Enterprise PKI Specialist (Contractor)

Enterprise PKI Specialist (Fixed Term Contract) The Enterprise PKI Specialist is a senior technical specialist responsible for the design, implementation, governance, and evolution of Public Key Infrastructure (PKI) services across Qube Research & Technologies (QRT). The successful candidate will serve as the organisation's primary PKI subject matter expert, providing strategic guidance, architectural leadership, hands-on engineering expertise, and technical governance across all PKI-related initiatives. This is a highly specialised role requiring extensive experience designing, building, and modernising PKI environments within large enterprises. The successful candidate will have a proven track record of delivering PKI programmes from initial requirements gathering and architecture design through to implementation, operationalisation, and long-term governance. PKI Architecture & Delivery Design and deliver enterprise grade PKI architecture and supporting operational model . Design and implement root and issuing Certificate Authority (CA) hierarchies. Define certificate policies, certificate profiles, naming standards, trust models, and operational controls. Design resilient, highly available PKI infrastructure and supporting services. Lead the implementation and migration of PKI platforms, tooling, and supporting infrastructure. Define disaster recovery, backup, recovery, and key protection requirements for PKI services. Design and oversee Hardware Security Module (HSM) integration and key management processes. Establish operational procedures for certificate issuance, renewal, revocation, recovery, and lifecycle management. Ensure solutions are scalable, supportable, and aligned with security and regulatory requirements. PKI Subject Matter Expertise Act as the organisation's recognised PKI authority and trusted advisor. Provide expert guidance on certificate authority design, trust models, certificate lifecycle management, revocation strategies, and key protection. Advise engineering and platform teams on PKI integration requirements and best practices. Review proposed solutions and ensure alignment with established PKI standards and architectural principles. Provide technical leadership for complex PKI-related initiatives and problem resolution. Machine Identity & Certificate Lifecycle Management Develop enterprise approaches for managing machine identities at scale. Design and implement automated certificate issuance, renewal, rotation, and revocation processes. Support certificate management across infrastructure, cloud, container, networking, and application environments. Reduce operational risk associated with certificate expiry and trust failures. Define standards for certificate discovery, inventory, monitoring, and reporting. Stakeholder Engagement & Governance Work closely with infrastructure, engineering, cloud, security, risk, and operational teams. Translate complex PKI and cryptographic concepts into clear business and technical recommendations. Develop PKI standards, policies, procedures, and governance documentation. Support audits and regulatory reviews relating to cryptographic and PKI controls. Influence technical direction and ensure PKI considerations are embedded within strategic initiatives. Essential Skills & Experience Proven experience designing and delivering enterprise PKI environments from inception through production operation . Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures. 10+ years of experience working with enterprise PKI, trust services, or cryptographic infrastructure. Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance. Experience implementing and operating HSM-backed PKI environments. Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains. Proven experience leading PKI programmes or transformations across multiple organisations . Ability to engage effectively with senior stakeholders, architects, engineers, auditors, and operational teams. Desirable Skills & Experience Experience with Venafi, Keyfactor , DigiCert Trust Lifecycle Manager, Sectigo , EJBCA, HashiCorp Vault, or equivalent platforms. Experience with Microsoft Active Directory Certificate Services (AD CS) design and migration programmes . Experience implementing PKI within AWS, Azure, Kubernetes, and hybrid cloud environments. Experience supporting financial services, regulated industries, or large-scale enterprise environments. Relevant industry certifications in security, architecture, cloud, or cryptography. Contract Details Fixed Term Contract Hybrid working model London-based role Competitive package dependent on experience