Enter a job title or keyword
PKI & Hardware Security Module (HSM) Engineer
Job Location:
Job Location:
Fairfax, VA - USA
Yearly Salary:
USD 130000 - 180000
Yearly Salary:
Posted:
17 October 2026 (11 hours ago)
Posted:
Application Deadline:
14 January 2027
Application Deadline:
Vacancies:
1 Vacancy
Vacancies:
Job Summary
PKI & Hardware Security Module (HSM) Engineer
Clearance: Active Secret required
Place of Performance: Fairfax VA (Hybrid) on-site 3 days per week Full-Time Permanent
Position Overview
Nationwide IT Services (NIS) is seeking an experienced Public Key Infrastructure (PKI)& Hardware Security Module (HSM) Engineer to support the NATO Post-Quantum Cryptography (PQC) Pilot Project. This hands-on engineer will modernize enterprise public key infrastructure implement hybrid classical and post-quantum certificates integrate HSMs for secure key management and support a disciplined cryptographic migration. The role also helps develop repeatable capabilities in PKI modernization crypto-agility and PQC implementation.
Key Responsibilities
About Nationwide IT Services
NIS is a CVE-verified Service-Disabled Veteran-Owned Small Business and an IT and management consulting company. Our mission is to deliver value-added services to our customers leveraging technology people and industry best practices to implement innovative solutions through our trusted employees and team members.
Our benefits package includes medical dental and vision insurance; life and disability insurance; a 401(k) plan with employer match; paid holidays; PTO (sick/vacation); commuter benefits; an employee assistance program (EAP); educational reimbursement; and pet insurance.
Salary range $130000 to $180000 annually
The salary range is a general guideline. We consider several factors when determining base salary offers including the positions scope and responsibilities the candidates experience education and skills and current market conditions.
Clearance: Active Secret required
Place of Performance: Fairfax VA (Hybrid) on-site 3 days per week Full-Time Permanent
Position Overview
Nationwide IT Services (NIS) is seeking an experienced Public Key Infrastructure (PKI)& Hardware Security Module (HSM) Engineer to support the NATO Post-Quantum Cryptography (PQC) Pilot Project. This hands-on engineer will modernize enterprise public key infrastructure implement hybrid classical and post-quantum certificates integrate HSMs for secure key management and support a disciplined cryptographic migration. The role also helps develop repeatable capabilities in PKI modernization crypto-agility and PQC implementation.
Key Responsibilities
- Design deploy and operate enterprise PKI using Microsoft AD CS EJBCA or equivalent systems including CA hierarchies certificate lifecycles CRL/OCSP and CP/CPS policies.
- Integrate and administer HSMs such as Thales Luna or Entrust nShield including partitioning in-HSM key generation backup/cloning PED authentication and firmware management.
- Implement hybrid X.509 certificates combining classical and post-quantum cryptography (ML-DSA / ML-KEM); evaluate hybrid versus composite approaches.
- Plan and execute key ceremonies under dual-control and split-knowledge procedures; maintain scripts witness records and audit evidence.
- Support FIPS 140-3 module use and prepare RMF/ATO security evidence.
- Create phased CA and certificate cutover plans rollback criteria and go/no-go evidence.
- Troubleshoot TLS/mTLS code signing S/MIME and application authentication integrations.
- Document architecture SOPs and configuration baselines for customer and NATO stakeholder review.
- Bachelors degree in computer science Information Systems Cybersecurity Electrical Engineering or related field; equivalent demonstrated experience accepted.
- 5 years of engineering or operating enterprise PKI in production including CA deployment hierarchy management and lifecycle automation.
- Hands-on HSM administration including key lifecycle partitioning multi-person authentication and backup/restore.
- Experience executing key ceremonies with dual control and audit/witness requirements.
- Working knowledge of ML-KEM ML-DSA SLH-DSA NIST FIPS 203/204/205 and CNSA 2.0 migration timelines.
- Experience with X.509 TLS/mTLS CRL/OCSP enterprise certificate integration and Python and/or PowerShell.
- Active U.S. Secret security clearance; U.S. person status required.
- CompTIA Security at minimum (CISSP or CISM strongly preferred).
- At least one vendor HSM certification (such as Thales Luna or Entrust nShield) OR documented equivalent hands-on HSM administration experience.
- Previous PQC pilot or hybrid-certificate implementation experience.
- NATO federal classified or highly regulated environment experience.
- RMF/ATO documentation and FIPS 140-3 or Common Criteria exposure.
- PKI-specific AD CS or EJBCA training; CCSP GSEC or GCIH certification.
- Advanced education or training in cryptography or applied mathematics.
- Top Secret/SCI clearance or NATO Secret eligibility.
- Work on-site in Fairfax Virginia two days remote; occasional travel as required by the pilot.
About Nationwide IT Services
NIS is a CVE-verified Service-Disabled Veteran-Owned Small Business and an IT and management consulting company. Our mission is to deliver value-added services to our customers leveraging technology people and industry best practices to implement innovative solutions through our trusted employees and team members.
Our benefits package includes medical dental and vision insurance; life and disability insurance; a 401(k) plan with employer match; paid holidays; PTO (sick/vacation); commuter benefits; an employee assistance program (EAP); educational reimbursement; and pet insurance.
Salary range $130000 to $180000 annually
The salary range is a general guideline. We consider several factors when determining base salary offers including the positions scope and responsibilities the candidates experience education and skills and current market conditions.
Required Experience:
Manager
