PKI Infrastructure Engineer — Certificates, Directory and Card Management for NATO with security clearance

ppEvery secure login, signed document and trusted connection across a large international organisation rests on its public key infrastructure. A multinational defence organisation is looking for a senior engineer to run that infrastructure day to day, design what comes next, and be the person other teams elevate to when certificates stop behaving. /ph3What You Would Be Doing /h3ulliInstalling, configuring and maintaining the organisation-wide public key infrastructure and every component it depends on — virtualised platform, networking, hardware. /liliRunning the directory service and its supporting web service, and keeping the dedicated databases healthy. /liliOwning certificate status checking and time stamping, so that revocation actually takes effect. /liliDeploying, integrating and managing the card management system, and supporting smart card enrolment and certificate issue. /liliManaging hardware security modules, including firmware upgrades. /liliAnalysing certificate authority logs: troubleshooting alarms and errors, and watching activity for what should not be there. /liliKeeping daily operations, backup and restore in order, and proving the restore works. /liliProviding second and third line technical support to the operating authorities and the customers of the service. /liliDesigning new components, writing the standard operating procedures that go with every change, and documenting new services properly. /liliInvestigating network faults, security incidents and performance problems, and carrying the improvements through to implementation. /liliSupporting the integration of security tooling into current and future environments, and running the testing, validation and acceptance that goes with it. /liliWriting the technical documentation the next engineer will need: installation guides, configuration baselines, test plans and reports, hardening guides. /liliWorking with project managers, engineers, architects and operational stakeholders, and handing over to operations with the knowledge transfer that makes a handover real. /liliBeing willing to work outside office hours when an incident or an operational requirement asks for it. /li /ulh3What you would bring /h3ulliAt least five years in cyber security or a closely related field — building security architecture, delivering security capabilities, or running demanding technical estates. /liliDeep knowledge of modern networking and internet protocols, including their security, and working competence configuring routers and switches. /liliHands-on administration of Windows Server, Red Hat Enterprise Linux and VMware, with backup and restore done in earnest. /liliPractical scripting in Python and PowerShell, and automation with Ansible. /liliReal familiarity with SSL, TLS and OpenSSL, and with SQL database administration. /liliFive years or more across network installation, testing and integration; network support and performance monitoring; migration projects; and fault diagnosis to agreed procedures. /liliConfiguration, maintenance and repair of storage networks, servers, tape libraries and virtualisation platforms. /liliSystems installation and decommissioning, quality plans and method statements, integration builds and test specifications, configuration management and problem management. /liliRecent work with Juniper, Palo Alto and RSA NetWitness, and design and configuration of infrastructure elements inside projects — routing, switching, virtualisation. /liliA record of delivering into industry, government or military organisations, including deployments to operational areas, working alone or coordinating an industry team. /liliStrong professional English, written and spoken, with genuine technical writing ability. /liliNice to have: experience supporting a military or governmental organisation. /li /ulpExtensions are offered where the work goes well. Applications are reviewed as they arrive. /p /p