PKI and Key Management Architect

• →Design the certificate hierarchy and trust arrangements for hybrid and pure PQC modes.
• →Design certificate chains from root to end entity, including hybrid or composite options, parallel operation of classical and PQC chains, and PQC-signed revocation through both CRL and OCSP.
• →Assess the operational and engineering effects of post-quantum certificates and keys, such as larger certificate and message sizes.

• →Demonstrate issuance, renewal and revocation across representative pilot services.
• →Document the key lifecycle: generation, storage, backup, rotation periods and destruction.

• Integrate the PKI with HSM and key management capabilities through documented, reusable interfaces.
• Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is an approved product for NATO use (listed in the NATO Information Assurance Product Catalogue or approved by a NATO nation’s national authority).
• Assess the entropy sources used for key generation against NIST SP 800-90B or an equivalent evaluation such as BSI AIS 31.
• Protect private keys through their lifecycle, demonstrate the controls work, and zeroize key material at the end of the pilot.

• Bachelor’s degree in a computer-related field.
• At least five years of experience in PKI, key management or security engineering.
• Experience designing or operating an enterprise PKI, including certificate authority hierarchies and revocation through CRL and OCSP.
• Experience integrating a PKI or key management system with HSMs.
• Working knowledge of PQC signature algorithms (ML-DSA and SLH-DSA) and hybrid or composite certificates.

• U.S. citizenship and an active U.S. Secret clearance or higher at the time of hire.
• Ability to receive a NATO SECRET clearance briefing, arranged by Devis’s Facility Security Officer, before the estimated start of work on 4 January 2027. Unescorted access to NATO sites requires it.
• Disclosure of every citizenship you hold. You must be a citizen of a NATO member nation; if you also hold citizenship of a non-NATO nation, it must be declared.
• A valid passport with no travel restrictions.

• Ability to document key lifecycle procedures and integration interfaces that another team can operate.

• Ability to work with NCIA engineers in The Hague and with the pilot’s test team on measured results.

• Experience with FIPS 140-3 validated HSMs and reading CMVP security policies.
• Experience assessing entropy sources under NIST SP 800-90B or BSI AIS 31.
• Experience running parallel classical and PQC certificate chains.
• Experience on NATO or allied government PKI programs.

• The PKI shows the full credential lifecycle, including revocation, across representative pilot services.
• The key lifecycle is documented end to end and the private key controls are demonstrated.
• PKI and key management results are part of the crypto-agile reference architecture: baseline at the third milestone, validated at the sixth.
• Key material is zeroized at the end of the pilot, with each action recorded.

• Work model: hybrid. Off-site work is performed at Devis’s headquarters at 2107 Wilson Boulevard, Arlington, Virginia.
• Travel: about 40 percent of your time on-site at NCIA’s hub laboratory in The Hague. The contract plans on-site work across the whole team at about 40 percent, concentrated between the second and fifth milestones (roughly May through early November 2027, assuming a 4 January 2027 start).

Devis is an AA/EOE/M/F/Disabled/VET Employer committed to providing equal employment opportunity without regard to an individual’s race, color, religion, age, gender, sexual orientation, veteran status, national origin or disability.