IAM Platform Engineer - PKI & Cloud Native

You are a technically strong engineer with a sense for security and platform architecture.
You understand how identity, certificates, integrations, and automation come together in a modern IT environment.
Additionally, you bring:

• Extensive experience with PKI architectures and certificate authorities.

• Hands-on experience with Microsoft AD CS and modern or open source PKI solutions; experience with HSM integration is a plus.

• Good knowledge of TLS, mTLS, X.509, cryptography, and key management.

• Experience with Infrastructure as Code, CI/CD, Git-based workflows, GitOps, and scripting in, for example, PowerShell, Bash, or Python.

• Experience with Kubernetes and container platforms and knowledge of the integration between PKI, IAM, Keycloak, OIDC/OAuth/SAML, truststores, and certificate-based authentication.

• A hands-on, analytical, and solution-oriented way of working, with ownership, quality awareness, and the ability to explain complex technical subject matter clearly to both technical and non-technical stakeholders.

Our employment conditions follow the CAO Rijk.

This means you can count on the following, among other things:

• A salary of at least EUR 4,132 and at most EUR 6,275 gross per month based on 36 hours. The grading is dependent on knowledge and experience.

• 8% holiday allowance and a 13th month. In total, this is 16.5% on top of your salary. We call this the Individual Choice Budget (IKB). You decide yourself how, when, and in what way you want to use this budget.

• Pension accrual at the ABP Pension Fund.

• A laptop (Microsoft or Apple) and mobile phone (Android or iOS).

• Two to three days of working from home, the rest you are present in our recently renovated building. You will make further agreements about this within your team.

We will close the vacancy once sufficient candidates have applied.

Do you want to build the secure foundation of a modern identity platform? Within the IAM Platform team at CBS, we are looking for an engineer focusing on PKI, certificates, machine identities, and cloud-native security within an open and future-proof platform landscape.
Will you help build this?

In this role, you will work on the technical foundations underlying secure access and reliable machine-to-machine communication. You will design and build a modern, automated PKI service that replaces the current Microsoft-based root and intermediate CA. In doing so, you will combine a strong security background with a platform engineering mindset, in which GitOps, Infrastructure as Code, and self-service for DevOps and application teams are central.

You will work at the intersection of identity, security, and platform engineering.
In this role, you will:

• design and implement a new PKI architecture with root and intermediate CAs based on open standards, preferably using open source technology;

• migrate the existing Microsoft PKI in phases to the new solution, with minimal impact on production environments, based on cloud-native, open-source software;

• set up automated certificate lifecycle management for issuance, renewal, revocation, and rotation, so that infrastructure and applications can provide themselves with certificates;

• build PKI as a platform service with GitOps workflows, Infrastructure as Code, and API-driven or self-service provisioning via platforms and CI/CD;

• integrate PKI with Kubernetes and container platforms, hybrid and cloud environments, on-premises workloads, and the IAM and Keycloak infrastructure, including TLS certificates, mTLS clients, truststores, and certificate-based authentication;

• document your architectural choices, standards, roles, and responsibilities, and ensure security, compliance, and continuity, including ISO 27001 and relevant government guidelines.