PKI Architect , Sailpoint , Cyber Arc Engineer at YES Ventures, London, £Contract Rate

Contract Type: Outside IR35

Working Arrangement: Fully remote, with occasional client-site visits

Initial Contract: 6 months minimum

Active SC Clearance : Mandatory

Programme Duration: Approximately 2 years of anticipated work

Start Date: 20th October

We are looking for experienced cybersecurity professionals to support enterprise security architecture, engineering and implementation programmes. These are long-term contract opportunities for specialists with strong hands-on technical expertise and experience delivering complex enterprise projects.

Key Responsibilities

• Design end-to-end enterprise PKI architecture, including offline Root CA, intermediate and issuing CAs, certificate policies and trust models.
• Provide technical expertise in Keyfactor Command and Certificate Lifecycle Management (CLM).
• Lead PKI transformation, centralisation, rationalisation and migration programmes.
• Implement certificate discovery, automated issuance, renewal, revocation, monitoring and API integrations.
• Integrate PKI with Microsoft AD CS, Windows and Linux infrastructure, enterprise applications and HSMs.
• Design high availability, CA redundancy, key backup and recovery, CRL/OCSP availability and disaster recovery.
• Provide technical leadership across architecture, design, engineering, implementation and governance.

Essential Experience

• Extensive enterprise PKI architecture and engineering experience.
• Strong hands-on Keyfactor Command / CLM expertise.
• Microsoft AD CS, HSM, X.509 certificates, TLS, CRL and OCSP.
• Experience delivering large-scale PKI transformation and centralisation.
• Strong technical stakeholder engagement and documentation skills.

Experience in UK government, defence or regulated environments is desirable.

Key Responsibilities

• Configure, develop and implement SailPoint identity governance solutions.
• Deliver identity lifecycle management, including joiner, mover and leaver processes.
• Implement identity aggregation, account correlation, provisioning and deprovisioning.
• Configure access certifications, access requests, entitlement management and role-based access controls.
• Integrate SailPoint with Active Directory, LDAP, cloud platforms and enterprise applications.
• Develop connectors, workflows, rules and API integrations.
• Troubleshoot production issues and support testing, deployment and technical documentation.

Essential Experience

• Hands-on SailPoint IdentityIQ (IIQ) and/or Identity Security Cloud (ISC) experience.
• Strong IAM and Identity Governance and Administration (IGA) knowledge.
• Experience with provisioning, access reviews, connectors and enterprise integrations.
• Knowledge of REST APIs, scripting and directory services.
• Strong engineering and problem-solving skills.

Experience with Java, BeanShell and XML is desirable, particularly for IdentityIQ roles.

Key Responsibilities

• Implement and support enterprise CyberArk Privileged Access Management (PAM).
• Configure and maintain Digital Vault, CPM, PSM and PVWA components.
• Onboard privileged accounts and implement password rotation, reconciliation and verification.
• Configure privileged session management, monitoring and recording.
• Integrate CyberArk with Windows, Linux, Active Directory and enterprise security tools.
• Troubleshoot platform and account management issues.
• Support high availability, disaster recovery, upgrades and security policy implementation.

Essential Experience

• Hands-on CyberArk PAM implementation and engineering.
• Strong knowledge of Vault, CPM, PSM and PVWA.
• Experience with privileged account onboarding and automated credential management.
• Knowledge of Windows/Linux environments, networking and enterprise security controls.
• Experience supporting enterprise PAM deployments.

CyberArk Privilege Cloud, Conjur and Secrets Management experience is desirable.

• Outside IR35 contract
• Fully remote working, with occasional client visits when required
• Minimum initial contract duration of 6 months
• Approximately 2 years of anticipated programme work
• Candidates must be available for technical interviews and able to demonstrate relevant hands-on delivery experience
  

Number of contractors required: 5 — 2 PKI Architects, 2 SailPoint Engineers and 1 CyberArk Engineer.