PKI Infrastructure Engineer — Certificates, Directory andCard Management for NATO with security

Every secure login, signed document and trusted connection across a large international organisation rests on its public key infrastructure. A multinational defence organisation is looking for a senior engineer to run that infrastructure day to day, design what comes next, and be the person other teams escalate to when certificates stop behaving. What you would be doing Installing, configuring and maintaining the organisation-wide public key infrastructure and every component it depends on — virtualised platform, networking, hardware. Running the directory service and its supporting web service, and keeping the dedicated databases healthy. Owning certificate status checking and time stamping, so that revocation actually takes effect. Deploying, integrating and managing the card management system, and supporting smart card enrolment and certificate issue. Managing hardware security modules, including firmware upgrades. Analysing certificate authority logs: troubleshooting alarms and errors, and watching activity for what should not be there. Keeping daily operations, backup and restore in order, and proving the restore works. Providing second and third line technical support to the operating authorities and the customers of the service. Designing new components, writing the standard operating procedures that go with every change, and documenting new services properly. Investigating network faults, security incidents and performance problems, and carrying the improvements through to implementation. Supporting the integration of security tooling into current and future environments, and running the testing, validation and acceptance that goes with it. Writing the technical documentation the next engineer will need: installation guides, configuration baselines, test plans and reports, hardening guides. Working with project managers, engineers, architects and operational stakeholders, and handing over to operations with the knowledge transfer that makes a handover real. Being willing to work outside office hours when an incident or an operational requirement asks for it. What you would bring At least five years in cyber security or a closely related field — building security architecture, delivering security capabilities, or running demanding technical estates. Deep knowledge of modern networking and internet protocols, including their security, and working competence configuring routers and switches. Hands-on administration of Windows Server, Red Hat Enterprise Linux and VMware, with backup and restore done in earnest. Practical scripting in Python and PowerShell, and automation with Ansible. Real familiarity with SSL, TLS and OpenSSL, and with SQL database administration. Five years or more across network installation, testing and integration; network support and performance monitoring; migration projects; and fault diagnosis to agreed procedures. Configuration, maintenance and repair of storage networks, servers, tape libraries and virtualisation platforms. Systems installation and decommissioning, quality plans and method statements, integration builds and test specifications, configuration management and problem management. Recent work with Juniper, Palo Alto and RSA NetWitness, and design and configuration of infrastructure elements inside projects — routing, switching, virtualisation. A record of delivering into industry, government or military organisations, including deployments to operational areas, working alone or coordinating an industry team. Strong professional English, written and spoken, with genuine technical writing ability. Nice to have: experience supporting a military or governmental organisation. Extensions are offered where the work goes well. Applications are reviewed as they arrive.