Senior PKI Systems Engineer

Senior PKI & Cryptography Engineer | Apeldoorn, Netherlands | 12-month contract

We’re looking for a hands-on engineer with experience in PKI, digital certificates and cryptography. You’ll keep an existing Keyfactor EJBCA (PrimeKey) platform running while building and configuring a new PKI environment from designs already in place.

This role could suit a PKI Engineer, Cryptography Engineer, Certificate Services Engineer or Security Infrastructure Engineer with experience running certificate services in production.

What you’ll do

• Operate and maintain the existing EJBCA appliances and certificate authorities.
• Build and configure the new PKI environment, including root and subordinate certificate authorities.
• Support the certificate lifecycle, from key generation and certificate requests through to issuance and revocation.
• Integrate certificate services with IAM and provisioning platforms using REST APIs.
• Work with architects, security officers and operations teams, and document the setup for operational handover and audit.

What you’ll bring

• At least five years of demonstrable senior experience across PKI, cryptography and related security engineering.
• Hands-on experience building, configuring or operating enterprise PKI. EJBCA / PrimeKey experience is particularly relevant, and we’re also interested in engineers with strong production experience on platforms such as Microsoft AD CS or HashiCorp Vault PKI.
• Strong understanding of X.509 certificates, certificate signing requests, key pairs, TLS/mTLS and revocation via CRL and OCSP.
• Experience with Linux, DevOps, scripting such as Python, and API integrations.
• Familiarity with authentication flows, audit logging and security controls in complex environments.

Contract details

• Location – Apeldoorn, Netherlands. Hybrid working is negotiable.
• Start – 1 December 2026
• Duration – 12 months initially, with potential to extend
• Hours – 32–36 hours per week, with 36 preferred

Interested? Send your CV, availability and preferred weekly hours. Please include the PKI platforms you’ve worked with and what you personally built or maintained.