Enterprise PKI Specialist (Contractor)

Enterprise PKI Specialist (Fixed Term Contract)     The Enterprise PKI Specialist is a senior technical specialist responsible for the design, implementation, governance, and evolution of Public Key Infrastructure (PKI) services across Qube Research & Technologies (QRT).     The successful candidate will serve as the organisation's primary PKI subject matter expert, providing strategic guidance, architectural leadership, hands-on engineering expertise, and technical governance across all PKI-related initiatives.     This is a highly specialised role requiring extensive experience designing, building, and modernising PKI environments within large enterprises. The successful candidate will have a proven track record of delivering PKI programmes from initial requirements gathering and architecture design through to implementation, operationalisation, and long-term governance.     PKI Architecture & Delivery   Design and deliver enterprise  grade  PKI architecture and supporting operational  model .   Design and implement root and issuing Certificate Authority (CA) hierarchies.   Define certificate policies, certificate profiles, naming standards, trust models, and operational controls.   Design resilient,  highly available  PKI infrastructure and supporting services.   Lead the implementation and migration of PKI platforms, tooling, and supporting infrastructure.   Define disaster recovery, backup, recovery, and key protection requirements for PKI services.   Design and oversee Hardware Security Module (HSM) integration and key management processes.   Establish operational procedures for certificate issuance, renewal, revocation, recovery, and lifecycle management.   Ensure solutions are scalable, supportable, and aligned with security and regulatory requirements.   PKI Subject Matter Expertise   Act as the  organisation's   recognised  PKI authority and trusted advisor.   Provide  expert guidance on certificate authority design, trust models, certificate lifecycle management, revocation strategies, and key protection.   Advise  engineering and platform teams on PKI integration requirements and best practices.   Review proposed solutions and ensure alignment with established PKI standards and architectural principles.   Provide technical leadership for complex PKI-related initiatives and problem resolution.   Machine Identity & Certificate Lifecycle Management   Develop enterprise approaches for managing machine identities at scale.   Design and implement automated  certificate  issuance, renewal, rotation, and revocation processes.   Support certificate management across infrastructure, cloud, container, networking, and application environments.   Reduce operational risk associated with certificate expiry and trust failures.   Define standards for certificate discovery, inventory, monitoring, and reporting.   Stakeholder Engagement & Governance   Work closely with infrastructure, engineering, cloud, security, risk, and operational teams.   Translate complex PKI and cryptographic concepts into clear business and technical recommendations.   Develop PKI standards, policies, procedures, and governance documentation.   Support audits and regulatory reviews relating to cryptographic and PKI controls.   Influence technical direction and ensure PKI considerations are embedded within strategic initiatives.   Essential Skills & Experience   Proven experience designing and delivering enterprise PKI environments from  inception  through production  operation .   Extensive experience designing Root CA, Intermediate CA, and Issuing CA architectures.   10+ years of experience working with enterprise PKI, trust services, or cryptographic infrastructure.   Strong understanding of offline Root CA designs, trust hierarchy models, certificate policy development, and PKI governance.   Experience implementing and operating HSM-backed PKI environments.   Deep knowledge of X.509 certificates, PKCS standards, CRLs, OCSP, certificate validation, and trust chains.   Proven experience leading PKI  programmes  or transformations across multiple  organisations .   Ability to engage effectively with senior stakeholders, architects, engineers, auditors, and operational teams.   Desirable Skills & Experience   Experience with Venafi,  Keyfactor , DigiCert Trust Lifecycle Manager,  Sectigo , EJBCA,  HashiCorp  Vault, or equivalent platforms.   Experience with Microsoft Active Directory Certificate Services (AD CS) design and migration  programmes .   Experience implementing PKI within AWS, Azure, Kubernetes, and hybrid cloud environments.   Experience supporting financial services, regulated industries, or large-scale enterprise environments.   Relevant industry certifications in security, architecture, cloud, or cryptography.   Contract Details   Fixed Term Contract   Hybrid working model   London-based role   Competitive package dependent on experience