Senior Security Engineer - Post-Quantum Cryptography (PQC)

UNIZON Taskforce Technology; Suitland (MD); Hybrid; USD 120,000 - 180,000; Full time

Job summary

UNIZON Taskforce Technology in Suitland, MD seeks a Senior Security Engineer focused on network security assessments and PQC readiness. You will evaluate enterprise network infrastructure, conduct independent security assessments across on-premises and AWS/hybrid environments, and document findings with evidence-backed recommendations.

The role emphasizes cryptographic usage discovery, PKI dependencies, and migration planning to NIST PQC standards, with coordination across government leads and a

Qualifications

• 12+ years of IT security or enterprise network engineering experience, including at least five years of hands‑on network security engineering or assessment.
• Strong routing, switching, and network‑protocol fundamentals, with practical expertise in enterprise firewalls, VPNs, segmentation, and secure connectivity across on‑premises and AWS/hybrid environments.
• Demonstrated working knowledge of applied cryptography in networking: TLS 1.2/1.3, IPsec/IKEv2, SSH, PKI and certificate lifecycle, key management, and FIPS‑validated cryptographic modules.
• Familiarity with the NIST PQC standards (FIPS 203, 204, and 205) and the Federal PQC migration landscape, including NSM‑10, OMB M‑23‑02, NIST transition guidance (NIST IR 8547), and applicable Executive Order requirements.
• Experience assessing network security against Federal frameworks and standards such as NIST SP 800‑53 (e.g., SC‑8, SC‑12, SC‑13), SP 800‑52, SP 800‑77, and DISA STIGs or CIS Benchmarks.
• Ability to analyze device configurations, packet captures, and scan output (e.g., Wireshark, Nmap, testssl.sh/sslscan) to verify cryptographic and security settings.
• Strong technical writing and customer communication skills.

Responsibilities

• Plan and conduct security assessments of enterprise network architecture and infrastructure—routers, switches, firewalls, VPN concentrators, load balancers/ADCs, wireless, NAC, and AWS cloud networking against Federal security baselines and configuration standards.
• Evaluate the effectiveness of segmentation, secure connectivity, Zero Trust controls, intrusion detection/prevention, and security monitoring, and identify control gaps.
• Reconstruct and validate an incompletely documented As-Is network and security environment using configuration reviews, traffic analysis, scan data, and stakeholder interviews; substantiate every finding with technical evidence.
• Discover and inventory cryptographic usage across network technologies, including TLS (with termination and offload points), IPsec/IKEv2, SSH, MACsec, 802.1X/EAP-TLS, SNMPv3, DNSSEC, RADIUS/TACACS+, and other management-plane protocols.
• Analyze cryptographic implementations—key-exchange, digital-signature, and cipher-suite selections; certificate and PKI dependencies; key management and HSM integration; and FIPS 140-2/140-3 validated modules—to identify components that rely on quantum-vulnerable public-key algorithms (RSA, Diffie-Hellman, ECDH, ECDSA).
• Assess the impact of PQC requirements on network implementations, including larger keys and signatures affecting packet size, fragmentation, MTU, and handshake latency; hardware, ASIC, and crypto-accelerator constraints; hybrid key-establishment options; and certificate-chain and protocol interoperability.
• Perform vendor and product readiness assessments to determine current PQC support by platform and firmware, vendor roadmaps for NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA), and associated hardware or software refresh dependencies.
• Develop prioritized cryptographic inventories, risk assessments (including “harvest now, decrypt later” exposure for long-lived data), cryptographic-agility recommendations, and phased migration inputs aligned with applicable Federal requirements.
• Coordinate findings and implementation planning with the Government’s designated PQC, security, identity, application, and architecture leads.
• Lead discovery workshops, produce assessment reports and briefing packages, and explain and defend findings and recommendations to Government leadership.

Skills

Routing & Switching

Firewalls & VPNs

Cryptography in networking

TLS / IPsec / SSH

FIPS validated modules

NIST SP 800-53

Technical writing

Customer communication

Tools

Wireshark

Nmap

OpenSSL

Open Quantum Safe

Job description

Title: Senior Security Engineer-Network Security Assessment & Post-Quantum Cryptography (PQC)

Location: Suitland, Maryland – Hybrid (1 day onsite and 4 days remote)

Employment: Full Time/Direct Hire

Position Summary:

We are seeking a Senior Security Engineer with a network focus to perform independent security assessments of a Federal Government enterprise network spanning on-premises and AWS/hybrid environments. The role centers on evaluating how network infrastructure and services implement security controls and cryptography, and on assessing the enterprise’s readiness to migrate to post-quantum cryptography (PQC). The engineer will identify where cryptography is used across network technologies, determine how PQC requirements affect those implementations, and produce evidence-backed findings and recommendations. This is an assessment and security-engineering analysis role—not primarily operational support, vulnerability remediation, or firewall administration.

Key Responsibilities:

• Plan and conduct security assessments of enterprise network architecture and infrastructure—routers, switches, firewalls, VPN concentrators, load balancers/ADCs, wireless, NAC, and AWS cloud networking (VPC, Transit Gateway, Direct Connect)—against Federal security baselines and configuration standards.
• Evaluate the effectiveness of segmentation, secure connectivity, Zero Trust controls, intrusion detection/prevention, and security monitoring, and identify control gaps.
• Reconstruct and validate an incompletely documented As-Is network and security environment using configuration reviews, traffic analysis, scan data, and stakeholder interviews; substantiate every finding with technical evidence.
• Discover and inventory cryptographic usage across network technologies, including TLS (with termination and offload points), IPsec/IKEv2, SSH, MACsec, 802.1X/EAP-TLS, SNMPv3, DNSSEC, RADIUS/TACACS+, and other management-plane protocols.
• Analyze cryptographic implementations—key-exchange, digital-signature, and cipher-suite selections; certificate and PKI dependencies; key management and HSM integration; and FIPS 140-2/140-3 validated modules—to identify components that rely on quantum-vulnerable public-key algorithms (RSA, Diffie-Hellman, ECDH, ECDSA).
• Assess the impact of PQC requirements on network implementations, including larger keys and signatures affecting packet size, fragmentation, MTU, and handshake latency; hardware, ASIC, and crypto-accelerator constraints; hybrid key-establishment options; and certificate-chain and protocol interoperability.
• Perform vendor and product readiness assessments to determine current PQC support by platform and firmware, vendor roadmaps for NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA), and associated hardware or software refresh dependencies.
• Develop prioritized cryptographic inventories, risk assessments (including “harvest now, decrypt later” exposure for long-lived data), cryptographic-agility recommendations, and phased migration inputs aligned with applicable Federal requirements.
• Coordinate findings and implementation planning with the Government’s designated PQC, security, identity, application, and architecture leads.
• Lead discovery workshops, produce assessment reports and briefing packages, and explain and defend findings and recommendations to Government leadership.

Required Qualifications:

• 12+ years of IT security or enterprise network engineering experience, including at least five years of hands‑on network security engineering or assessment.
• Strong routing, switching, and network‑protocol fundamentals, with practical expertise in enterprise firewalls, VPNs, segmentation, and secure connectivity across on‑premises and AWS/hybrid environments.
• Demonstrated working knowledge of applied cryptography in networking: TLS 1.2/1.3, IPsec/IKEv2, SSH, PKI and certificate lifecycle, key management, and FIPS‑validated cryptographic modules.
• Familiarity with the NIST PQC standards (FIPS 203, 204, and 205) and the Federal PQC migration landscape, including NSM‑10, OMB M‑23‑02, NIST transition guidance (NIST IR 8547), and applicable Executive Order requirements.
• Experience assessing network security against Federal frameworks and standards such as NIST SP 800‑53 (e.g., SC‑8, SC‑12, SC‑13), SP 800‑52, SP 800‑77, and DISA STIGs or CIS Benchmarks.
• Ability to analyze device configurations, packet captures, and scan output (e.g., Wireshark, Nmap, testssl.sh/sslscan) to verify cryptographic and security settings.
• Strong technical writing and customer communication skills.

Desired Qualifications:

• Experience supporting Federal Government enterprise networks, preferably at a civilian agency.
• Experience with cryptographic discovery and inventory tools or automated cryptographic asset management.
• Hands‑on lab testing of PQC or hybrid key exchange (e.g., OpenSSL 3.5 or Open Quantum Safe libraries; hybrid TLS or IKEv2 with ML-KEM).
• Depth in a complementary specialty: network access control and identity integration, application-delivery security (e.g., F5/WAF), or HSM and enterprise key management.
• Relevant certifications such as CISSP, CCNP/CCIE Security, GIAC (e.g., GCIA), or CompTIA SecurityX (formerly CASP+). Certifications do not replace demonstrated assessment experience.