Senior PKI & Certificate Lifecycle Engineer (CyberArk CLM / ZTPKI) in London

The Role

Responsible for implementation and operations of CyberArk Zero Touch PKI (ZTPKI) and Certificate Lifecycle Management (CLM SaaS) platforms to secure machine identities across hybrid and cloud environments. The role focuses on certificate automation, PKI modernization and SaaS-based cryptographic lifecycle management.

Your responsibilities:

• Manage ZPKI end to end

• Implement CyberArk Zero Touch PKI (PKI-as-a-Service) for enterprise workloads

• Configure certificate issuance policies, templates, and trust chains

• Manage HSM-backed key security and compliance controls

• Support auto-enrollment (SCEP, EST, ACME, REST APIs)

• Drive migration from legacy PKI (ADCS, EJBCA, etc.) to SaaS PKI

• Implement and manage CyberArk Certificate Manager (CLM SaaS)

• Automate Certificate discovery, Issuance, renewal, revocation, Key rotation and lifecycle governance

• Define certificate policies, approval workflows, and compliance controls

• Ensure TLS/mTLS certificate governance across applications, APIs, and infrastructure

• Integrate CLM/ZTPKI with AWS / Azure, Kubernetes (cert-manager), CI/CD pipelines

• Implement API driven certificate provisioning

• Enable machine identity security across cloud-native workloads

• Troubleshoot Certificate expiry / outages, PKI chain issues, TLS handshake failures

• Monitor Certificate inventory, Expiry alerts, Compliance posture

• Support incident response for certificate-related outages

Essential skills/knowledge/experience:

• Minimum 4+ years of experience in working with Venafi SAAS based tool

• Experience with CyberArk Certificate Manager (Venafi), Zero Touch PKI (ZTPKI)

• Strong understanding of PKI concepts (CA, CSR, CRL, OCSP), X.509 certificates, TLS/mTLS

• Knowledge of Certificate lifecycle automation, Policy-based certificate issuance

• Experience in automation integration with PKI solutions

Desirable skills/knowledge/experience:

• Good to have Firewall and network fundamentals

• Good to have exposure to DevSecOps pipelines