PKI Security Engineer / CLM Implementation Engineer | Contract | EMEA Financial Services
I’m hiring a senior PKI engineer to lead a Certificate Lifecycle Management (CLM) rollout across EMEA entities at a major global financial institution.
This is a hands-on delivery role, not BAU certificate admin. You’ll take the platform from design and pilot through production rollout and handover, and start building the groundwork for post-quantum cryptography (PQC) readiness over the next 1-3 years.

What you’ll be doing

Leading the phased CLM rollout across multiple entities
Building a central inventory of certificates, keys, CAs and owners, and remediating expired, orphaned or manually managed certs
Integrating CLM with AD CS, public CAs, HSMs, load balancers, cloud, Kubernetes and CI/CD pipelines
Automating the full certificate lifecycle via ACME, SCEP, EST and APIs
Supporting crypto discovery, identifying quantum-vulnerable algorithms and shaping PQC migration plans
Writing HLD/LLD, runbooks and handover docs, and acting as PKI/CLM SME to security, infra, cloud and DevOps teams

What you’ll need

Delivered an enterprise CLM platform across multiple business units or regions (Keyfactor, DigiCert TLM, Venafi, AppViewX or similar)
Strong PKI fundamentals: AD CS, root/issuing CAs, CRL/OCSP, HSM integration
Certificate automation across Windows, Linux, network, cloud and container environments
Scripting in PowerShell, Python or Bash; Terraform/Ansible a bonus
Regulated financial services experience (audit, change control, segregation of duties)
Working knowledge of crypto-agility, CBOM and NIST PQC standards
Vendor CLM certification is strongly preferred; CISSP/CCSP/SABSA is a plus

Location: London
Rate: £600 - £700 P/D (inside IR 35)
Duration: Initial 6 Months