Enterprise PKI Specialist (Contractor)

Enterprise PKI Specialist (Fixed Term Contract)     The Enterprise PKI Specialist is a senior technical specialist responsible for the design, implementation, governance, and evolution of Public Key Infrastructure (PKI) services across Qube Research & Technologies (QRT).     The successful candidate will serve as the organisation’s primary PKI subject matter expert, providing strategic guidance, architectural leadership, hands-on engineering expertise, and technical governance across all PKI-related initiatives.     This is a highly specialised role requiring extensive experience designing, building, and modernising PKI environments within large enterprises. The successful candidate will have a proven track record of delivering PKI programmes from initial requirements gathering and architecture design through to implementation, operationalisation, and long-term governance.     PKI Architecture & Delivery   • Design and deliver enterprise  grade  PKI architecture and supporting operational  model .   • Design and implement root and issuing Certificate Authority (CA) hierarchies.   • Define certificate policies, certificate profiles, naming standards, trust models, and operational controls.   • Design resilient,  highly available  PKI infrastructure and supporting services.   • Lead the implementation and migration of PKI platforms, tooling, and supporting infrastructure.   • Define disaster recovery, backup, recovery, and key protection requirements for PKI services.   • Design and oversee Hardware Security Module (HSM) integration and key management processes.   • Establish operational procedures for certificate issuance, renewal, revocation, recovery, and lifecycle management.   • Ensure solutions are scalable, supportable, and aligned with security and regulatory requirements.   PKI Subject Matter Expertise   • Act as the  organisation’s   recognised  PKI authority and trusted advisor.   • Provide  expert guidance on certificate authority design, trust models, certificate lifecycle management, revocation strategies, and key protection.   • Advise  engineering and platform teams on PKI integration requirements and best practices.   • Review proposed solutions and ensure alignment with established PKI standards and architectural principles.   • Provide technical leadership for complex PKI-related initiatives and problem resolution.   Machine Identity & Certificate Lifecycle Management   • Develop enterprise approaches for managing machine identities at scale.   • Design and implement automated  certificate  issuance, renewal, rotation, and revocation processes.   • Support certificate management across infrastructure, cloud, container, networking, and application environments.   • Reduce operational risk associated with certificate expiry and trust failures.   • Define standards for certificate discovery, inventory, monitoring, and reporting.   Stakeholder Engagement & Governance   • Work closely with infrastructure, engineering, cloud, security, risk, and operational teams.   • Translate complex PKI and cryptographic concepts into clear business and technical recommendations.   • Develop PKI standards, policies, procedures, and governance documentation.   • Support audits and regulatory reviews relating to cryptographic and PKI controls.   • Influence technical direction and ensure PKI considerations are embedded within strategic initiatives.   Essential Skills & Experience   • Proven experience designing and delivering enterprise PKI environments from  inception  through production  operation .   • Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures.   • 10+ years of experience working with enterprise PKI, trust services, or cryptographic infrastructure.   • Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance.   • Experience implementing and operating HSM-backed PKI environments.   • Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains.   • Proven experience leading PKI  programmes  or transformations across multiple  organisations .   • Ability to engage effectively with senior stakeholders, architects, engineers, auditors, and operational teams.   Desirable Skills & Experience   • Experience with Venafi,  Keyfactor , DigiCert Trust Lifecycle Manager,  Sectigo , EJBCA,  HashiCorp  Vault, or equivalent platforms.   • Experience with Microsoft Active Directory Certificate Services (AD CS) design and migration  programmes .   • Experience implementing PKI within AWS, Azure, Kubernetes, and hybrid cloud environments.   • Experience supporting financial services, regulated industries, or large-scale enterprise environments.   • Relevant industry certifications in security, architecture, cloud, or cryptography.   Contract Details   • Fixed Term Contract   • Hybrid working model   • London-based role   • Competitive package dependent on experience