Senior PKI Engineer — Certificate Authorities, HSMs and Smart Cards for NATO with security clearance

WLG; Henegouwen; Sur place; EUR 80 000 - 120 000; Plein temps

Résumé du poste

WLG in Belgium is seeking a senior PKI/cyber security engineer to run the organisation-wide public key infrastructure, design the next generation, and be the go-to expert when certificates misbehave.

You will install, configure and maintain PKI components, manage HSMs, certificate status, card management, and scripting, while documenting SOPs and enabling smooth handovers to operations.

Qualifications

• Minimum five years in cyber security or related field.
• Hands-on admin of Windows Server and RHEL.
• Experience with PKI, certificate management and HSMs.
• Strong scripting in Python and PowerShell.
• Fluent English, written and spoken.

Responsabilités

• Install, configure and maintain PKI components across platforms.
• Run directory service, web service and keep databases healthy.
• Own certificate status and time stamping to enforce revocation.
• Deploy and manage card management and smart card enrollment.
• Manage hardware security modules and firmware upgrades.
• Analyze CA logs and monitor for unauthorized activity.
• Ensure daily operations, backups and restores work.
• Provide second/third line support to authorities and customers.
• Design new components and write SOPs.
• Investigate network faults, incidents and performance issues.
• Support security tooling integration and testing/validation.
• Write installation guides, baselines, plans and reports.
• Collaborate with PMs, engineers and hand over to operations.
• Be willing to work outside office hours when needed.

Connaissances

PKI expertise

Networking security

Windows admin

Linux admin

VMware

Python scripting

PowerShell

Ansible

SSL TLS OpenSSL

SQL admin

Incident response

Documentation

Formation

BSc in CS

Outils

Juniper

Palo Alto

RSA NetWitness

OpenSSL

VMware

Description du poste

Every secure login, signed document and trusted connection across a large international organisation rests on its public key infrastructure. A multinational defence organisation is looking for a senior engineer to run that infrastructure day to day, design what comes next, and be the person other teams elevate to when certificates stop behaving.

What You Would Be Doing

• Installing, configuring and maintaining the organisation-wide public key infrastructure and every component it depends on — virtualised platform, networking, hardware.
• Running the directory service and its supporting web service, and keeping the dedicated databases healthy.
• Owning certificate status checking and time stamping, so that revocation actually takes effect.
• Deploying, integrating and managing the card management system, and supporting smart card enrolment and certificate issue.
• Managing hardware security modules, including firmware upgrades.
• Analysing certificate authority logs: troubleshooting alarms and errors, and watching activity for what should not be there.
• Keeping daily operations, backup and restore in order, and proving the restore works.
• Providing second and third line technical support to the operating authorities and the customers of the service.
• Designing new components, writing the standard operating procedures that go with every change, and documenting new services properly.
• Investigating network faults, security incidents and performance problems, and carrying the improvements through to implementation.
• Supporting the integration of security tooling into current and future environments, and running the testing, validation and acceptance that goes with it.
• Writing the technical documentation the next engineer will need: installation guides, configuration baselines, test plans and reports, hardening guides.
• Working with project managers, engineers, architects and operational stakeholders, and handing over to operations with the knowledge transfer that makes a handover real.
• Being willing to work outside office hours when an incident or an operational requirement asks for it.

What you would bring

• At least five years in cyber security or a closely related field — building security architecture, delivering security capabilities, or running demanding technical estates.
• Deep knowledge of modern networking and internet protocols, including their security, and working competence configuring routers and switches.
• Hands-on administration of Windows Server, Red Hat Enterprise Linux and VMware, with backup and restore done in earnest.
• Practical scripting in Python and PowerShell, and automation with Ansible.
• Real familiarity with SSL, TLS and OpenSSL, and with SQL database administration.
• Five years or more across network installation, testing and integration; network support and performance monitoring; migration projects; and fault diagnosis to agreed procedures.
• Configuration, maintenance and repair of storage networks, servers, tape libraries and virtualisation platforms.
• Systems installation and decommissioning, quality plans and method statements, integration builds and test specifications, configuration management and problem management.
• Recent work with Juniper, Palo Alto and RSA NetWitness, and design and configuration of infrastructure elements inside projects — routing, switching, virtualisation.
• A record of delivering into industry, government or military organisations, including deployments to operational areas, working alone or coordinating an industry team.
• Strong professional English, written and spoken, with genuine technical writing ability.
• Nice to have: experience supporting a military or governmental organisation.

Extensions are offered where the work goes well. Applications are reviewed as they arrive.