PKI Infrastructure Engineer — Certificates, Directory and Card Management for NATO with security clearance

WLG; Henegouwen; On-site; EUR 90,000 - 130,000; Full time

Job summary

WLG is seeking a senior PKI engineer to run and evolve its public key infrastructure within a multinational defence context. You will install, configure and maintain PKI components, manage HSMs and certificates, and provide expert guidance to other teams.

Excellent English, five+ years in cyber security, and a track record of delivering secure infrastructure are essential for this role.

Qualifications

• Minimum five years in cyber security or related field.
• Strong knowledge of modern networking and security.
• Experience with Windows Server, RHEL and VMware.
• Scripting: Python and PowerShell; automation with Ansible.
• Familiarity with SSL, TLS and OpenSSL, and with SQL database administration.
• Five years or more across network installation, testing and integration.
• Configuration, maintenance and repair of storage networks and virtualization.
• Strong professional English, written and spoken.

Responsibilities

• Install, configure and maintain PKI infrastructure across platforms.
• Run directory services and supporting web service, keeping databases healthy.
• Own certificate status checking and time stamping to enforce revocation.
• Deploy, integrate and manage the card management system and smart cards.
• Manage hardware security modules and firmware upgrades.
• Analyse logs, troubleshoot alarms and monitor for anomalies.
• Maintain daily operations, backup and restore procedures.
• Provide second/third line technical support to authorities and customers.
• Design new components and write SOPs for changes and deployments.
• Investigate network faults and security incidents and implement improvements.
• Document installation guides, baselines and test plans.
• Collaborate with project managers and engineers for knowledge transfer.
• Willing to work outside office hours when required.

Skills

Cyber security

Networking

English proficiency

Technical writing

Tools

Windows Server

Red Hat Enterprise Linux

VMware

Python

PowerShell

Ansible

OpenSSL

SQL database administration

Juniper

Palo Alto

RSA NetWitness

Job description

Every secure login, signed document and trusted connection across a large international organisation rests on its public key infrastructure. A multinational defence organisation is looking for a senior engineer to run that infrastructure day to day, design what comes next, and be the person other teams elevate to when certificates stop behaving.

What You Would Be Doing

• Installing, configuring and maintaining the organisation-wide public key infrastructure and every component it depends on — virtualised platform, networking, hardware.
• Running the directory service and its supporting web service, and keeping the dedicated databases healthy.
• Owning certificate status checking and time stamping, so that revocation actually takes effect.
• Deploying, integrating and managing the card management system, and supporting smart card enrolment and certificate issue.
• Managing hardware security modules, including firmware upgrades.
• Analysing certificate authority logs: troubleshooting alarms and errors, and watching activity for what should not be there.
• Keeping daily operations, backup and restore in order, and proving the restore works.
• Providing second and third line technical support to the operating authorities and the customers of the service.
• Designing new components, writing the standard operating procedures that go with every change, and documenting new services properly.
• Investigating network faults, security incidents and performance problems, and carrying the improvements through to implementation.
• Supporting the integration of security tooling into current and future environments, and running the testing, validation and acceptance that goes with it.
• Writing the technical documentation the next engineer will need: installation guides, configuration baselines, test plans and reports, hardening guides.
• Working with project managers, engineers, architects and operational stakeholders, and handing over to operations with the knowledge transfer that makes a handover real.
• Being willing to work outside office hours when an incident or an operational requirement asks for it.

What you would bring

• At least five years in cyber security or a closely related field — building security architecture, delivering security capabilities, or running demanding technical estates.
• Deep knowledge of modern networking and internet protocols, including their security, and working competence configuring routers and switches.
• Hands-on administration of Windows Server, Red Hat Enterprise Linux and VMware, with backup and restore done in earnest.
• Practical scripting in Python and PowerShell, and automation with Ansible.
• Real familiarity with SSL, TLS and OpenSSL, and with SQL database administration.
• Five years or more across network installation, testing and integration; network support and performance monitoring; migration projects; and fault diagnosis to agreed procedures.
• Configuration, maintenance and repair of storage networks, servers, tape libraries and virtualisation platforms.
• Systems installation and decommissioning, quality plans and method statements, integration builds and test specifications, configuration management and problem management.
• Recent work with Juniper, Palo Alto and RSA NetWitness, and design and configuration of infrastructure elements inside projects — routing, switching, virtualisation.
• A record of delivering into industry, government or military organisations, including deployments to operational areas, working alone or coordinating an industry team.
• Strong professional English, written and spoken, with genuine technical writing ability.
• Nice to have: experience supporting a military or governmental organisation.

Extensions are offered where the work goes well. Applications are reviewed as they arrive.