PKI & Hardware Security Module (HSM) Engineer

PKI & Hardware Security Module (HSM) EngineerClearance: Active Secret required
Place of Performance: Fairfax, VA (Hybrid) on-site 3 days per week | Full-Time, Permanent

Position Overview

Nationwide IT Services (NIS) is seeking an experienced Public Key Infrastructure (PKI)& Hardware Security Module (HSM) Engineer to support the NATO Post-Quantum Cryptography (PQC) Pilot Project. This hands-on engineer will modernize enterprise public key infrastructure, implement hybrid classical and post-quantum certificates, integrate HSMs for secure key management, and support a disciplined cryptographic migration. The role also helps develop repeatable capabilities in PKI modernization, crypto-agility, and PQC implementation.

Key Responsibilities

• Design, deploy, and operate enterprise PKI using Microsoft AD CS, EJBCA, or equivalent systems, including CA hierarchies, certificate lifecycles, CRL/OCSP, and CP/CPS policies.
• Integrate and administer HSMs such as Thales Luna or Entrust nShield, including partitioning, in-HSM key generation, backup/cloning, PED authentication, and firmware management.
• Implement hybrid X.509 certificates combining classical and post-quantum cryptography (ML-DSA / ML-KEM); evaluate hybrid versus composite approaches.
• Plan and execute key ceremonies under dual-control and split-knowledge procedures; maintain scripts, witness records, and audit evidence.
• Support FIPS 140-3 module use and prepare RMF/ATO security evidence.
• Create phased CA and certificate cutover plans, rollback criteria, and go/no-go evidence.
• Troubleshoot TLS/mTLS, code signing, S/MIME, and application authentication integrations.
• Document architecture, SOPs, and configuration baselines for customer and NATO stakeholder review.

Required Qualifications

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, Electrical Engineering, or related field; equivalent demonstrated experience accepted.
• 5+ years of engineering or operating enterprise PKI in production, including CA deployment, hierarchy management, and lifecycle automation.
• Hands-on HSM administration, including key lifecycle, partitioning, multi-person authentication, and backup/restore.
• Experience executing key ceremonies with dual control and audit/witness requirements.
• Working knowledge of ML-KEM, ML-DSA, SLH-DSA, NIST FIPS 203/204/205, and CNSA 2.0 migration timelines.
• Experience with X.509, TLS/mTLS, CRL/OCSP, enterprise certificate integration, and Python and/or PowerShell.
• Active U.S. Secret security clearance; U.S. person status required.

Required Certifications

• CompTIA Security+ at minimum (CISSP or CISM strongly preferred).