD CS expertise. * Highly desirable: CISSP, CCSP, CISM, SABSA or equivalent security/architecture qualification. * Desirable: cloud certification in Azure, AWS or GCP. * Desirable: Kubernetes certification such as CKA or CKS, where container certificate automation is in scope. * Desirable: PKI, HSM or cryptography-focused professional training/certification. * PQC-specific formal certification is not mandatory; practical knowledge of NIST PQC standards, crypto-agility, discovery and migration planning is required. Automation & Integration Skills (Highly Desired) * PowerShell, Python and Bash scripting. * REST APIs, JSON, OAuth/service authentication & secure automation patterns. * Infrastructure as Code and configuration automation, such as Terraform, Ansible etc * CI/CD platforms & Git-based source control. * SQL/reporting & data analysis for certificate inventory, ownership & risk tracking. Key behaviours/competencies * Hands-on delivery focus with the ability to move from architecture and design into implementation & troubleshooting. * Proactive, risk-based & security-focused approach. * Strong stakeholder management across EMEA entities & cross-region teams. * Ability to translate technical PKI, certificate and PQC risks into clear business impact and remediation priorities. * Strong written and verbal communication, including technical workshops and senior stakeholder updates. * Good planning, prioritisation and dependency management across multiple onboarding waves. * High-quality technical documentation and knowledge transfer. Apply Harvey Nash Banking and Financial Services 27 Reviews Similar Pki Security Engineer / Clm Implementation Engineer Jobs Popular with Other Job Seekers Mac Infrastructure Engineer Invitise Ltd City of London (EC1A) Up to £700 per day 23 hours ago NEW Contract Cyber Security Engineer Coburg Banks Limited Birmingham (B1), B1 £450 - £500 per day 22 hours ago NEW Azure Infrastructure Engineer DGH Recruitment City of London (EC1), EC1 £65000 - £75000 per annum + Benefits 21 hours ago NEW Infrastructure Engineer Xcede London £550 - £600 per day 1 day ago Platform Engineer (DV) - £440 per day Inside IR35 - Wiltshire (Hybrid) Exalto Consulting ltd Wiltshire Up to £440 per day Inside IR35 22 hours ago NEW Senior Linux Systems Administrator-LAMP Morson Edge Brompton, South West London (SW10), SW10 0AA £450 - 500 per day 1 day ago AD Engineer Xcede London Competitive 1 day ago Solutions Architect Lynx Recruitment Limited South West London (SW1E) From £60,000 to £80,000 per annum 1 day ago Infrastructure Engineer TXP London £500 - £501 per day 2 days ago Infrastructure Engineer VIQU IT Recruitment The City, City of London (EC2), EC1Y 1BE £450 - 550 per day 1 day ago PKI Security Engineer / CLM Implementation Engineer jobs PKI Security Engineer / CLM Implementation Engineer jobs in City Of London IT jobs IT jobs in City Of London Infrastructure jobs Infrastructure jobs in City Of London Jobs in City Of London Full Time jobs Christmas jobs Weekend jobs Retail jobs Amazon Warehouse Operative jobs Night Shift jobs NHS jobs HGV jobs Warehouse jobs Cleaning jobs No Experience jobs Administration jobs Remote jobs Admin jobs Evening jobs Tesco jobs Get hired. Find success. Get started Totaljobs About us Careers at Totaljobs Press Partners Privacy policy Terms and conditions Cookies Legal and compliance Accessibility Jobseekers Salary Planner Jobseeker help centre Career advice Recruiters Post job ads Recruiting news Courses Contact us - recruiters Recruit internationally Download App store Play store The Stepstone Group UK Ltd © 2026 We use cookies We use cookies to operate our website, measure how people use our services to help us improve them, enrich usage profiles and personalise the content displayed to you. We also share information about your use of our site with our social media, advertising, and analytics partners, who may combine it with other information, to show you relevant ads on other websites, and to measure the performance of our advertising. Some cookies are essential for the operation of our website. If you would prefer us not to use the non-essential cookies, click “Just necessary”, but please be aware that this may impact your experience of our site and the services we are able to offer. Click “Accept” if you’re happy for us to place these cookies. You can change your mind at any time. Store and / or access information on a device Cookies, device identifiers, or other information can be stored or accessed on your device for the purposes presented to you. Personalised ads and content, ad and content measurement, audience insights and product development Ads and content can be personalised based on a profile. More data can be added to better personalise ads and content. The performance of ads and content can be measured. Insights about audiences who have viewed the ads and content can be extracted. Data can be used to build or improve user experience, systems and software. Display third-party content (social networks, videos) Content from social networks and embedded content from third-party providers can be displayed. Identifiers derived from authentications If an identifier is created based on authentication data, such as contact details associated with online accounts you have set up on websites or apps (e.g. email address, phone number) or customer identifiers (e.g. an identifier provided by your telecommunications provider), then this identifier can be used to recognize you across websites, apps and devices if you are logged in with the same contact details. Just Necessary Accept All Cookie Settings You can also exercise your right to object to data processing based on legitimate interests under “Privacy Policy”. Privacy Policy Cookie policy