Overview
The PKI Architect will play a crucial role in leading the architectural design and delivery of a migration from on-premises Active Directory Certificate Services (AD CS) to DigiCert ONE, a SaaS-based certificate management platform. This contract position, requiring two days a week on-site in London, involves collaboration with various stakeholders including the Global Digital team and security personnel to ensure the seamless transition and governance of the certificate services environment across a distributed enterprise.
Responsibilities
- Design the target-state architecture for migrating certificate services from on-premise AD CS to DigiCert ONE.
- Define and document the security and Role-Based Access Control (RBAC) model for the new certificate environment.
- Produce architecture and operational documentation for the Global Digital operational team.
- Develop runbooks and operational guidance for consuming member firms.
- Support formal customer security reviews, providing documentation and subject matter expertise as required.
- Advise on certificate lifecycle management, encryption standards, and PKI best practices throughout the migration.
- Work with technical and business stakeholders to ensure a smooth, low-risk transition with minimal disruption to certificate consumers.
Requirements
- Strong, demonstrable understanding of Active Directory Certificate Services (AD CS).
- Minimum 5 years' hands-on experience with enterprise-grade certificate management.
- In-depth knowledge of certificates, PKI concepts, and encryption technologies.
- General working knowledge of Active Directory.
- Experience designing and implementing security and RBAC models.
- Proven experience producing high-quality technical documentation (architecture documents, runbooks, operational guides).
- Experience supporting or participating in formal security review processes.
- Experience with a SaaS-based certificate management platform, ideally DigiCert ONE (desirable).