PKI & Hardware Security Module (HSM) Engineer

Nationwide IT Services, Inc.; Fair Oaks (VA); Hybrid; USD 130,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) plan with employer match

Paid holidays

PTO (vacation/sick)

Commuter benefits

Employee assistance program (EAP)

Educational reimbursement

Pet insurance

Job summary

Nationwide IT Services, Inc. seeks an experienced PKI & HSM Engineer to modernize enterprise PKI, implement hybrid classical and post‑quantum certificates, and integrate HSMs for secure key management. The role supports a NATO PQC pilot project with a hybrid Fairfax, VA on‑site model and two remote days.

The ideal candidate has 5+ years in production PKI, HSM administration, dual‑control key ceremonies, and a U.S. Secret clearance.

Qualifications

• Bachelor's degree or equivalent in CS/IS/Cybersecurity or related field.
• 5+ years engineering/operating enterprise PKI in production.
• Hands-on HSM administration with key lifecycle management.
• Experience conducting key ceremonies with dual-control/audit requirements.
• Familiarity with ML‑KEM/ML‑DSA and NIST FIPS 203/204/205.
• Experience with X.509, TLS/mTLS, and certificate integration.
• Active U.S. Secret security clearance; U.S. person status.

Responsibilities

• Design, deploy, and operate enterprise PKI including CA hierarchies and lifecycle.
• Integrate and administer HSMs (Thales Luna, Entrust nShield) and manage in‑HSM keys.
• Implement hybrid X.509 certificates combining classical and post‑quantum crypto.
• Plan and execute key ceremonies with dual control and audit trails.
• Support RMF/ATO security evidence and FIPS 140‑3 module use.
• Create cutover plans, rollback criteria, and go/no‑go evidence.
• Troubleshoot TLS/mTLS, code signing, and S/MIME integrations.
• Document architecture, SOPs, and baselines for NATO/stakeholders.

Skills

PKI engineering

HSM administration

TLS/mTLS

Certificate management

Python/PowerShell

US Secret clearance

Audit/witness procedures

Dual-control ceremonies

Education

Bachelor's degree in CS/IS/Cybersecurity

Tools

Microsoft AD CS

EJBCA

Thales Luna

Entrust nShield

Job description

PKI & Hardware Security Module (HSM) Engineer

Clearance: Active Secret required

Place of Performance: Fairfax, VA (Hybrid) on-site 3 days per week | Full-Time, Permanent

Position Overview

Nationwide IT Services (NIS) is seeking an experienced Public Key Infrastructure (PKI)& Hardware Security Module (HSM) Engineer to support the NATO Post-Quantum Cryptography (PQC) Pilot Project. This hands‑on engineer will modernize enterprise public key infrastructure, implement hybrid classical and post‑quantum certificates, integrate HSMs for secure key management, and support a disciplined cryptographic migration. The role also helps develop repeatable capabilities in PKI modernization, crypto‑agility, and PQC implementation.

Key Responsibilities

• Design, deploy, and operate enterprise PKI using Microsoft AD CS, EJBCA, or equivalent systems, including CA hierarchies, certificate lifecycles, CRL/OCSP, and CP/CPS policies.
• Integrate and administer HSMs such as Thales Luna or Entrust nShield, including partitioning, in‑HSM key generation, backup/cloning, PED authentication, and firmware management.
• Implement hybrid X.509 certificates combining classical and post‑quantum cryptography (ML‑DSA / ML‑KEM); evaluate hybrid versus composite approaches.
• Plan and execute key ceremonies under dual‑control and split‑knowledge procedures; maintain scripts, witness records, and audit evidence.
• Support FIPS 140‑3 module use and prepare RMF/ATO security evidence.
• Create phased CA and certificate cutover plans, rollback criteria, and go/no‑go evidence.
• Troubleshoot TLS/mTLS, code signing, S/MIME, and application authentication integrations.
• Document architecture, SOPs, and configuration baselines for customer and NATO stakeholder review.

Required Qualifications

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, Electrical Engineering, or related field; equivalent demonstrated experience accepted.
• 5+ years of engineering or operating enterprise PKI in production, including CA deployment, hierarchy management, and lifecycle automation.
• Hands‑on HSM administration, including key lifecycle, partitioning, multi‑person authentication, and backup/restore.
• Experience executing key ceremonies with dual control and audit/witness requirements.
• Working knowledge of ML‑KEM, ML‑DSA, SLH‑DSA, NIST FIPS 203/204/205, and CNSA 2.0 migration timelines.
• Experience with X.509, TLS/mTLS, CRL/OCSP, enterprise certificate integration, and Python and/or PowerShell.
• Active U.S. Secret security clearance; U.S. person status required.

Required Certifications

• CompTIA Security+ at minimum (CISSP or CISM strongly preferred).
• At least one vendor HSM certification (such as Thales Luna or Entrust nShield) OR documented equivalent hands‑on HSM administration experience.

Preferred Qualifications

• Previous PQC pilot or hybrid‑certificate implementation experience.
• NATO, federal, classified, or highly regulated environment experience.
• RMF/ATO documentation and FIPS 140‑3 or Common Criteria exposure.
• PKI‑specific AD CS or EJBCA training; CCSP, GSEC, or GCIH certification.
• Advanced education or training in cryptography or applied mathematics.
• Top Secret/SCI clearance or NATO Secret eligibility.

Additional Requirements

• Work on‑site in Fairfax, Virginia, two days remote; occasional travel as required by the pilot.

About Nationwide IT Services

NIS is a CVE‑verified Service‑Disabled Veteran‑Owned Small Business and an IT and management consulting company. Our mission is to deliver value‑added services to our customers, leveraging technology, people, and industry best practices to implement innovative solutions through our trusted employees and team members.

Our benefits package includes medical, dental, and vision insurance; life and disability insurance; a 401(k) plan with employer match; paid holidays; PTO (sick/vacation); commuter benefits; an employee assistance program (EAP); educational reimbursement; and pet insurance.

Salary range $130,000 to $180,000 annually
The salary range is a general guideline. We consider several factors when determining base salary offers, including the position’s scope and responsibilities, the candidate’s experience, education, and skills, and current market conditions.