Security & HSM Architect

Security & HSM Architect Remote | Global This is highly urgent - we can only consider those that can start by the first week of October (working part-time is a possibility) We are looking for an experienced Security & HSM Architect to design the end-to-end security architecture for a highly secure platform deployed within enterprise and government data centres. The platform operates on-premise within air-gapped environments, so this role requires genuine expertise in cryptography, PKI and Hardware Security Modules. This is primarily an architecture and advisory engagement: you will develop the security design and implementation plan, with an established team of DevOps and Platform Engineers responsible for delivery. Key Responsibilities • Design the end-to-end security architecture for on-premise, air-gapped environments • Define identity, encryption, certificate and key-management strategies • Design PKI hierarchies covering certificate issuance, rotation, revocation and offline root CAs • Architect HSM-backed key management, including deployment, integration, high availability and recovery • Establish secure key lifecycle processes, key ceremonies, quorum controls and operator access • Design secrets management, mTLS, workload identity and zero-trust controls • Conduct threat modelling and security architecture reviews • Produce clear architecture documents, security plans and implementation guidance • Advise enterprise and government clients on secure data-centre deployments • Guide DevOps and Platform Engineering teams throughout implementation Essential Experience • Proven experience designing enterprise-level security architecture • Strong hands-on knowledge of Hardware Security Modules in production environments • End-to-end understanding of PKI, cryptography and key lifecycle management • Experience with major HSM technologies such as Thales Luna, Entrust nShield, Utimaco or equivalent • Strong understanding of PKCS#11, encryption standards, key ceremonies and certificate management • Experience designing security for on-premise or air-gapped data centres • Ability to solve complex security problems and translate designs into practical implementation plans • Experience operating within highly secure enterprise, government, defence or similarly regulated environments Show more Show less

Proven experience designing enterprise-level security architecture; Strong hands-on knowledge of Hardware Security Modules in production environments; End-to-end understanding of PKI, cryptography and key lifecycle management; Experience with major HSM technologies such as Thales Luna, Entrust nShield, Utimaco or equivalent; Strong understanding of PKCS#11, encryption standards, key ceremonies and certificate management; Experience designing security for on-premise or air-gapped data centres; Ability to solve complex security problems and translate designs into practical implementation plans; Experience operating within highly secure enterprise, government, defence or similarly regulated environments

Design the end-to-end security architecture for on-premise, air-gapped environments; Define identity, encryption, certificate and key-management strategies; Design PKI hierarchies covering certificate issuance, rotation, revocation and offline root CAs; Architect HSM-backed key management, including deployment, integration, high availability and recovery; Establish secure key lifecycle processes, key ceremonies, quorum controls and operator access; Design secrets management, mTLS, workload identity and zero-trust controls; Conduct threat modelling and security architecture reviews; Produce clear architecture documents, security plans and implementation guidance; Advise enterprise and government clients on secure data-centre deployments; Guide DevOps and Platform Engineering teams throughout implementation