Senior PKI Engineer — Certificate Authorities, HSMs and Smart Cards for NATO with security clearance

Every secure login signed document and trusted connection across a largeinternational organisation rests on its public key infrastructure. A multinational defenceorganisation is looking for a senior engineer to run that infrastructure day to day design whatcomes next and be the person other teams escalate to when certificates stop behaving.

What you would be doing

• Installing configuring and maintaining the organisation-wide public key infrastructure andevery component it depends on virtualised platform networking hardware.
• Running the directory service and its supporting web service and keeping the dedicateddatabases healthy.
• Owning certificate status checking and time stamping so that revocation actually takeseffect.
• Deploying integrating and managing the card management system and supporting smart cardenrolment and certificate issue.
• Managing hardware security modules including firmware upgrades.
• Analysing certificate authority logs: troubleshooting alarms and errors and watching activityfor what should not be there.
• Keeping daily operations backup and restore in order and proving the restore works.
• Providing second and third line technical support to the operating authorities and thecustomers of the service.
• Designing new components writing the standard operating procedures that go with everychange and documenting new services properly.
• Investigating network faults security incidents and performance problems and carrying theimprovements through to implementation.
• Supporting the integration of security tooling into current and future environments andrunning the testing validation and acceptance that goes with it.
• Writing the technical documentation the next engineer will need: installation guidesconfiguration baselines test plans and reports hardening guides.
• Working with project managers engineers architects and operational stakeholders andhanding over to operations with the knowledge transfer that makes a handover real.
• Being willing to work outside office hours when an incident or an operational requirementasks for it.

What you would bring

• At least five years in cyber security or a closely related field building securityarchitecture delivering security capabilities or running demanding technical estates.
• Deep knowledge of modern networking and internet protocols including their security andworking competence configuring routers and switches.
• Hands-on administration of Windows Server Red Hat Enterprise Linux and VMware with backupand restore done in earnest.
• Practical scripting in Python and PowerShell and automation with Ansible.
• Real familiarity with SSL TLS and OpenSSL and with SQL database administration.
• Five years or more across network installation testing and integration; network support andperformance monitoring; migration projects; and fault diagnosis to agreed procedures.
• Configuration maintenance and repair of storage networks servers tape libraries andvirtualisation platforms.
• Systems installation and decommissioning quality plans and method statements integrationbuilds and test specifications configuration management and problem management.
• Recent work with Juniper Palo Alto and RSA NetWitness and design and configuration ofinfrastructure elements inside projects routing switching virtualisation.
• A record of delivering into industry government or military organisations includingdeployments to operational areas working alone or coordinating an industry team.
• Strong professional English written and spoken with genuine technical writing ability.
• Nice to have: experience supporting a military or governmental organisation.

Extensions are offered where the work goes well. Applications are reviewed as theyarrive.