Overview
The Public Key Infrastructure (PKI) Engineer operates and maintains the BICES Enterprise Public Key Infrastructure (BEPKI) and serves as its service owner. The role involves advising on the integration of authentication, integrity, non-repudiation, and confidentiality aspects into existing and upcoming operational services on BICES.
Key Responsibilities
- Installs, configures, maintains, monitors, and supports BEPKI systems including certification authority, registration authority, hardware security module, directory, certificate-status, time-stamping, and database services.
- Maintains associated policies, procedures, accreditation evidence, logs, backups, and performance information.
- Provides second-level technical support, investigates faults, supports service modifications and integration, and coordinates with vendors and external certification authority teams.
- Supports BICES exercises and missions and trains registration authority personnel.
- Drafts and updates security policies, standard operating procedures, certificate policy, and certification practice statement documentation.
- Monitors certification authority logs, system alarms, errors, and user activity, and investigates anomalous behaviour.
- Performs regular backups, restoration tests, upgrades, database maintenance, and other recurring administration.
- Prepares and executes test scenarios for backups, restoration, upgrades, configuration changes and service enhancements.
- Prepares BEPKI systems and evidence for vulnerability assessments, compliance audits, accreditation activities, exercises, and missions.
- Supports approved BEPKI modifications and capability changes by providing technical input, estimates, test results, and implementation evidence.
- Coordinates assigned technical activities with vendors and other contributors.
- Contributes PKI expertise to relevant BGX programme and project activities.
- Delivers second-level technical support and works with BEPKI vendors to diagnose and resolve service issues.
- Manages the top-level BICES registration authority and provides technical guidance to other registration authorities.
- Coordinates with national root certification authority operation teams, BEPKI entities, BGX staff, and other personnel engaged in related activities.
Required Experience
- At least 3 years post-related experience;
- Experience in operation and configuration of Information Security and Cryptography, such as PKI based symmetric and asymmetric encryption, hash functions, digital signatures, digital certificates, PKI system development, design and day-to-day management in complex IT environments with multiple domains;
- Experience in management of certified/accredited PKI CA (deployment, installation, configuration and maintenance) solutions;
- Experience in deployment, installation, configuration and maintenance of digital certificates, auto-enrolment services, and HSM;
- Experience in the management of PKI RAs;
- Experience in CIS certification and accreditation in complex IT environments;
- Experience in certificate-based Multi-Factor Authentication (MFA) tokens and its integration in Windows, Linux systems for user access;
- Knowledge of the principles of computer and communications security, networking, and vulnerabilities of modern operating systems and applications;
- Experience in drafting security policies, including PKI related policies for complex IT environments;
- Demonstrated experience of analysing and interpreting system, security and application logs in order to diagnose faults and spot abnormal behaviours of the BICES PKI CA and related services;
- Extensive experience in SSL, TLS, and OpenSSL.
- Knowledge of and experience in the NATO security policy and the related directives (Desirable);
- Practical experience for Multi-Factor Authentication with use of PKI based user hardware tokens (Desirable);
- Practical experience in VMware and holding system administration certificates (Desirable);
- Knowledge of NATO PKI certificate policy and certification practice statement (Desirable);
- Prior experience of working in an international environment comprising both military and civilian elements (Desirable);
- Experience with on-premises PKI platforms such as Entrust Certificate Authority and/or Red Hat Certificate System (Desirable);
- Extensive experience in operating systems backup and restore (Desirable);
- Practical experience in scripting (PowerShell) (Desirable).
Qualifications
University degree in Computer Science, Computer Engineering, Systems Engineering, Mathematics or related discipline;
