On-Prem Enterprise CA & HSM Setup

We are seeking a hands-on Principal PKI and Cryptographic Architect who can not only design the overall architecture but also actively build, configure, and deliver the core cryptographic foundation.
​This rollout covers an on-premise, multi-tier Public Key Infrastructure across datacenter infrastructure, Kubernetes clusters, and branch locations. While an internal engineer will handle baseline OS provisioning, network plumbing, and routine fleet scripting, this role owns the end-to-end design, direct technical implementation, and production sign-off for the critical cryptographic components.
​What You Will Deliver:
​Author and deliver production-ready Certificate Policy and Certification Practice Statement (CP/CPS) documentation and technical certificate profiles.
​Design resilient validation paths (CRL and OCSP) to prevent branch outages across distributed enterprise networks.
​Personally conduct and execute the offline Root CA generation ceremony, establishing custodian procedures and secure key custody protocols.
​Hands-on installation, configuration, and integration of on-premise Hardware Security Modules with our CA engines using standard cryptographic interfaces.
​Hands-on build and configuration of an external on-premise HashiCorp Vault cluster as our Workload CA, integrating it directly with Kubernetes cert-manager for automated pod mutual TLS.
​Partner with our internal systems engineer to test and validate Active Directory Certificate Services auto-enrollment, 802.1X, and disaster recovery runbooks.

​Requirements:
​Demonstrated experience directly delivering and deploying on-premise enterprise PKI environments from ground zero.
​Hands-on execution experience with Hardware Security Modules and formal offline root key ceremonies.
​Deep practical engineering expertise with HashiCorp Vault PKI engine, Kubernetes cert-manager, and container workload encryption.
​Strong knowledge of Microsoft AD CS, Kerberos, directory services, and standard device enrollment protocols.
​Track record of delivering complete, production-grade technical runbooks and architecture documentation.

​How to Apply:
In your proposal, please provide specific examples or summaries of enterprise PKI implementations you have personally architected and delivered. Sanitized architecture diagrams, past key ceremony procedures, or runbook outlines that demonstrate your hands-on delivery experience are strongly encouraged.