PKI SME Engineer - Microsoft AD CS
Rate: £520 per day Inside IR35 Contract: 6-12 Months (Subject to Extension) Location: Remote with some occasional travel onsite to Bath.
Overview
We are seeking an experienced PKI SME Engineer to lead the hands-on implementation of a Microsoft Public Key Infrastructure (PKI) solution within a greenfield enterprise environment.
This is a delivery-focused role requiring a technical specialist with proven experience deploying Microsoft Active Directory Certificate Services (AD CS) at enterprise scale. The successful candidate will be responsible for building, configuring, testing, and transitioning a production-ready PKI capability into service, followed by a period of focused post-go-live hypercare.
Working from established designs and architecture, you will take ownership of the implementation, integration, testing, and operational handover of the PKI platform, ensuring it is secure, scalable, and production-ready.
Role Purpose
The PKI SME Engineer is responsible for the end-to-end delivery of a Microsoft PKI solution within a new enterprise environment.
You will carry out the technical implementation of Microsoft Active Directory Certificate Services (AD CS), integrating the service into enterprise infrastructure and validating the platform through comprehensive testing before supporting production cutover and hypercare activities.
This role is focused on technical delivery, testing, transition, and post-go-live support rather than solution design.
Key Responsibilities
PKI Platform Implementation
Build and configure a greenfield Microsoft PKI environment based on approved architectural designs.
Prepare and validate all platform prerequisites, including Windows Server, Active Directory, DNS, networking, service accounts, and security groups.
Offline Root Certificate Authority (CA)
Enterprise Issuing Certificate Authorities
Active Directory Certificate Services (AD CS) components
Supporting PKI infrastructure services
Certificate Services Configuration
Configure and manage certificate templates, policies, and permissions.
Implement auto-enrolment, certificate renewal, and certificate revocation processes.
Configure and validate Certificate Revocation Lists (CRLs), certificate chain publication, and supporting services.
Implement and support OCSP and NDES services where required.
Integration & Validation
Integrate PKI services with Active Directory and enterprise infrastructure.
Support integration with applications, devices, endpoints, and hybrid environments.
Execute build verification testing and functional validation activities.
Troubleshoot and resolve implementation defects and technical issues.
Go-Live & Hypercare
Support production deployment and service cutover activities.
Provide post-go-live hypercare support.
Investigate and resolve certificate, trust, authentication, and enrolment issues.
Work closely with operational support teams to ensure a smooth transition to business-as-usual support.
Documentation & Handover
Produce comprehensive as-built documentation.
Create operational runbooks and configuration records.
Document testing outcomes and implementation activities.
Deliver knowledge transfer sessions to support and operational teams.
Essential Technical Skills
Microsoft PKI Expertise
Strong hands-on experience implementing Microsoft Active Directory Certificate Services (AD CS).
Enterprise Certificate Authority (CA) deployment and administration.
Certificate lifecycle management.
PKI Technologies
Certificate Templates
Auto-Enrolment
Certificate Revocation Lists (CRL)
Online Certificate Status Protocol (OCSP)
Network Device Enrolment Service (NDES)
Certificate Chain Management
Trust Validation
Microsoft Infrastructure
Windows Server
Active Directory
Group Policy
PowerShell Scripting
Enterprise Integration
Integration of PKI with enterprise infrastructure and applications.
Experience supporting hybrid and on-premises environments.
Knowledge of identity, authentication, and security services.
Troubleshooting
Certificate chain troubleshooting.
TLS and SSL certificate troubleshooting.
Service authentication and trust-related issue resolution.
Certificate enrolment and renewal diagnostics.
Required Experience
Proven hands-on experience delivering enterprise PKI implementations.
Extensive experience deploying Microsoft AD CS environments.
Experience building and configuring enterprise-scale PKI solutions.
Strong background working across both on-premises and hybrid infrastructures.
Demonstrated experience supporting production deployments and post-go-live hypercare activities.
Desirable Skills
Microsoft security technologies.
Enterprise identity and access management solutions.
Infrastructure automation using PowerShell.
Experience within highly regulated or security-sensitive environments.
Knowledge of certificate-based authentication and enterprise security frameworks.
Neutral 2–4 sentence summary of what working at this company is like, drawn from public reviews and press coverage. Tone, collaboration style, pace, benefits highlights.
