Identity & Security Architect (Keycloak / PKI)

Purpose

To own two related areas. The first is the authorisation API — a Keycloak deployment serving agency staff, enrolment agents and partner organisations, with fifty to one hundred thousand accounts and delegated administration across partner organisations. The second is device trust: mutual TLS with device certificates validated against a device registry, and the public key infrastructure that supports it.

The production root certificate authority and its hardware security modules reside on physical appliances on-premises under client custody. Cloud infrastructure applies only to development environments.

Key responsibilities

Authorization API

• Design the realm, client, role and group model for staff, agents and partner organisations, including delegated administration boundaries and the joiner, mover and leaver lifecycle.
• Define the token strategy — lifetimes, refresh handling, claim design, and introspection versus local validation.
• Package Keycloak for high availability on PostgreSQL, with realm configuration managed as versioned code rather than console configuration, and no secrets in image or chart.
• Design authorisation enforcement at the API gateway in conjunction with the API Gateway Architect.
• Define audit event emission into the security logging estate, aligned to the SIEM subsystem’s ingest requirements.

Device trust and PKI

• Establish the certificate authority ownership and lifecycle position across the consortium and take it to written agreement.
• Design the device certificate lifecycle — issuance, enrolment, renewal, revocation, and handling of a compromised or lost device in the field.
• Design mutual TLS device trust terminated at the API gateway, with the device registry validation path and defined failure behaviour.
• Design hardware security module integration for the on-premise root and the operational custody model, on the basis that the client operates it rather than us.

Essential experience

• Keycloak in production at organisational scale — realm and role modelling, delegated administration, identity brokering, and realm configuration managed as code.
• Public key infrastructure designed and operated in production, including certificate lifecycle at fleet scale and working revocation.
• Mutual TLS terminated at a gateway or load balancer, with device or client identity validated against a registry.
• Hardware security module integration, with an understanding of custody and key ceremony practice.
• Security design held across organisational boundaries where the outcome had to be agreed rather than imposed.

Desirable experience

• EJBCA or an equivalent certificate authority platform in production.
• Apache APISIX, or Kong with demonstrable transferable reasoning.
• Field device fleets — point of sale, enrolment terminals or similar — requiring certificate provisioning without a management platform.
• Government or regulated identity systems, including data sovereignty constraints.

Expected hours: 40.0 – 45.0 per week

Application Question(s):

• Have you delivered software into a multi-party programme, where the organisation deploying it was not the one building it?
• Have you delivered production work in an on-premise or hybrid environment (not cloud-only)?
• Are you comfortable working within a settled technology

decision?

Experience:

• On-premises: 10 years (Required)

Work Location: In person