PKI Architect

We are looking for an experienced PKI Architect to design, build and industrialise a secure, resilient and scalable Public Key Infrastructure platform.

In this role, you will take ownership of the technical architecture, assess and select suitable PKI technologies, contribute directly to implementation, and help establish the operational foundations of the platform. You will act as the technical authority on PKI-related matters, working closely with infrastructure, security and operations teams, as well as technology vendors and integration partners.

The ideal candidate combines strong PKI architecture expertise with hands-on technical capabilities and the ability to communicate complex technical concepts to both technical teams and management.

Key responsibilities

1. PKI Architecture and Design

• Define and document the target architecture for the PKI platform, ensuring security, scalability, resilience and maintainability.

• Design highly available, multi-site and multi-region architectures, including business continuity and disaster recovery mechanisms.

• Architect certificate validation and publication services, including OCSP responders, Certificate Revocation Lists (CRLs) and associated publication endpoints.

• Establish trust models, certification hierarchies, certificate lifecycle policies and the technical standards governing the platform.

• Produce architecture documents, technical specifications, design decisions and implementation guidelines.

2. Technology Assessment and Solution Selection

• Conduct technical assessments, comparative studies and Proofs of Concept (PoCs) to validate architectural options.

• Evaluate PKI technologies and platforms, including EJBCA, HashiCorp Vault, OpenBao, and relevant commercial or open-source solutions.

• Contribute to technology sourcing, vendor selection and procurement activities.

• Assess vendor capabilities, support models, integration requirements and operational implications.

• Engage with technology providers, system integrators and technical partners to challenge proposed solutions and ensure they meet the programme's requirements.

• Present and explain architectural options, technical trade-offs and recommendations to technical teams, stakeholders and management.

3. Implementation and Automation

• Take an active role in deploying, configuring and integrating the selected PKI technologies.

• Build prototypes and technical demonstrators to validate architectural decisions before wider deployment.

• Establish the initial development, testing, qualification and pre-production environments.

• Design and implement infrastructure automation and automated certificate lifecycle management processes.

• Define and develop CI/CD pipelines to support reliable, repeatable and controlled deployments.

• Troubleshoot complex technical issues and contribute directly to resolving implementation and integration challenges.

4. Operations, Reliability and Continuous Improvement

• Contribute to the initial operation and stabilisation of PKI environments.

• Provide expert-level technical support for complex incidents and challenging production issues.

• Define monitoring, observability, alerting and operational requirements for the platform.

• Contribute to maintenance planning, security patching, upgrades, performance optimisation and capacity management.

• Lead Root Cause Analysis (RCA) activities and define corrective actions and long-term reliability improvements.

• Help establish operational procedures and practices that support a secure, sustainable and scalable service.

5. Technical Leadership and Knowledge Transfer

• Act as the PKI technical lead and primary technical reference for the programme.

• Coordinate technical contributors and ensure consistency across architecture, implementation and operational activities.

• Support the development of PKI expertise within infrastructure, security and operations teams.

• Explain technical concepts and design decisions clearly to future service consumers and non-specialist stakeholders.

• Prepare the platform for industrialisation, service expansion and progressive handover to operational teams.

• Promote technical standards, good engineering practices and continuous improvement throughout the programme.

Required skills and experience

• Proven experience as a PKI Architect, Senior PKI Engineer or in a comparable senior infrastructure security role.

• Strong expertise in PKI architecture and design, supported by successful delivery of complex PKI projects.

• In-depth understanding of X.509 certificates, certificate authorities, certification hierarchies, trust models and certificate lifecycle management.

• Solid knowledge of certificate revocation and validation mechanisms, particularly OCSP and CRLs, including publication and availability considerations.

• Experience designing highly available, resilient and geographically distributed infrastructure.

• Hands-on experience implementing, configuring and integrating PKI technologies.

• Practical knowledge of infrastructure automation, CI/CD pipelines and deployment standardisation.

• Experience in technical solution assessment, Proofs of Concept and vendor evaluation.

• Strong troubleshooting skills and the ability to investigate complex technical issues.

• Excellent communication skills, with the ability to explain technical concepts and architectural decisions to different audiences.

• Ability to combine strategic architectural thinking with practical implementation and operational considerations.

Preferred qualifications

• Experience with EJBCA, HashiCorp Vault, OpenBao or comparable enterprise PKI and cryptographic infrastructure solutions.

• Familiarity with both open-source and commercial PKI ecosystems.

• Experience with DevOps practices, Infrastructure as Code and automated infrastructure deployment.

• Exposure to security operations, service monitoring, incident management and production service transition.

• Experience acting as a technical lead on complex security infrastructure programmes.