Senior Infrastructure & Security Architect

For one of our Partners, we are looking for a Senior Infrastructure & Security Architect (m/f/n) to support a long-term project delivered for a European Union organization based in Luxembourg.

The CertaaS Architect is responsible for driving the technical evolution, integration, standardisation, and adoption of the Certificate as a Service (CertaaS) platform across all infrastructure and network services.

The primary objective is to establish CertaaS as the single, authoritative and automated solution for managing the complete lifecycle of digital certificates, regardless of the infrastructure technology, service domain, or squad responsible for operating it.

The architect must combine strong architectural expertise with practical engineering skills, actively contributing to the design, development, integration, troubleshooting, and deployment of certificate management solutions.

The role acts as a technical bridge between squads, ensuring that certificate management is no longer implemented independently within each technical domain but delivered through a consistent, secure, reusable, and centrally governed service.

Key Responsibilities:

A. CertaaS Architecture & Service Evolution

• Define and maintain the target architecture of the CertaaS ecosystem, covering certificate issuance, renewal, distribution, installation, monitoring, and revocation.
• Design scalable, secure, highly available, and automated certificate lifecycle management solutions.
• Develop standard certificate integration patterns, reusable APIs, workflows, and automation components.
• Define certificate management standards, including certificate profiles, naming conventions, trust chains, key protection, and cryptographic requirements.
• Identify existing certificate management practices across infrastructure services and propose their progressive consolidation into CertaaS.
• Contribute to the CertaaS technical roadmap, prioritising automation, reliability, security, and operational efficiency.
• Ensure alignment with enterprise security, PKI, compliance, and infrastructure architecture requirements.

B. Cross-Domain Technical Integration

Design, implement, and support CertaaS integration across the following infrastructure domains:

• Reverse Proxy - Automated certificate deployment and renewal on NGINX reverse proxies, including TLS termination and certificate chains
• Load Balancing - Automated management and deployment of certificates on F5 BIG-IP and VELOS platforms
• VPN & Remote Access - Certificate lifecycle management for VPN gateways, authentication services, and remote access infrastructure
• Firewalls - Integration with Fortinet and Check Point platforms for certificates used by TLS inspection, management, VPN, and other supported services
• Network Infrastructure - Certificate provisioning for routers, switches, controllers, management interfaces, and network authentication protocols
• Cisco ISE - Integration of identity and network access control certificates, including EAP-TLS, administrative interfaces, and related trust chains
• Telephony - Certificate management for Cisco Unified Communications Manager (CUCM) and associated collaboration infrastructure
• Videoconferencing - TLS and mutual TLS certificate management for video communication platforms, endpoints, and associated services

For each domain, the architect is expected to:

• Assess existing certificate management mechanisms and operational constraints.
• Define the appropriate CertaaS integration approach.
• Develop or contribute directly to integration components and automation.
• Validate certificate deployment, renewal, rollback, and recovery procedures.
• Work alongside the responsible squad to implement the solution.
• Ensure that integration is documented, tested, monitored, and operationally maintainable.
• Eliminate unnecessary domain-specific certificate management processes.

C. Hands-on Engineering & Automation

The architect must be capable of independently designing and implementing technical solutions, not simply producing architectural documentation.

Expected engineering activities include:

• Developing automation scripts, APIs, and integration components.
• Implementing certificate issuance and renewal workflows using technologies such as ACME, REST APIs, SCEP, EST, and other applicable PKI interfaces.
• Building integrations using Bash, Ansible/AWX, GitLab CI/CD, and API-based automation.
• Developing proof-of-concepts and reference implementations for squad adoption.
• Troubleshooting complex TLS, PKI, certificate chain, and authentication issues.
• Performing certificate validation, deployment testing, and troubleshooting using OpenSSL and other diagnostic tools.
• Supporting production deployments and resolving complex certificate-related incidents.
• Integrating certificate automation with existing infrastructure deployment and configuration management pipelines.
• Ensuring certificate private keys and sensitive material are handled securely.
• The architect is expected to produce working implementations, not merely design specifications.

D. Cross-Squad Technical Leadership

The CertaaS Architect acts as the central technical integration point between CertaaS and all infrastructure squads.

Responsibilities include:

• Establishing and maintaining strong technical collaboration with squad architects, engineers, developers, and Proxy Product Owners.
• Identifying certificate-related dependencies and integration opportunities across squads.
• Facilitating cross-squad technical decisions and resolving integration blockers.
• Promoting common architectures and reusable solutions instead of duplicated implementations.
• Supporting squads during the transition from manual or local certificate management to CertaaS.
• Ensuring technical consistency across different infrastructure technologies.
• Participating in architecture reviews, PI Planning, cross-squad coordination, and relevant technical committees.
• Coaching engineers and transferring knowledge to operational teams.
• Acting as the reference expert for certificate integration and lifecycle automation.
• The architect must be an enabler of squad delivery, not an additional approval layer or operational bottleneck.

E. Security, Compliance & Operational Readiness

• Ensure certificates comply with applicable organisational security and cryptographic standards.
• Promote secure private key generation, distribution, storage, rotation, and revocation.
• Ensure certificate renewal processes are automated, resilient, and traceable.
• Define mechanisms to detect expired, expiring, misconfigured, untrusted, and unmanaged certificates.
• Integrate certificate status and lifecycle monitoring with operational observability platforms.
• Define appropriate alerting, escalation, and incident management procedures.
• Ensure deployments support rollback and recovery in the event of certificate-related failures.
• Contribute to operational documentation, SOPs, and knowledge transfer for L1/L2 support.
• Maintain certificate traceability and service ownership through appropriate inventory and configuration management mechanisms.

Required Technical Competencies

PKI and Certificate Management - Expert

• Strong understanding of X.509, TLS 1.2/1.3, mutual TLS, and certificate trust chains.
• Practical experience with public and private PKI infrastructures.
• Strong understanding of certificate issuance, renewal, revocation, and validation.
• Knowledge of certificate profiles, SAN, EKU, CRL, OCSP, and certificate authority hierarchies.
• Experience with automated certificate management technologies and protocols.
• Understanding of cryptographic key management, including HSM and secure key storage concepts.

Network & Security Infrastructure - Advanced

Practical experience with several of the following technologies:

• F5 BIG-IP / VELOS.
• NGINX reverse proxy.
• Fortinet and Check Point firewalls.
• VPN gateways and remote access technologies.
• Cisco ISE and 802.1X / EAP-TLS.
• Cisco CUCM and unified communications infrastructure.
• Videoconferencing and collaboration platforms.
• Linux infrastructure and network services.

Deep expertise in every platform is not required, but the candidate must be able to understand unfamiliar environments, collaborate with domain specialists, and independently implement integrations.

DevOps & Automation - Advanced

• Bash scripting and shell automation.
• Ansible and AWX automation.
• Git and GitLab CI/CD.
• REST APIs and service integration.
• Infrastructure as Code principles and Terraform.
• Automated testing and deployment pipelines.
• Secure secret handling.
• Configuration management and version-controlled infrastructure.

Required Professional Competencies

• Ability to move seamlessly between high-level architecture and detailed technical implementation.
• Strong analytical and troubleshooting capabilities.
• Proven experience delivering solutions involving several infrastructure teams.
• Ability to influence technical decisions without relying on hierarchical authority.
• Strong communication skills with architects, developers, operations teams, and service management.
• Practical and solution-oriented mindset, favouring working implementations over unnecessary complexity.
• Ability to challenge existing practices constructively.
• Ownership and accountability for end-to-end technical outcomes.
• Strong documentation and knowledge-sharing discipline.

Expected Deliverables

• CertaaS Target Architecture: An up-to-date architecture defining components, integration patterns, security controls, and operational dependencies.
• Certificate Integration Inventory: A consolidated view of certificate management practices, integration opportunities, and gaps across infrastructure domains.
• Cross-Domain Integration Roadmap: A prioritised plan for bringing all relevant infrastructure services under CertaaS management.
• Reusable Automation Components: Tested and version-controlled scripts, APIs, Ansible roles, and deployment pipelines.
• Reference Implementations: Working CertaaS integrations demonstrating how squads can implement the standard solution.
• Operational Documentation: Technical designs, runbooks, SOPs, rollback procedures, and troubleshooting guides.
• Monitoring & Compliance: Mechanisms for detecting unmanaged, expiring, or incorrectly deployed certificates.
• Knowledge Transfer: Documentation, technical workshops, and practical enablement for squads and operational support teams.
• All technical deliverables must follow established engineering governance, including GitLab repositories, merge requests, peer reviews, automated testing, and controlled releases.

Success Criteria & KPIs

• CertaaS Adoption - Increasing percentage of in-scope certificates managed through CertaaS
• Cross-Domain Coverage - Progressive integration of all targeted infrastructure domains
• Automated Renewals - Increasing percentage of certificates renewed and deployed without manual intervention
• Certificate Incidents - Reduction in incidents caused by expiration, incorrect chains, or failed renewals
• Certificate Visibility - Comprehensive inventory with identified ownership, expiry, and lifecycle status
• Deployment Reliability - Successful certificate deployment and renewal with validated rollback mechanisms
• Integration Reusability - Adoption of common integration components by several squads
• Operational Readiness - Every production integration supported by documentation, monitoring, and recovery procedures

Operating Model & Collaboration

The CertaaS Architect works transversally across infrastructure squads and in close collaboration with the CertaaS service owner, Lead Architect, security stakeholders, and operational management.

The architect:

• Owns technical consistency and integration patterns across domains.
• Collaborates with squad architects and engineers on implementation.
• Contributes directly to scripting, configuration, testing, and deployment.
• Supports PPOs in defining and refining integration work items.
• Coordinates dependencies without replacing squad-level delivery ownership.
• Works with operations to ensure solutions are supportable and maintainable.
• Escalates cross-domain design conflicts and delivery blockers when necessary.
• The central CertaaS service retains ownership of the common certificate lifecycle capabilities, while domain squads remain accountable for their infrastructure and production operations.

Expected Profile

A senior infrastructure or security architect with a strong background in networking, PKI, automation, and distributed infrastructure services.The ideal candidate has previously designed and delivered complex infrastructure integrations and remains actively involved in hands-on engineering.

This position requires an individual who is equally comfortable:

• Designing an enterprise-grade certificate automation architecture.
• Writing and troubleshooting an Ansible playbook or Bash integration.
• Diagnosing a complex TLS or certificate chain issue.
• Working with an F5, NGINX, firewall, or Cisco engineer.
• Leading technical discussions involving several squads.
• Supporting production teams during a certificate-related incident.
• The role is not suitable for an architect who focuses exclusively on diagrams, documentation, governance, or coordination without direct engineering contributions.

Offer:

• B2B contract
• Hybrid set-upwith 1 trip per month (negotiable) to Luxembourg without reimbursement.
• Rate: 650 EUR net/MD