PKI Team Leader

NCC Group; Manila; Hybrid; PHP 600,000 - 900,000; Full time

Benefits offered by this job

Transportation allowance

Rice allowance

Night differential & holiday pay

13th-month pay + bonus plan

Day-1 HMO coverage

Job summary

NCC Group is seeking a PKI Analyst in Taguig City, Metro Manila, with hybrid work arrangement (2 days onsite). The role focuses on the day-to-day operation and governance of a managed PKI service for a financial services client, ensuring service reliability and incident response.

The position emphasizes operational discipline, cryptographic risk awareness, and effective stakeholder communication, rather than PKI architecture. Strong SLAs and client-facing delivery are required.

Qualifications

• Experience in a managed service or security operations role with defined SLAs.
• Strong understanding of PKI concepts including certificates, authorities, trust chains, expiry, and revocation.
• Experience managing certificate lifecycles within enterprise or managed services.
• Experience with systems that require privileged access and governance.

Responsibilities

• Provide operational support for managed PKI services.
• Maintain accurate inventory of certificates (public/private).
• Manage certificate issuance, renewal, revocation, and re-keying per PKI processes.

Skills

Managed service experience

Security operations

IAM

Security platform operations

PKI concepts

Certificate lifecycle management

Privileged access governance

SLA adherence

Client-facing

Education

Degree in security/computer science

Tools

Sectigo

DigiCert

Microsoft AD CS

Venafi

Job description

Department

Cyber Services and Capabilities

Position Title

PKI Analyst

Location

Taguig City, Metro Manila – 2 days per week onsite

Role Purpose

This role is an operational position within NCC Group’s Managed Services organisation, responsible for the day‑to‑day operation and support of a managed Public Key Infrastructure (PKI) service for a regulated financial services client. The role focuses on the effective running, maintenance, and governance of PKI services delivered using the Sectigo platform. It includes managing certificate lifecycles at scale, maintaining accurate PKI inventories, supporting access governance for cryptographic key management systems, and responding to PKI‑related incidents and service requests. The role operates within defined managed service processes and escalation paths and works closely with service delivery teams, suppliers, and client stakeholders. The emphasis is on service reliability, risk awareness, and clear communication rather than PKI architecture or engineering design. It requires strong operational discipline, an understanding of cryptographic risk, and the ability to support both planned and unplanned maintenance activities while ensuring service levels and client expectations are met.

Key Responsibilities

• Provide operational support for managed PKI services.
• Maintain an accurate and up‑to‑date inventory of public and private certificates.
• Manage certificate issuance, renewal, revocation, and re‑keying activities in line with agreed PKI processes and security standards.
• Support the migration and re‑issuance of existing certificates into the client’s defined PKI structure.
• Monitor certificate expiry and service availability to proactively prevent certificate‑related outages.
• Maintain and review user access to cryptographic key management systems, ensuring privileged access is restricted, reviewed, and removed appropriately.
• Support joiner, mover, and leaver access‑management processes for PKI platforms.
• Act as an operational point of contact for PKI‑related incidents, service requests, and escalations.
• Support planned maintenance activities through change coordination and stakeholder communication.
• Support unplanned maintenance and incident response activities, providing timely and accurate updates to internal teams and client stakeholders.
• Work with internal teams and third‑party suppliers to ensure PKI platform availability meets agreed service levels.
• Identify and escalate weaknesses or risks within cryptographic services in line with managed services governance and escalation procedures.
• Contribute to the continuous improvement of PKI processes, documentation, and operational runbooks.
• Deliver a professional, customer‑focused service aligned to managed services delivery standards.

Skills, Knowledge & Expertise – Minimum Requirements

• Experience working in a managed service, security operations, IAM, or security platform operations role.
• Practical understanding of PKI concepts, including certificates, certificate authorities, trust chains, expiry, and revocation.
• Experience supporting certificate lifecycle management within an enterprise or managed service environment.
• Experience working with systems requiring privileged access and strong access governance.
• Strong process discipline and experience working to defined procedures and SLAs.
• Experience working in a client‑facing or service delivery role.

Skills, Knowledge & Expertise – Desirable Requirements

• Experience with enterprise PKI platforms such as Sectigo, DigiCert, Microsoft AD CS, Venafi, or similar.
• Experience supporting regulated or financial services clients.
• Familiarity with cryptographic key management systems or HSM concepts.
• ITIL or service management experience.
• Security related certifications such as Security+, GIAC, CISSP, or equivalent.
• Degree in a relevant technical or security related discipline.

Benefits

• Transportation and rice allowances
• Night differential, overtime pay and holiday pay
• 13th‑month pay and performance‑based bonus plan
• Day‑1 HMO healthcare coverage for you and dependents
• Outpatient medicine reimbursement
• Group life insurance, accidental death & disability cover
• Employee Assistance Program (EAP) with 24/7 confidential counselling
• Generous vacation and sick leave, available from Day 1
• Special time off for major life events such as marriage, becoming a grandparent, or welcoming a new pet
• Company share plan & Sharesave scheme allowing discounted share purchase through monthly savings