PKI Engineers

Join the NATO Communications and Information Agency as a PKI Engineer based in Mons, Belgium. The role involves managing the full lifecycle of digital certificates, developing automation workflows, and ensuring the integrity and reliability of NATO's PKI environment to support cyber security operations.

Responsibilities

• Manage the full lifecycle of digital certificates, including issuance, renewal, revocation, and compliance auditing, ensuring the integrity and reliability of the organization’s PKI environment.
• Develop and implement automation workflows to streamline certificate management processes, reduce manual effort, and minimize operational risk.
• Analyze PKI system performance, identify optimization opportunities, and contribute to scalability improvements that meet evolving business needs.
• Contribute to ensuring high availability, resilience, and performance of PKI services across on-premises, hybrid, and cloud environments.
• Support the automation of certificate management workflows using scripting and automation tools (e.g., PowerShell, Python, Bash, Ansible, or similar technologies).
• Proactively monitor certificate health, identify potential expiration issues, and coordinate timely remediation to prevent service disruptions.
• Document actions taken and provide clear recommendations for follow-up or preventive measures to stakeholders.

Requirements

• Bachelor’s degree at a nationally recognised/certified University in a related discipline and 2 years post-related experience. Or exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate’s particular abilities or experience that is/are of interest to NCIA, that is, at least 6 years extensive and progressive expertise in duties related to the function of the post.
• At least 2 years of practical experience in designing, deploying, and supporting secure web services and associated architectures.
• Advanced expertise in PKI technologies, including X.509 digital certificates, Certificate Authorities, and supporting protocols such as OCSP, CRL distribution, and S/MIME.
• Strong background in cryptographic algorithms (RSA, ECC, AES, SHA-2) and security protocols such as TLS/SSL and IPsec.
• Proven capability in identifying, assessing, and mitigating security vulnerabilities, with experience applying industry best practices and compliance frameworks.
• Minimum 2 years of experience managing Credential Management Systems (CMS), including enrolment workflows, lifecycle management, and secure key handling.
• Skilled in troubleshooting certificate-related issues across multiple operating systems, including Windows, Linux, and macOS.
• Fluency in English, both written and spoken.

Skills

• PKI Technologies
• X.509 Digital Certificates
• Certificate Authorities
• OCSP Protocol
• CRL Distribution
• S/MIME
• Cryptographic Algorithms
• RSA
• ECC
• AES
• SHA-2
• TLS/SSL Protocols
• IPsec Protocol
• Security Vulnerability Assessment
• Credential Management Systems
• Enrolment Workflows
• Lifecycle Management
• Secure Key Handling
• Certificate Troubleshooting
• Windows Operating System
• Linux Operating System
• macOS Operating System

Languages

English