Job Description \n Security Engineer - PKI/CLM Implementation \n \n Inside IR35 - Up to £700 per day \n Hybrid in Central London \n 6-Month Initial Contract \n \n The role \n A leading financial services organisation is looking for a senior, hands-on PKI Security Engineer to lead the design, implementation and phased rollout of a Certificate Lifecycle Management (CLM) platform across its EMEA entities. You'll set up automated certificate discovery and lifecycle controls, integrate the platform with the enterprise PKI estate, and support post-quantum cryptography (PQC) risk assessment and remediation over the next 1 to 3 years. \n Key responsibilities \n \n Lead the CLM rollout from design and pilot through to production and operational handover. \n Build and maintain a central inventory of certificates, keys, trust stores, CAs, owners and dependencies. \n Integrate CLM with Microsoft AD CS, public CAs, HSMs, load balancers, network devices, servers, cloud, Kubernetes and DevOps pipelines. \n Automate the certificate lifecycle (request through to decommissioning) using ACME, SCEP, EST, APIs and agents. \n Design the CLM architecture, RBAC, security controls and operating processes in line with change governance. \n Plan onboarding waves with stakeholders, and remediate orphaned, expired, weak or manually managed certificates. \n Define monitoring, alerting, dashboards, audit evidence and KPIs/KRIs. \n Support cryptographic discovery for PQC, identify quantum-vulnerable algorithms and help shape migration plans. \n Produce HLDs, LLDs, runbooks and handover documentation, and act as PKI/CLM SME for teams across EMEA. \n \n Essential experience \n \n Substantial hands-on PKI/CLM implementation in complex enterprise environments, beyond BAU certificate administration. \n Proven delivery of an enterprise CLM platform across multiple business units, entities or regions. \n Strong PKI knowledge: root and issuing CAs, Microsoft AD CS, templates, CRL, OCSP, trust chains and HSM integration. \n Certificate lifecycle automation across Windows, Linux, network, cloud, container and DevOps environments. \n Experience with at least one leading CLM product (Keyfactor Command, DigiCert Trust Lifecycle Manager, Venafi, AppViewX or equivalent). \n Knowledge of X.509, TLS/mTLS, PKCS standards and key stores, with ACME, SCEP, EST and REST API integration. \n Working knowledge of crypto-agility, cryptographic inventory and PQC migration planning (NIST standards). \n Experience in regulated financial services or similarly controlled environments. \n \n Infrastructure and cloud skills \n Active Directory, Entra ID, Windows Server, Linux and OpenSSL; Azure, AWS and GCP key management; Kubernetes and cert-manager; CI/CD and Git workflows; HSMs, KMS and secrets management. \n Highly desired \n \n Scripting in PowerShell, Python and Bash, plus Terraform or Ansible. \n CLM vendor certification, and AD CS expertise (such as Windows Server Hybrid Administrator). \n CISSP, CCSP, CISM or SABSA, and cloud or Kubernetes certification (CKA, CKS) \n
Security Engineer - PKI/CLM Implementation - Inside IR35 - Up to £700 per day in Liverpool employer: Hunter Bond
Join our leading bank, where we prioritise employee growth and a collaborative work culture. As a KYC CLM AVP in London, you'll benefit from flexible working options and the chance to lead a dynamic team in a high-growth area, driving meaningful improvements in client experience and operational efficiency. We are committed to fostering an environment that encourages innovation and professional development, making us an excellent employer for those seeking a rewarding career in banking.
