PKI & Digital Identity Engineer (all genders)

You develop and integrate trust structures for identities, certificates and digital signatures. The focus is on a transparent certificate lifecycle and secure interfaces to applications. You treat issuance, renewal and revocation as a coherent operational process.

Certificates must reach the correct application, be renewed and be validated reliably. You plan trust chains, profiles and administrative responsibilities. Registration procedures, revocation checking and expiry monitoring are integrated. Signature processes connect identity, key access and validation. A recovery design accounts for the failure of a CA, HSM or other required services and is tested using concrete scenarios.

• Design and implement PKI structures, certificate profiles and administrative roles according to their purpose.
• Automate certificate issuance, renewal and revocation and integrate them with applications or end devices.
• Connect signature and identity solutions and review trust stores and validation procedures.
• Set up monitoring for expiry and failure cases and document recovery and operating procedures.
• Integrate certificate profiles, trust chains, renewal and revocation procedures.
• Test signature and PKI integrations with valid, expired and revoked certificates.

What matters is demonstrable experience that is relevant to the role. It may come from appropriate vocational training, a degree, professional practice or a well-founded career change. We will align the specific level of responsibility with your knowledge and experience.

• Understanding of X.509 certificates, TLS and fundamental PKI processes.
• Experience with system or application integration and controlled access management.
• Careful work on security-critical configurations and clear documentation.

This knowledge is helpful, but you do not need to have all of it at once. In your application, describe where you have already gained practical experience and which areas you would like to explore in greater depth.

• Experience with HSM-backed PKIs, signature platforms or certificate automation.
• Knowledge of federated identities or trust-service integrations.

You make trust relationships and certificate processes manageable. Expiring certificates, invalid trust chains and recovery cases are treated as real operational risks and safeguarded in a verifiable way.

This role can be based in Cologne or performed remotely. We will agree the specific form of collaboration, project requirements and any necessary customer appointments before you start.

This role is offered as permanent employment on a full-time or part-time basis. We will agree the responsibilities, working hours, start date and compensation to suit the role and your level of experience.

Show us in your application which experience or interests you bring to this role. A CV and relevant project examples, certificates or work samples will help us assess your professional background. Please do not send confidential customer data, credentials or protected source code.

Tell us your preferred working model, your possible start date and whether you would like to work full-time or part-time.

If you have questions about the role, contact our recruitment team at hr@otoko.com. Inclusion in the applicant pool is voluntary and takes place only with separate consent; it is not a prerequisite for reviewing your application.