IAM Platform Engineer - PKI & Cloud Native

Do you want to build the secure foundation of a modern identity platform? Within the IAM Platform team at CBS, we are looking for an engineer who focuses on PKI, certificates, machine identities, and cloud-native security within an open and future-proof platform landscape.
Will you help build this?

Where you make the difference

In this role, you will work on the technical foundations for secure access and reliable machine-to-machine communication. You will design and build a modern, automated PKI service that replaces the current Microsoft-based root and intermediate CA. You will combine a strong security background with a platform engineering mindset, where GitOps, Infrastructure as Code, and self-service for DevOps and application teams are central.

You will work at the intersection of identity, security, and platform engineering.
In doing so:

• you will design and implement a new PKI architecture with root and intermediate CAs based on open standards, preferably with open-source technology;

• you will migrate the existing Microsoft PKI in phases to the new solution, with minimal impact on production environments, based on cloud-native, open-source software;

• you will set up automated certificate lifecycle management for issuance, renewal, revocation, and rotation, so that infrastructure and applications can provide themselves with certificates;

• you will build PKI as a platform service with GitOps workflows, Infrastructure as Code, and API-driven or self-service provisioning via platforms and CI/CD;

• you will integrate PKI with Kubernetes and container platforms, hybrid and cloud environments, on-premises workloads, and the IAM and Keycloak infrastructure, including TLS certificates, mTLS clients, truststores, and certificate-based authentication;

• you will document architectural choices, standards, roles, and responsibilities, and ensure security, compliance, and continuity, including ISO 27001 and relevant government guidelines.

Your future colleagues

You will become part of the IAM Platform team at CBS. You will have the opportunity to help build a young team, foster collaboration within the team, and shape the technical direction of the platform.
Within the team, colleagues work on various components of the IAM landscape, such as Keycloak, PKI, and cloud-native security. Together, you will build identity services that form an important building block for a secure and future-proof IT environment. In this development phase, collaboration, ownership, knowledge sharing, and continuous improvement are extra important.

This is you

You are a technically strong engineer with a feel for security and platform architecture.
You understand how identity, certificates, integrations, and automation come together in a modern IT environment.
Additionally, you bring:

• Extensive experience with PKI architectures and certificate authorities.

• Hands-on experience with Microsoft AD CS and modern or open-source PKI solutions; experience with HSM integration is a plus.

• Good knowledge of TLS, mTLS, X.509, cryptography, and key management.

• Experience with Infrastructure as Code, CI/CD, Git-based workflows, GitOps, and scripting in PowerShell, Bash, or Python, for example.

• Experience with Kubernetes and container platforms and knowledge of the integration between PKI, IAM, Keycloak, OIDC/OAuth/SAML, truststores, and certificate-based authentication.

• A hands-on, analytical, and solution-oriented approach, with ownership, quality awareness, and the ability to clearly explain complex technical matters to technical and non-technical stakeholders.

Factually well-arranged

We follow the CAO Rijk for our employment conditions.

This means that, among other things, you can count on the following:

• A salary of at least EUR 4,132,- and a maximum of EUR 6,275,- gross per month based on 36 hours. The grading depends on knowledge and experience.

• 8% holiday allowance and a 13th month. In total, this is 16.5% on top of your salary. We call this the Individual Choice Budget (IKB). You decide how, when, and in what way you want to use this budget.

• Pension accrual with the ABP Pension Fund.

• A laptop (Microsoft or Apple) and mobile phone (Android or iOS).

• Two to three days of working from home, the rest of the time you will be present in our recently renovated building. You will make further agreements about this within your team.

Come work on the facts

We will close the vacancy once we have sufficient candidates.