PKI & Hardware Security Module (HSM) Engineer

Nationwide IT Services•Fairfax, VA

2d•$130,000 - $180,000•Onsite

About The Position

Nationwide IT Services (NIS) is seeking an experienced Public Key Infrastructure (PKI) and Hardware Security Module (HSM) Engineer to support the NATO Post-Quantum Cryptography (PQC) Pilot Project. This hands-on role will modernize enterprise PKI, implement hybrid classical and post-quantum certificates, integrate HSMs for secure key management, and support a disciplined cryptographic migration. It will also help develop repeatable capabilities in PKI modernization, crypto-agility, and PQC implementation. The position is full-time and permanent, based on-site in Fairfax, Virginia, with occasional travel as required by the pilot. An active Secret clearance and U.S. person status are required. NIS is a CVE-verified Service-Disabled Veteran-Owned Small Business and an IT and management consulting company. Its mission is to deliver value-added services by leveraging technology, people, and industry best practices to implement innovative solutions through trusted employees and team members.

Requirements

Bachelor’s degree in computer science, Information Systems, Cybersecurity, Electrical Engineering, or a related field; equivalent demonstrated experience is accepted.
At least 5 years of experience engineering or operating enterprise PKI in production, including CA deployment, hierarchy management, and lifecycle automation.
Hands-on HSM administration experience, including key lifecycle, partitioning, multi-person authentication, and backup/restore.
Experience executing key ceremonies with dual-control and audit/witness requirements.
Working knowledge of ML-KEM, ML-DSA, SLH-DSA, NIST FIPS 203/204/205, and CNSA 2.0 migration timelines.
Experience with X.509, TLS/mTLS, CRL/OCSP, enterprise certificate integration, and Python and/or PowerShell.
Active U.S. Secret security clearance; U.S. person status required.
CompTIA Security+ certification at minimum.
At least one vendor HSM certification, such as Thales Luna or Entrust nShield, or documented equivalent hands-on HSM administration experience.
On-site work in Fairfax, Virginia, with occasional travel as required by the pilot.

Nice To Haves

CISSP or CISM certification.
Previous PQC pilot or hybrid-certificate implementation experience.
Experience in NATO, federal, classified, or highly regulated environments.
RMF/ATO documentation and FIPS 140-3 or Common Criteria exposure.
PKI-specific AD CS or EJBCA training; CCSP, GSEC, or GCIH certification.
Advanced education or training in cryptography or applied mathematics.
Top Secret/SCI clearance or NATO Secret eligibility.

Responsibilities

Design, deploy, and operate enterprise PKI using Microsoft AD CS, EJBCA, or equivalent systems, including CA hierarchies, certificate lifecycles, CRL/OCSP, and CP/CPS policies.
Integrate and administer HSMs such as Thales Luna or Entrust nShield, including partitioning, in-HSM key generation, backup/cloning, PED authentication, and firmware management.
Implement hybrid X.509 certificates combining classical and post-quantum cryptography (ML-DSA / ML-KEM), and evaluate hybrid versus composite approaches.
Plan and execute key ceremonies under dual-control and split-knowledge procedures; maintain scripts, witness records, and audit evidence.
Support FIPS 140-3 module use and prepare RMF/ATO security evidence.
Create phased CA and certificate cutover plans, rollback criteria, and go/no-go evidence.
Troubleshoot TLS/mTLS, code signing, S/MIME, and application authentication integrations.
Document architecture, SOPs, and configuration baselines for customer and NATO stakeholder review.
Work on-site in Fairfax, Virginia, and travel occasionally as required by the pilot.