PKI & Cloud Architect (Contract)
DV Cleared | Hybrid (South West, UK)
Ncounter is seeking an experienced DV Cleared Architect to support a major Defence programme, driving the design and delivery of secure, large-scale infrastructure across both private and public cloud environments. This position focuses heavily on enterprise PKI and trust services, integrating modern authentication, federation, and certificate management capabilities across highly assured platforms.
You’ll take a leading role in shaping resilient architectures within secure, air-gapped environments, ensuring compliance with MOD and NCSC principles while delivering practical, scalable solutions to complex mission systems.
Key Responsibilities:
• Define and deliver enterprise-grade PKI and trust infrastructures covering Root/Issuing CAs, Registration Authorities, Validation Authorities, and Certificate Lifecycle Management systems
• Develop high-quality design artefacts, standards, and documentation for PKI, identity, and cross-domain architectures
• Provide technical guidance on Active Directory integration, federation services, and certificate-based authentication methods
• Architect solutions using VMWare Cloud Foundation (VCF) and contribute to hybrid deployments spanning AWS, GCP, and Azure environments
• Engage with stakeholders through technical workshops, design reviews, and assurance boards to align design outputs with programme goals
Essential Skills & Experience:
• Hands-on experience building and maintaining enterprise PKI and trust infrastructures (Root/Issuing CAs, RA, VA, CLM). Familiarity with Defence or government PKI ecosystems is advantageous
• Strong understanding of Active Directory, federation and identity management platforms, and certificate-based access controls
• Experience designing secure cloud solutions within private (VCF) and hyperscale (AWS, Azure, GCP) environments
• Knowledge of certificate auto-enrolment, key management, and hardware security modules (HSMs)
• Familiarity with relevant standards and policies such as X.509, RFC5280, TLS, FIPS 140-3, and NCSC or NIST identity guidance
• Background delivering within high-assurance, disconnected, or restricted network environments
This contract offers the chance to take technical ownership of critical design elements within a secure Defence platform. If you combine deep PKI knowledge with a track record of secure cloud solution delivery, Ncounter would welcome a confidential discussion
