PKI Architect / PKI Engineer (16028) (80-100%)

Task

For our client in Wallisellen, we are looking immediately or by arrangement for an experienced PKI Architect / PKI Engineer for a long-term project assignment.
Based on an existing proof of concept with EJBCA, a productive PKI for issuing device identities (Manufacturer Device Certificates according to IEEE 802.1AR) is to be established. You will be responsible for the design and implementation of the PKI architecture with CA hierarchy and offline root, secure key management, as well as the preparation and execution of the key ceremony. Further focal points include integration into AD/Entra ID, hardening and role separation, as well as backup, restore and emergency preparedness. In addition, you will create the necessary operational, usage and maintenance concepts and accompany the solution until handover to regular operation.

Requirements

Mandatory requirements

• Proven establishment of at least one productive PKI from scratch under own responsibility - from architecture through key ceremony to operational handover
• Sound knowledge of X.509 and RFC 5280
• Practical experience with EJBCA in installation and operation
• Experience in creating CP/CPS as well as backup and recovery concepts including restore tests
• Experience with integration into Active Directory and Entra ID
• Knowledge in system hardening and network segmentation
• Good knowledge of Linux administration, container technologies and databases
• Ability to produce high-quality technical and operational documentation
• Good knowledge of German

Advantageous

• Knowledge of CMP according to RFC 4210, especially Lightweight CMP Profile (RFC 9483), as well as IEEE 802.1AR and BRSKI
• Experience with 802.1X and NAC based on certificates
• Certificate management in OT and industrial environments
• Knowledge of regulatory requirements such as IEC 62443 or NIS2 as well as experience with audits
• Experience with high availability at the database level
• Automation with Ansible or comparable technologies

Project duration 6 months (with option to extend)
Contact person Ursula Oesch , 052 224 44 15, oesch@iqplus.ch