{"id":4010484,"url":"https://alion.io/job/shimi-senior-infrastructure-security-architect","title":"Senior Infrastructure & Security Architect","company":{"id":1623,"name":"SHIMI","domain":"shimi.pl","url":"https://alion.io/company/shimi","size_band":"51-200","is_staffing_agency":false,"employer_type":"staffing","is_intermediary":false,"listed_via":null,"ats_vendor":"Recruitify","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":13650,"max":null,"currency":"EUR","period":"month","gross":null,"usd_annual":183564},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Ansible","optional":false},{"name":"AWX","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Configuration Management","optional":false},{"name":"Git","optional":false},{"name":"GitLab","optional":false},{"name":"GitLab CI","optional":false},{"name":"Incident Management","optional":false},{"name":"Linux","optional":false},{"name":"Nginx","optional":false},{"name":"OpenSSL","optional":false},{"name":"PKI","optional":false},{"name":"Rest API","optional":false},{"name":"Terraform","optional":false},{"name":"VPN","optional":false}],"status":"live","first_seen_at":"2026-11-10T08:48:00Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T20:41:04Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"For one of our Partners, we are looking for a Senior Infrastructure & Security Architect (m/f/n) to support a long-term project delivered for a European Union organization based in Luxembourg.\nThe CertaaS Architect is responsible for driving the technical evolution, integration, standardisation, and adoption of the Certificate as a Service (CertaaS) platform across all infrastructure and network services.\nThe primary objective is to establish CertaaS as the single, authoritative and automated solution for managing the complete lifecycle of digital certificates, regardless of the infrastructure technology, service domain, or squad responsible for operating it.\nThe architect must combine strong architectural expertise with practical engineering skills, actively contributing to the design, development, integration, troubleshooting, and deployment of certificate management solutions.\nThe role acts as a technical bridge between squads, ensuring that certificate management is no longer implemented independently within each technical domain but delivered through a consistent, secure, reusable, and centrally governed service.\nKey Responsibilities:\nA. CertaaS Architecture & Service Evolution\nDefine and maintain the target architecture of the CertaaS ecosystem, covering certificate issuance, renewal, distribution, installation, monitoring, and revocation.\nDesign scalable, secure, highly available, and automated certificate lifecycle management solutions.\nDevelop standard certificate integration patterns, reusable APIs, workflows, and automation components.\nDefine certificate management standards, including certificate profiles, naming conventions, trust chains, key protection, and cryptographic requirements.\nIdentify existing certificate management practices across infrastructure services and propose their progressive consolidation into CertaaS.\nContribute to the CertaaS technical roadmap, prioritising automation, reliability, security, and operational efficiency.\nEnsure alignment with enterprise security, PKI, compliance, and infrastructure architecture requirements.\nB. Cross-Domain Technical Integration\nDesign, implement, and support CertaaS integration across the following infrastructure domains:\nReverse Proxy - Automated certificate deployment and renewal on NGINX reverse proxies, including TLS termination and certificate chains\nLoad Balancing - Automated management and deployment of certificates on F5 BIG-IP and VELOS platforms\nVPN & Remote Access - Certificate lifecycle management for VPN gateways, authentication services, and remote access infrastructure\nFirewalls - Integration with Fortinet and Check Point platforms for certificates used by TLS inspection, management, VPN, and other supported services\nNetwork Infrastructure - Certificate provisioning for routers, switches, controllers, management interfaces, and network authentication protocols\nCisco ISE - Integration of identity and network access control certificates, including EAP-TLS, administrative interfaces, and related trust chains\nTelephony - Certificate management for Cisco Unified Communications Manager (CUCM) and associated collaboration infrastructure\nVideoconferencing - TLS and mutual TLS certificate management for video communication platforms, endpoints, and associated services\nFor each domain, the architect is expected to:\nAssess existing certificate management mechanisms and operational constraints.\nDefine the appropriate CertaaS integration approach.\nDevelop or contribute directly to integration components and automation.\nValidate certificate deployment, renewal, rollback, and recovery procedures.\nWork alongside the responsible squad to implement the solution.\nEnsure that integration is documented, tested, monitored, and operationally maintainable.\nEliminate unnecessary domain-specific certificate management processes.\nC. Hands-on Engineering & Automation\nThe architect must be capable of independently designing and implementing technical solutions, not simply producing architectural documentation.\nExpected engineering activities include:\nDeveloping automation scripts, APIs, and integration components.\nImplementing certificate issuance and renewal workflows using technologies such as ACME, REST APIs, SCEP, EST, and other applicable PKI interfaces.\nBuilding integrations using Bash, Ansible/AWX, GitLab CI/CD, and API-based automation.\nDeveloping proof-of-concepts and reference implementations for squad adoption.\nTroubleshooting complex TLS, PKI, certificate chain, and authentication issues.\nPerforming certificate validation, deployment testing, and troubleshooting using OpenSSL and other diagnostic tools.\nSupporting production deployments and resolving complex certificate-related incidents.\nIntegrating certificate automation with existing infrastructure deployment and configuration management pipelines.\nEnsuring certificate private keys and sensitive material are handled securely.\nThe architect is expected to produce working implementations, not merely design specifications.\nD. Cross-Squad Technical Leadership\nThe CertaaS Architect acts as the central technical integration point between CertaaS and all infrastructure squads.\nResponsibilities include:\nEstablishing and maintaining strong technical collaboration with squad architects, engineers, developers, and Proxy Product Owners.\nIdentifying certificate-related dependencies and integration opportunities across squads.\nFacilitating cross-squad technical decisions and resolving integration blockers.\nPromoting common architectures and reusable solutions instead of duplicated implementations.\nSupporting squads during the transition from manual or local certificate management to CertaaS.\nEnsuring technical consistency across different infrastructure technologies.\nParticipating in architecture reviews, PI Planning, cross-squad coordination, and relevant technical committees.\nCoaching engineers and transferring knowledge to operational teams.\nActing as the reference expert for certificate integration and lifecycle automation.\nThe architect must be an enabler of squad delivery, not an additional approval layer or operational bottleneck.\nE. Security, Compliance & Operational Readiness\nEnsure certificates comply with applicable organisational security and cryptographic standards.\nPromote secure private key generation, distribution, storage, rotation, and revocation.\nEnsure certificate renewal processes are automated, resilient, and traceable.\nDefine mechanisms to detect expired, expiring, misconfigured, untrusted, and unmanaged certificates.\nIntegrate certificate status and lifecycle monitoring with operational observability platforms.\nDefine appropriate alerting, escalation, and incident management procedures.\nEnsure deployments support rollback and recovery in the event of certificate-related failures.\nContribute to operational documentation, SOPs, and knowledge transfer for L1/L2 support.\nMaintain certificate traceability and service ownership through appropriate inventory and configuration management mechanisms.\nRequired Technical Competencies\nPKI and Certificate Management - Expert\nStrong understanding of X.509, TLS 1.2/1.3, mutual TLS, and certificate trust chains.\nPractical experience with public and private PKI infrastructures.\nStrong understanding of certificate issuance, renewal, revocation, and validation.\nKnowledge of certificate profiles, SAN, EKU, CRL, OCSP, and certificate authority hierarchies.\nExperience with automated certificate management technologies and protocols.\nUnderstanding of cryptographic key management, including HSM and secure key storage concepts.\nNetwork & Security Infrastructure - Advanced\nPractical experience with several of the following technologies:\nF5 BIG-IP / VELOS.\nNGINX reverse proxy.\nFortinet and Check Point firewalls.\nVPN gateways and remote access technologies.\nCisco ISE and 802.1X / EAP-TLS.\nCisco CUCM and unified communications infrastructure.\nVideoconferencing and collaboration platforms.\nLinux infrastructure and network services.\nDeep expertise in every platform is not required, but the candidate must be able to understand unfamiliar environments, collaborate with domain specialists, and independently implement integrations.\nDevOps & Automation - Advanced\nBash scripting and shell automation.\nAnsible and AWX automation.\nGit and GitLab CI/CD.\nREST APIs and service integration.\nInfrastructure as Code principles and Terraform.\nAutomated testing and deployment pipelines.\nSecure secret handling.\nConfiguration management and version-controlled infrastructure.\nRequired Professional Competencies\nAbility to move seamlessly between high-level architecture and detailed technical implementation.\nStrong analytical and troubleshooting capabilities.\nProven experience delivering solutions involving several infrastructure teams.\nAbility to influence technical decisions without relying on hierarchical authority.\nStrong communication skills with architects, developers, operations teams, and service management.\nPractical and solution-oriented mindset, favouring working implementations over unnecessary complexity.\nAbility to challenge existing practices constructively.\nOwnership and accountability for end-to-end technical outcomes.\nStrong documentation and knowledge-sharing discipline.\nExpected Deliverables\nCertaaS Target Architecture: An up-to-date architecture defining components, integration patterns, security controls, and operational dependencies.\nCertificate Integration Inventory: A consolidated view of certificate management practices, integration opportunities, and gaps across infrastructure domains.\nCross-Domain Integration Roadmap: A prioritised plan for bringing all relevant infrastructure services under CertaaS management.\nReusable Automation Components: Tested and version-controlled scripts, APIs, Ansible roles, and deployment pipelines.\nReference Implementations: Working CertaaS integrations demonstrating how squads can implement the standard solution.\nOperational Documentation: Technical designs, runbooks, SOPs, rollback procedures, and troubleshooting guides.\nMonitoring & Compliance: Mechanisms for detecting unmanaged, expiring, or incorrectly deployed certificates.\nKnowledge Transfer: Documentation, technical workshops, and practical enablement for squads and operational support teams.\nAll technical deliverables must follow established engineering governance, including GitLab repositories, merge requests, peer reviews, automated testing, and controlled releases.\nSuccess Criteria & KPIs\nCertaaS Adoption - Increasing percentage of in-scope certificates managed through CertaaS\nCross-Domain Coverage - Progressive integration of all targeted infrastructure domains\nAutomated Renewals - Increasing percentage of certificates renewed and deployed without manual intervention\nCertificate Incidents - Reduction in incidents caused by expiration, incorrect chains, or failed renewals\nCertificate Visibility - Comprehensive inventory with identified ownership, expiry, and lifecycle status\nDeployment Reliability - Successful certificate deployment and renewal with validated rollback mechanisms\nIntegration Reusability - Adoption of common integration components by several squads\nOperational Readiness - Every production integration supported by documentation, monitoring, and recovery procedures\nOperating Model & Collaboration\nThe CertaaS Architect works transversally across infrastructure squads and in close collaboration with the CertaaS service owner, Lead Architect, security stakeholders, and operational management.\nThe architect:\nOwns technical consistency and integration patterns across domains.\nCollaborates with squad architects and engineers on implementation.\nContributes directly to scripting, configuration, testing, and deployment.\nSupports PPOs in defining and refining integration work items.\nCoordinates dependencies without replacing squad-level delivery ownership.\nWorks with operations to ensure solutions are supportable and mainta...","description_format":"text","description_chars":13304,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Luxembourg","iso":"LU","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","IT Staffing & Staff Augmentation"],"lifecycle":[{"event":"open","at":"2026-11-10T09:48:47Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":21,"reasons":["conf:4","win:early"],"computed_at":"2026-11-11T01:26:47Z"},"pay":{"stated_usd_annual":183564,"is_top_pay":false},"html_url":"https://alion.io/job/shimi-senior-infrastructure-security-architect","json_url":"https://alion.io/job/shimi-senior-infrastructure-security-architect.json","meta":{"generated_at":"2026-11-11T01:26:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":123,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1623},"rest":"https://alion.io/mcp/rest/get_company?id=1623"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fshimi-senior-infrastructure-security-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fshimi-senior-infrastructure-security-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fshimi-senior-infrastructure-security-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/shimi-senior-infrastructure-security-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fshimi-senior-infrastructure-security-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4010484}},{"tool":"search_jobs","arguments":{"company":"shimi.pl","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4010484},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}