PKI and Key Management Architect

Development InfoStructure•Arlington, VA

3d•$175,000 - $209,000•Hybrid

About The Position

This is a contingent-upon-award role supporting a 12-month NATO pilot to transition communication and information systems from current public-key cryptography to quantum-resistant algorithms. Sponsored by Headquarters Supreme Allied Commander Transformation (HQ SACT), with the NATO Communications and Information Agency (NCIA) as technical authority, the pilot spans laboratories in Mons, Brussels and The Hague. It includes a live demonstration for NATO VIPs by the end of June 2027 and concludes in December 2027 with an actionable migration roadmap. The architect will design, build and demonstrate a quantum-safe public-key infrastructure (PKI) supporting hybrid and pure post-quantum cryptography (PQC) modes. The work includes demonstrating credential issuance, renewal and revocation across pilot services; integrating PKI with hardware security modules (HSMs) and key management through documented, reusable interfaces; protecting private keys throughout their lifecycle; and assessing key-generation entropy sources. The role is centered primarily at NCIA’s hub laboratory in The Hague and involves close collaboration with the Technical Lead, NCIA engineers and the test team. The work model is hybrid. Off-site work is performed at Devis’s headquarters in Arlington, Virginia. Approximately 40 percent of the role is expected to involve on-site work at NCIA’s hub laboratory in The Hague, with on-site work concentrated roughly between May and early November 2027, assuming a January 4, 2027 start. The role requires U.S. citizenship and an active U.S. Secret clearance or higher at hire, as well as the ability to receive a NATO SECRET clearance briefing before the estimated start of work.

Requirements

Bachelor’s degree in a computer-related field.
At least five years of experience in PKI, key management or security engineering.
Experience designing or operating an enterprise PKI, including certificate authority hierarchies and CRL and OCSP revocation.
Experience integrating a PKI or key management system with HSMs.
Working knowledge of PQC signature algorithms ML-DSA and SLH-DSA, and hybrid or composite certificates.
Ability to document key lifecycle procedures and integration interfaces so another team can operate them.
Ability to collaborate with NCIA engineers in The Hague and the pilot’s test team on measured results.
U.S. citizenship and an active U.S. Secret clearance or higher at the time of hire.
Ability to receive a NATO SECRET clearance briefing before the estimated start of work on January 4, 2027.
Must be a citizen of a NATO member nation and disclose every citizenship held; any citizenship of a non-NATO nation must be declared.
Valid passport with no travel restrictions.

Nice To Haves

Experience with FIPS 140-3 validated HSMs and reading CMVP security policies.
Experience assessing entropy sources under NIST SP 800-90B or BSI AIS 31.
Experience running parallel classical and PQC certificate chains.
Experience on NATO or allied government PKI programs.
Experience with specific certificate authority and HSM products.

Responsibilities

Design certificate hierarchies and trust arrangements for hybrid and pure PQC modes.
Design certificate chains from root to end entity, including hybrid or composite options, parallel classical and PQC chains, and PQC-signed revocation using CRL and OCSP.
Assess operational and engineering effects of post-quantum certificates and keys, including larger certificate and message sizes.
Demonstrate credential issuance, renewal and revocation across representative pilot services.
Document key lifecycle procedures, including generation, storage, backup, rotation periods and destruction.
Integrate the PKI with HSM and key management capabilities using documented, reusable interfaces.
Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is approved for NATO use through the NATO Information Assurance Product Catalogue or a NATO nation’s national authority.
Assess key-generation entropy sources against NIST SP 800-90B or an equivalent evaluation such as BSI AIS 31.
Protect private keys throughout their lifecycle, demonstrate the controls, and zeroize key material at the end of the pilot.
Record each key-zeroization action.
Work with NCIA engineers in The Hague and the pilot test team on measured results.
Contribute PKI and key management results to the crypto-agile reference architecture, with a baseline at the third milestone and validation at the sixth.