Public Key Infrastructure and Cryptographic Specialist

Sasso Consulting (Pty) Ltd; Johannesburg; Vor Ort; ZAR 700.000 - 1.000.000; Vollzeit

Zusammenfassung

Sasso Consulting (Pty) Ltd is seeking experienced Public Key Infrastructure and Cryptographic Specialists to design, implement, secure and maintain enterprise PKI and cryptographic security solutions.

You will manage digital certificates, encryption technologies, cryptographic keys, CA operations and associated security infrastructure to ensure confidentiality, integrity and authenticity of systems and communications.

Qualifikationen

• Diploma or degree in IT/cybersecurity or related.
• ,

Aufgaben

• Design, implement, configure and maintain enterprise PKI environments.
• Install and administer Certificate Authorities (CAs) including root/subordinate CAs.
• Manage certificate issuance, renewal, revocation and lifecycle processes.
• Configure PKI templates and enrolment procedures; maintain AD CS or equivalent.
• Support PKI upgrades, migrations and integrations; ensure PKI security.
• Implement and manage cryptographic key generation, storage, rotation and destruction.
• Oversee TLS configurations and secure communications across enterprise systems.
• Collaborate with security, infrastructure, network and cloud teams on PKI projects.

Kenntnisse

PKI architecture

Certificate lifecycle

AD CS

HSMs

TLS configurations

Cryptographic protocols

Certificate authorities

Key management

Security standards

Ausbildung

Information Technology degree or diploma

Tools

AD CS

HSMs

Jobbeschreibung

Public Key Infrastructure and Cryptographic Specialist

Location: Centurion, Gauteng (provisional – to be confirmed)
Positions Available: 5
Salary: Market-related
Employment Type: To be confirmed

Job Overview

We are seeking experienced and technically proficient Public Key Infrastructure (PKI) and Cryptographic Specialists to design, implement, administer, secure and maintain enterprise Public Key Infrastructure and cryptographic security solutions.

The successful candidates will be responsible for managing digital certificates, encryption technologies, cryptographic keys, certificate authorities and associated security infrastructure to ensure the confidentiality, integrity and authenticity of organisational systems, applications and communications.

This role requires strong hands‑on expertise in PKI architecture, certificate lifecycle management, cryptographic protocols, Hardware Security Modules (HSMs), encryption technologies and enterprise security integration.

The ideal candidates will have proven experience implementing and supporting PKI and cryptographic solutions within complex enterprise IT environments, with a strong understanding of information security, identity management and regulatory compliance.

Key Responsibilities

Public Key Infrastructure Management

• Design, implement, configure and maintain enterprise Public Key Infrastructure environments.
• Install, configure and administer Certificate Authorities (CAs), including root and subordinate CAs.
• Manage certificate issuance, renewal, revocation, expiration and lifecycle processes.
• Implement and maintain certificate templates, certificate policies and certificate enrolment procedures.
• Configure and manage Microsoft Active Directory Certificate Services (AD CS) or equivalent PKI platforms.
• Maintain Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) services.
• Monitor PKI infrastructure availability, performance and security.
• Troubleshoot certificate validation, trust chain, authentication and encryption issues.
• Support PKI upgrades, migrations, integrations and infrastructure modernisation projects.
• Maintain accurate certificate inventories and PKI configuration documentation.

Cryptographic Key Management and Security

• Implement and manage cryptographic key generation, storage, distribution, rotation, revocation and destruction processes.
• Configure and maintain secure encryption and key management solutions.
• Support the implementation and administration of Hardware Security Modules (HSMs).
• Manage cryptographic policies, key protection controls and secure key storage mechanisms.
• Implement appropriate symmetric and asymmetric encryption technologies.
• Support digital signature, certificate‑based authentication and secure communication solutions.
• Ensure cryptographic controls align with organisational security policies and recognised industry standards.
• Investigate cryptographic security vulnerabilities and recommend remediation measures.
• Support cryptographic key recovery, backup and disaster recovery procedures.
• Assist with cryptographic algorithm and protocol modernisation initiatives.

Certificate Lifecycle Management

• Implement automated certificate discovery, issuance, renewal and revocation processes.
• Monitor certificate expiration dates and prevent certificate‑related service disruptions.
• Manage internal and externally issued digital certificates.
• Support certificate deployment across servers, applications, network devices and cloud environments.
• Implement certificate management policies and operational procedures.
• Configure and maintain certificate enrolment and automated certificate management solutions.
• Investigate and resolve certificate‑related incidents affecting enterprise systems.
• Maintain certificate lifecycle reports, inventories and compliance records.

Encryption and Secure Communications

• Implement and maintain Transport Layer Security (TLS) configurations across enterprise systems.
• Support secure communication protocols and certificate‑based authentication.
• Configure and troubleshoot SSL/TLS certificates for web servers, applications and network services.
• Implement encryption controls for data at rest and in transit.
• Support secure email, digital signing and authentication technologies.
• Assist with implementing mutual TLS (mTLS) and certificate‑based authentication for applications and APIs.
• Identify and remediate weak cryptographic configurations, outdated algorithms and insecure protocols.
• Collaborate with application, infrastructure and network teams to strengthen encryption security.

Enterprise Integration and Cloud Cryptography

• Integrate PKI solutions with Microsoft Active Directory, Microsoft Entra ID and enterprise identity services.
• Support certificate‑based authentication for users, devices, applications and services.
• Implement and maintain PKI integrations with Windows, Linux, network infrastructure and enterprise applications.
• Support cryptographic services within Microsoft Azure, AWS or equivalent cloud platforms.
• Configure cloud key management and certificate management services.
• Assist with securing cloud workloads, application secrets and cryptographic keys.
• Support enterprise certificate automation and integration with DevOps processes.
• Collaborate with cybersecurity, infrastructure, cloud and application development teams.

Security Governance, Compliance and Risk Management

• Conduct PKI security assessments and cryptographic configuration reviews.
• Ensure certificate authorities and cryptographic systems follow recognised security standards.
• Support compliance with ISO 27001, NIST and applicable information security requirements.
• Maintain cryptographic policies, certificate practice statements and operational procedures.
• Assist with internal and external security audits involving PKI and encryption controls.
• Monitor emerging cryptographic vulnerabilities and recommend appropriate remediation.
• Maintain audit logs, technical reports and compliance evidence.
• Support business continuity and disaster recovery planning for critical PKI infrastructure.
• Recommend improvements to cryptographic security architecture and operational processes.

Minimum Requirements

• Relevant diploma or degree in Information Technology, Computer Science, Cybersecurity, Information Security, Network Engineering or a related discipline.
• Typically 3–5 years of relevant experience in PKI administration, cryptographic security, enterprise information security or a related technical specialisation.
• Proven hands‑on experience implementing, configuring or administering enterprise PKI solutions.
• Strong practical knowledge of Certificate Authorities, digital certificates and certificate lifecycle management.
• Experience with Microsoft Active Directory Certificate Services (AD CS) or equivalent enterprise PKI technologies.
• Strong understanding of X.509 certificates, certificate chains, trust models and certificate validation.
• Practical knowledge of encryption technologies and cryptographic key management principles.
• Experience configuring and troubleshooting SSL/TLS certificates and secure communication protocols.
• Understanding of certificate revocation mechanisms, including CRLs and OCSP.
• Experience supporting certificate‑based authentication and secure enterprise integrations.
• Knowledge of symmetric and asymmetric encryption, digital signatures and hashing algorithms.
• Familiarity with Hardware Security Modules and secure key management technologies.
• Strong working knowledge of Windows Server, Active Directory and enterprise networking.
• Familiarity with Linux environments and cloud security technologies.
• Understanding of PKI security standards and recognised cryptographic best practices.
• Strong analytical, troubleshooting and technical documentation skills.

Technical Skills and Competencies

Public Key Infrastructure Technologies

• Microsoft Active Directory Certificate Services (AD CS)
• Enterprise Certificate Authorities
• Root and subordinate Certificate Authorities
• Certificate Authority hierarchy design
• X.509 digital certificates
• Certificate Signing Requests (CSRs)
• Certificate templates and enrolment
• Certificate Revocation Lists (CRLs)
• Online Certificate Status Protocol (OCSP)
• Certificate lifecycle management
• Certificate trust chains and validation
• Certificate Policy (CP) and Certification Practice Statement (CPS)

Cryptographic Technologies

• Public Key Cryptography
• Symmetric and asymmetric encryption
• Advanced Encryption Standard (AES)
• RSA
• Elliptic Curve Cryptography (ECC)
• Cryptographic hashing algorithms
• Digital signatures
• Cryptographic key generation and rotation
• Secure key storage and destruction
• Cryptographic algorithm and protocol security

Hardware Security Modules and Key Management

Experience with relevant technologies would be advantageous:

• Hardware Security Modules (HSMs)
• Thales HSM solutions
• Entrust HSM solutions
• Utimaco HSM solutions
• Azure Key Vault
• Azure Managed HSM
• AWS Key Management Service (KMS)
• AWS CloudHSM
• Google Cloud KMS
• PKCS#11
• Enterprise cryptographic key management platforms

Certificate Management and Automation

• Certificate discovery and inventory management
• Certificate issuance and renewal automation
• Certificate expiration monitoring
• Certificate revocation management
• Automated Certificate Management Environment (ACME)
• Simple Certificate Enrolment Protocol (SCEP)
• Network Device Enrolment Service (NDES)
• Certificate Management Protocol (CMP)
• Venafi, Keyfactor, DigiCert or equivalent certificate lifecycle management solutions
• PowerShell and scripting automation

Authentication and Secure Communications

• SSL/TLS
• Mutual TLS (mTLS)
• Certificate-based authentication
• Public and private key management
• Secure web application communications
• VPN certificate authentication
• 802.1X certificate‑based network authentication
• Secure email certificates
• Digital signing and verification
• API and application certificate security

Enterprise Infrastructure and Integration

• Microsoft Active Directory
• Microsoft Entra ID
• Windows Server
• Linux and Unix
• Web servers and application servers
• Enterprise networking and firewalls
• Cloud and hybrid infrastructure
• Identity and access management integration
• Application and database encryption

Automation and Troubleshooting

• PowerShell
• OpenSSL
• Windows Certificate Manager
• Microsoft certutil
• REST APIs
• Certificate validation and troubleshooting
• PKI monitoring and reporting
• Automated certificate deployment
• PKI health checks and diagnostics

Security Frameworks and Standards

• ISO/IEC 27001
• NIST Cybersecurity Framework
• NIST SP 800-57 – Key Management
• NIST SP 800-53 – Security and Privacy Controls
• NIST SP 800-52 – TLS Configuration Guidelines
• RFC 5280 – X.509 Public Key Infrastructure
• FIPS 140-2 / FIPS 140-3
• Relevant cryptographic security policies and standards
• POPIA and applicable data protection requirements

Relevant Certifications (Advantageous)

One or more of the following certifications would be beneficial:

• Certified Information Systems Security Professional (CISSP)
• Certified Cloud Security Professional (CCSP)
• CompTIA Security+
• Microsoft Certified: Windows Server Hybrid Administrator Associate
• Microsoft Certified: Azure Security Engineer Associate
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• GIAC Security Essentials (GSEC)
• Relevant PKI or certificate management certifications
• Keyfactor, Venafi, DigiCert or equivalent vendor training and certifications
• Relevant HSM administration or cryptographic key management certifications
• Relevant Microsoft Azure, AWS or cloud security certifications

Key Personal Attributes

• Strong analytical and technical problem‑solving abilities.
• Excellent attention to detail and accuracy.
• Ability to troubleshoot complex PKI, certificate and encryption issues.
• Strong understanding of information security and cryptographic principles.
• Proactive approach to identifying security risks and preventing certificate‑related outages.
• Excellent communication and stakeholder engagement skills.
• Ability to collaborate effectively with cybersecurity, infrastructure, networking and application teams.
• Strong organisational and technical documentation skills.
• Ability to manage multiple security priorities and technical projects.
• High levels of confidentiality, accountability and professional integrity.

Application Requirements

Interested candidates should submit an updated CV clearly detailing their practical Public Key Infrastructure and cryptographic security experience, together with copies of relevant academic qualifications and professional certifications.

Candidates should specifically highlight:

• PKI platforms and Certificate Authority environments they have implemented, administered or supported.
• Experience with Microsoft AD CS, root and subordinate CAs, certificate templates and enrolment.
• Digital certificate lifecycle management, issuance, renewal and revocation experience.
• Practical experience with cryptographic key management, encryption and digital signatures.
• Exposure to Hardware Security Modules and enterprise key management technologies.
• SSL/TLS configuration, certificate validation and troubleshooting experience.
• Certificate automation tools, scripting and lifecycle management platforms.
• PKI integration with enterprise applications, networks, cloud platforms and identity services.
• PKI migrations, upgrades, disaster recovery or security improvement projects.
• The size and complexity of enterprise PKI environments they have supported.
• Relevant PKI, cryptography, information security and cloud security certifications.

Important: This is a specialist PKI and Cryptographic Security opportunity requiring demonstrable hands‑on experience with enterprise PKI technologies, certificate management and cryptographic security. General IT infrastructure, cybersecurity or certificate installation experience without substantial PKI expertise will not be sufficient.

Please note: Specific project requirements, remuneration, employment arrangements and working conditions will be confirmed during the recruitment process.