PKI and Key Management Architect

Development InfoStructure; Arlington (VA); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Devis is seeking a PKI and Key Management Architect to design and build a quantum-safe public-key infrastructure for a NATO-led pilot, focusing on PQC modes, certificate chains, and secure credential lifecycles.

This role requires hybrid work from Arlington, VA with travel to The Hague. The ideal candidate has 5+ years in PKI, HSM integration, and knowledge of PQC algorithms and NIST SP 800-90B; the role demonstrates end-to-end key management and zeroization of key material.

Qualifications

• Bachelor’s degree in a computer-related field.
• 5+ years of PKI, key management or security engineering.
• Experience designing or operating an enterprise PKI, including certificate authority hierarchies and revocation through CRL and OCSP.
• Experience integrating a PKI or key management system with HSMs.
• Working knowledge of PQC signature algorithms (ML-DSA and SLH-DSA) and hybrid or composite certificates.

Responsibilities

• Design the certificate hierarchy and trust arrangements for hybrid and pure PQC modes.
• Design certificate chains from root to end entity, including hybrid or composite options, parallel operation of classical and PQC chains, and PQC-signed revocation through both CRL and OCSP.
• Assess the operational and engineering effects of post-quantum certificates and keys, such as larger certificate and message sizes.
• Demonstrate issuance, renewal and revocation across representative pilot services.
• Document the key lifecycle: generation, storage, backup, rotation periods and destruction.
• Integrate the PKI with HSM and key management capabilities through documented, reusable interfaces.
• Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is an approved product for NATO use.
• Assess the entropy sources used for key generation against NIST SP 800-90B.
• Protect private keys through their lifecycle, demonstrate the controls work, and zeroize key material at the end of the pilot.

Skills

PKI design

Security engineering

Documentation

Collaboration

Education

Bachelor’s degree in a computer-related field

Tools

HSM integration

NIST SP 800-90B

Job description

Join Our Team

NATO is testing how to move its communication and information systems from today’s public-key cryptography to algorithms that hold up against attack by quantum computers. Headquarters Supreme Allied Commander Transformation (HQ SACT) is sponsoring a 12-month pilot across three NATO laboratories in Mons, Brussels and The Hague, with the NATO Communications and Information Agency (NCIA) as technical authority. The pilot includes a live demonstration for NATO VIPs by the end of June 2027 and closes in December 2027 with a migration roadmap NATO can act on. Devis is competing to support this work. As PKI and Key Management Architect, you will design and build the pilot’s quantum-safe public-key infrastructure and the key management and hardware security behind it.

The Role

This is a contingent-upon-award PKI and Key Management Architect role. You will design, build and demonstrate a quantum-safe public-key infrastructure that supports hybrid and pure post-quantum cryptography (PQC) modes, then show the full credential lifecycle (issuance, renewal and revocation) across the pilot’s services. You will integrate the PKI with hardware security modules (HSMs) and key management through documented, reusable interfaces, protect private keys throughout their lifecycle, and assess the entropy sources used for key generation. Most of this work centers on NCIA’s hub laboratory in The Hague, which hosts the pilot’s PKI and key management, and you will work closely with the Technical Lead and the test team. Experience with specific certificate authority and HSM products helps, but the core of the job is designing a PQC certificate chain and key lifecycle that hold up under measurement.

What You’ll Do

Design the Quantum-Safe PKI

• Design the certificate hierarchy and trust arrangements for hybrid and pure PQC modes.
• Design certificate chains from root to end entity, including hybrid or composite options, parallel operation of classical and PQC chains, and PQC-signed revocation through both CRL and OCSP.
• Assess the operational and engineering effects of post-quantum certificates and keys, such as larger certificate and message sizes.

Run the Credential Lifecycle

• Demonstrate issuance, renewal and revocation across representative pilot services.
• Document the key lifecycle: generation, storage, backup, rotation periods and destruction.

Integrate HSMs, Key Management and Entropy

• Integrate the PKI with HSM and key management capabilities through documented, reusable interfaces.
• Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is an approved product for NATO use (listed in the NATO Information Assurance Product Catalogue or approved by a NATO nation’s national authority).
• Assess the entropy sources used for key generation against NIST SP 800-90B or an equivalent evaluation such as BSI AIS 31.
• Protect private keys through their lifecycle, demonstrate the controls work, and zeroize key material at the end of the pilot.

Education and Experience

• Bachelor’s degree in a computer-related field.
• At least five years of experience in PKI, key management or security engineering.
• Experience designing or operating an enterprise PKI, including certificate authority hierarchies and revocation through CRL and OCSP.
• Experience integrating a PKI or key management system with HSMs.
• Working knowledge of PQC signature algorithms (ML-DSA and SLH-DSA) and hybrid or composite certificates.

Security Clearance

• U.S. citizenship and an active U.S. Secret clearance or higher at the time of hire.
• Ability to receive a NATO SECRET clearance briefing, arranged by Devis’s Facility Security Officer, before the estimated start of work on 4 January 2027. Unescorted access to NATO sites requires it.
• Disclosure of every citizenship you hold. You must be a citizen of a NATO member nation; if you also hold citizenship of a non-NATO nation, it must be declared.
• A valid passport with no travel restrictions.

Technical Skills

• Ability to document key lifecycle procedures and integration interfaces that another team can operate.

Communication and Collaboration

• Ability to work with NCIA engineers in The Hague and with the pilot’s test team on measured results.

Nice to Have

• Experience with FIPS 140-3 validated HSMs and reading CMVP security policies.
• Experience assessing entropy sources under NIST SP 800-90B or BSI AIS 31.
• Experience running parallel classical and PQC certificate chains.
• Experience on NATO or allied government PKI programs.

Performance Expectations

• The PKI shows the full credential lifecycle, including revocation, across representative pilot services.
• The key lifecycle is documented end to end and the private key controls are demonstrated.
• PKI and key management results are part of the crypto-agile reference architecture: baseline at the third milestone, validated at the sixth.
• Key material is zeroized at the end of the pilot, with each action recorded.

Special Requirements

• Work model: hybrid. Off-site work is performed at Devis’s headquarters at 2107 Wilson Boulevard, Arlington, Virginia.
• Travel: about 40 percent of your time on-site at NCIA’s hub laboratory in The Hague. The contract plans on-site work across the whole team at about 40 percent, concentrated between the second and fifth milestones (roughly May through early November 2027, assuming a 4 January 2027 start).

Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.