PKI & HSM Engineer — Hybrid, Secret-Cleared

Nationwide IT Services, Inc.; Fair Oaks (VA); Hybrid; USD 130,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) plan with employer match

Paid holidays

PTO (vacation/sick)

Commuter benefits

Employee assistance program (EAP)

Educational reimbursement

Pet insurance

Job summary

Nationwide IT Services, Inc. seeks an experienced PKI & HSM Engineer to modernize enterprise PKI, implement hybrid classical and post‑quantum certificates, and integrate HSMs for secure key management. The role supports a NATO PQC pilot project with a hybrid Fairfax, VA on‑site model and two remote days.

The ideal candidate has 5+ years in production PKI, HSM administration, dual‑control key ceremonies, and a U.S. Secret clearance.

Qualifications

• Bachelor's degree or equivalent in CS/IS/Cybersecurity or related field.
• 5+ years engineering/operating enterprise PKI in production.
• Hands-on HSM administration with key lifecycle management.
• Experience conducting key ceremonies with dual-control/audit requirements.
• Familiarity with ML‑KEM/ML‑DSA and NIST FIPS 203/204/205.
• Experience with X.509, TLS/mTLS, and certificate integration.
• Active U.S. Secret security clearance; U.S. person status.

Responsibilities

• Design, deploy, and operate enterprise PKI including CA hierarchies and lifecycle.
• Integrate and administer HSMs (Thales Luna, Entrust nShield) and manage in‑HSM keys.
• Implement hybrid X.509 certificates combining classical and post‑quantum crypto.
• Plan and execute key ceremonies with dual control and audit trails.
• Support RMF/ATO security evidence and FIPS 140‑3 module use.
• Create cutover plans, rollback criteria, and go/no‑go evidence.
• Troubleshoot TLS/mTLS, code signing, and S/MIME integrations.
• Document architecture, SOPs, and baselines for NATO/stakeholders.

Skills

PKI engineering

HSM administration

TLS/mTLS

Certificate management

Python/PowerShell

US Secret clearance

Audit/witness procedures

Dual-control ceremonies

Education

Bachelor's degree in CS/IS/Cybersecurity

Tools

Microsoft AD CS

EJBCA

Thales Luna

Entrust nShield

Job description

Nationwide IT Services, Inc. seeks an experienced PKI & HSM Engineer to modernize enterprise PKI, implement hybrid classical and post‑quantum certificates, and integrate HSMs for secure key management. The role supports a NATO PQC pilot project with a hybrid Fairfax, VA on‑site model and two remote days.

The ideal candidate has 5+ years in production PKI, HSM administration, dual‑control key ceremonies, and a U.S. Secret clearance.