PKI Certificate Management - Security Identity Engineer

London Stock Exchange Group; Bengaluru; On-site; INR 2,800,000 - 4,500,000; Full time

Job summary

London Stock Exchange Group (LSEG) seeks a Security PKI Engineer to engineer, operate, and continually improve PKI/CLM capabilities across enterprise and cloud environments. You will work with architects and security teams to design scalable, secure identity and encryption services while delivering measurable improvements in availability and performance.

You will manage CA hierarchies, automation, and certificate lifecycles, contributing to incident response and sustainable operational

Qualifications

• Bachelor's degree in CS, Cyber Security, Engineering, or related technical discipline.
• 7+ years of PKI, Cyber Security, Identity & Access Management, or security engineering.
• Expert understanding of PKI, X.509 certificates, certificate chains, trust models, and validation.
• Strong experience with CA and services including Root/Intermediate/Issuing CAs, CRLs, OCSP, AIA, CDP.
• Hands-on with enterprise PKI/CLM platforms such as AD CS, Venafi, DigiCert, Keyfactor, Entrust, Sectigo, or EJBCA.
• Knowledge of key management, HSMs, CSPs, cryptographic controls.
• Experience designing PKI automation via APIs, PowerShell, Python, Bash.
• Knowledge of AD, Entra ID, Kerberos, NTLM, SAML, OAuth, OIDC, identity federation.
• Experience operating PKI in Azure/AWS/GCP and cloud-native patterns.
• Understanding of TCP/IP, DNS, TLS, mTLS, firewalls, load balancing.
• Experience with SRE practices: monitoring, incident response, resilience.
• Crypto agility and PQC readiness initiatives experience.
• Code signing, software supply chain security, Kubernetes PKI automation.
• PKI architecture design.

Responsibilities

• Engineer, administer, and maintain PKI components including Root, Intermediate, and Issuing CAs.
• Operate certificate validation and distribution services: CRLs, OCSP, AIA, CDP.
• Manage end-to-end certificate lifecycle: request validation, issuance, renewal, revocation, retirement.
• Maintain high-quality PKI/CLM with documentation and runbooks.
• Reduce expirations by proactive inventory hygiene and crypto compliance.
• Drive project priorities and deliverables for PKI/CLM.
• Apply SRE mindset to monitoring, incident response, and service resilience.
• Design software components to improve availability, latency, and efficiency.
• Build automation to prevent problem recurrence and automate responses.
• Review code and optimize automation for certificate operations.
• Improve monitoring/alerts for certificate expiry, CA health, CLM workflows.
• Integrate CLM with enterprise tooling and APIs for governance.
• Collaborate with architects to align PKI/CLM with platform standards.
• Mentor team members on PKI availability and performance.

Skills

PKI

Certificate Management

AD CS

Venafi

Cloud PKI

Automation

SRE

APIs

PowerShell

Python

Bash

Active Directory

Entra ID

Kerberos

SAML/OIDC

OAuth

Kubernetes

TLS/mTLS

Crypto Controls

Code Signing

Education

Bachelor's degree in Computer Science or related field

Tools

Microsoft AD CS

CyberArk Cert Manager (Venafi)

DigiCert

Keyfactor

Entrust

Sectigo

EJBCA

Job description

Role Summary

The Security PKI Engineer will be responsible for engineering, operating, and continuously improving LSEG’s Public Key Infrastructure (PKI) and Certificate Lifecycle Management (CLM) capabilities. This role ensures trusted identity, authentication, and encryption services are reliable, scalable, and secure across enterprise and cloud environments. You will contribute to designs and production improvements that increase availability, performance, and operational efficiency, partnering closely with architects, security teams, infrastructure, and application owners to deliver measurable outcomes on agreed priorities and timelines.

Key Responsibilities

• Engineer, administer, and maintain PKI components including Root, Intermediate, and Issuing Certificate Authorities.
• Operating and supporting certificate validation and distribution services including CRLs, OCSP, AIA, and CDP.
• Executing end-to-end certificate lifecycle processes: request validation, issuance, renewal, revocation, and retirement.
• Ensuring essential PKI and CLM processes meet high-quality standards through strong operational controls, documentation, and repeatable runbooks.
• Maintaining certificate inventory hygiene and reduce operational risk by proactively addressing expirations and crypto compliance gaps.
• Driving project priorities, deadlines, and outcomes for PKI and CLM engineering deliverables.
• Applying deep knowledge of site reliability, software engineering, tooling, frameworks, infrastructure, and systems to deliver each task effectively.
• Contributing to designs of software components, systems, and features that improve availability, scalability, latency, and efficiency of LSEG services.
• Participating in sustainable incident response and production improvements, including root cause analysis and preventive remediation.
• Building automation to prevent problem recurrence and implementing automated responses for non-exceptional service conditions.
• Writing and reviewing optimized and accurate automation code and scripts to improve certificate operations and reliability.
• Providing feedback and suggested improvements through peer code reviews, focusing on quality, performance, and maintainability.
• Improving monitoring and alerting for certificate expiry, CA health, OCSP and CRL availability, and CLM workflow performance.
• Supporting integration of CLM workflows with enterprise tooling and APIs to reduce manual effort and improve governance.
• Partnering with architects to decompose solutions for technology systems and products, aligning PKI and CLM designs to platform standards.
• Acting as a point of contact within the PKI domain by demonstrating strong depth of knowledge and building awareness of adjacent domains to manage dependencies.
• Proactively building and applying relevant domain knowledge related to workflows, data pipelines, business policies, configurations, and constraints.
• Providing mentorship and advice to team members on improving availability and performance of critical services.

Qualifications

• Bachelor's degree in Computer Science, Cyber Security, Engineering, or a related technical discipline.
• 7+ years of experience in PKI, Cyber Security, Identity & Access Management, or security engineering.
• Expert understanding of PKI, X.509 certificates, certificate chains, trust models, and certificate validation.
• Strong experience with Certificate Authorities and supporting services, including Root, Intermediate, and Issuing CAs, CRLs, OCSP, AIA, and CDP.
• Hands‑on experience with enterprise PKI and CLM platforms such as Microsoft AD CS, CyberArk Certificate Manager (Venafi), DigiCert, Keyfactor, Entrust, Sectigo, or EJBCA.
• Strong understanding of key management, HSMs, KSPs, CSPs, certificate lifecycle management, and cryptographic controls.
• Experience designing and implementing PKI automation using APIs, PowerShell, Python, or Bash.
• Strong knowledge of Active Directory, Entra ID, Kerberos, NTLM, SAML, OAuth, OIDC, and identity federation.
• Experience operating PKI services across Azure, AWS, and/or GCP, including cloud‑native certificate management patterns.
• Strong understanding of networking and security protocols, including TCP/IP, DNS, TLS, mTLS, firewalls, and load balancing.
• Experience operating security‐critical services with an SRE mindset, including monitoring, alerting, incident response, and service resilience.
• Experience supporting crypto agility and Post‑Quantum Cryptography (PQC) readiness initiatives, including certificate discovery, cryptographic inventory, automation, migration planning, and adoption of emerging NIST PQC standards.
• Experience with code signing, software supply chain security, Kubernetes certificate automation, and PKI architecture design.

Certifications (Nice to have)

• Security Certifications (SSCP, CompTIA Security+)
• Azure/AWS/GCP cloud security certifications
• PKI/CLM platform training and/or public CA program familiarity

Career Stage: Manager

London Stock Exchange Group (LSEG) Information:

Join us and be part of a team that values innovation, quality, and continuous improvement. If you're ready to take your career to the next level and make a significant impact, we'd love to hear from you. LSEG is a leading global financial markets infrastructure and data provider. Our purpose is driving financial stability, empowering economies and enabling customers to create sustainable growth. Our purpose is the foundation on which our culture is built. Our values of Integrity, Partnership, Excellence and Change underpin our purpose and set the standard for everything we do, every day. They go to the heart of who we are and guide our decision making and everyday actions. Working with us means that you will be part of a dynamic organisation of 25,000 people across 65 countries. However, we will value your individuality and enable you to bring your true self to work so you can help enrich our diverse workforce. We are proud to be an equal opportunities employer. This means that we do not discriminate on the basis of anyone’s race, religion, colour, national origin, gender, sexual orientation, gender identity, gender expression, age, marital status, veteran status, pregnancy or disability, or any other basis protected under applicable law. Conforming with applicable law, we can reasonably accommodate applicants' and employees' religious practices and beliefs, as well as mental health or physical disability needs. You will be part of a collaborative and creative culture where we encourage new ideas. We are committed to sustainability across our global business and we are proud to partner with our customers to help them meet their sustainability objectives. Our charity, the LSEG Foundation provides charitable grants to community groups that help people access economic opportunities and build a secure future with financial independence. Colleagues can get involved through fundraising and volunteering. LSEG offers a range of tailored benefits and support, including healthcare, retirement planning, paid volunteering days and wellbeing initiatives.

Privacy notice: Please take a moment to read this privacy notice carefully, as it describes what personal information London Stock Exchange Group (LSEG) (we) may hold about you, what it’s used for, and how it’s obtained, your rights and how to contact us as a data subject. If you are submitting as a Recruitment Agency Partner, it is essential and your responsibility to ensure that candidates applying to LSEG are aware of this privacy notice.

LSEG (London Stock Exchange Group) is a leading global financial markets infrastructure and data provider. Our purpose is driving financial stability, empowering economies and enabling customers to create sustainable growth. Our purpose is the foundation on which our culture is built. Our values of Integrity, Partnership, Excellence, and Change underpin our purpose and set the standard for everything we do, every day. Working with us is part of a dynamic organisation of 25,000 people across 65 countries. We are committed to sustainability, and we expand our global reach in 70 countries. Our Data & Analytics, Capital Markets and Post Trade divisions provide integrated suite of trusted financial market infrastructure services to help our customers pursue their ambitions. Explore our divisions. Find out more. Get to know some of our people who are pushing the boundaries of technology, finance and more around the world.