The Role
Design and demonstrate a quantum-safe PKI supporting hybrid and pure PQC certificate chains, credential issuance, renewal, and revocation. Integrate PKI and key management with HSMs, assess entropy sources, document end-to-end key lifecycle controls, protect and zeroize private keys, and collaborate with NCIA engineers and test teams. The role is hybrid, centered in The Hague, with approximately 40% onsite travel and requires an active U.S. Secret clearance or higher.
Summary Generated by Built In
Join Our TeamNATO is testing how to move its communication and information systems from today’s public-key cryptography to algorithms that hold up against attack by quantum computers. Headquarters Supreme Allied Commander Transformation (HQ SACT) is sponsoring a 12-month pilot across three NATO laboratories in Mons, Brussels and The Hague, with the NATO Communications and Information Agency (NCIA) as technical authority. The pilot includes a live demonstration for NATO VIPs by the end of June 2027 and closes in December 2027 with a migration roadmap NATO can act on. Devis is competing to support this work. As PKI and Key Management Architect, you will design and build the pilot’s quantum-safe public-key infrastructure and the key management and hardware security behind it.The RoleThis is a contingent-upon-award PKI and Key Management Architect role. You will design, build and demonstrate a quantum-safe public-key infrastructure that supports hybrid and pure post-quantum cryptography (PQC) modes, then show the full credential lifecycle (issuance, renewal and revocation) across the pilot’s services. You will integrate the PKI with hardware security modules (HSMs) and key management through documented, reusable interfaces, protect private keys throughout their lifecycle, and assess the entropy sources used for key generation. Most of this work centers on NCIA’s hub laboratory in The Hague, which hosts the pilot’s PKI and key management, and you will work closely with the Technical Lead and the test team. Experience with specific certificate authority and HSM products helps, but the core of the job is designing a PQC certificate chain and key lifecycle that hold up under measurement.What You’ll Do
Design the Quantum-Safe PKI
- Design the certificate hierarchy and trust arrangements for hybrid and pure PQC modes.
- Design certificate chains from root to end entity, including hybrid or composite options, parallel operation of classical and PQC chains, and PQC-signed revocation through both CRL and OCSP.
- Assess the operational and engineering effects of post-quantum certificates and keys, such as larger certificate and message sizes.
Run the Credential Lifecycle
- Demonstrate issuance, renewal and revocation across representative pilot services.
- Document the key lifecycle: generation, storage, backup, rotation periods and destruction.
- Integrate the PKI with HSM and key management capabilities through documented, reusable interfaces.
- Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is an approved product for NATO use (listed in the NATO Information Assurance Product Catalogue or approved by a NATO nation’s national authority).
- Assess the entropy sources used for key generation against NIST SP 800-90B or an equivalent evaluation such as BSI AIS 31.
- Protect private keys through their lifecycle, demonstrate the controls work, and zeroize key material at the end of the pilot.
- Bachelor’s degree in a computer-related field.
- At least five years of experience in PKI, key management or security engineering.
- Experience designing or operating an enterprise PKI, including certificate authority hierarchies and revocation through CRL and OCSP.
- Experience integrating a PKI or key management system with HSMs.
- Working knowledge of PQC signature algorithms (ML-DSA and SLH-DSA) and hybrid or composite certificates.
- U.S. citizenship and an active U.S. Secret clearance or higher at the time of hire.
- Ability to receive a NATO SECRET clearance briefing, arranged by Devis’s Facility Security Officer, before the estimated start of work on 4 January 2027. Unescorted access to NATO sites requires it.
- Disclosure of every citizenship you hold. You must be a citizen of a NATO member nation; if you also hold citizenship of a non-NATO nation, it must be declared.
- A valid passport with no travel restrictions.
- Ability to document key lifecycle procedures and integration interfaces that another team can operate.
- Ability to work with NCIA engineers in The Hague and with the pilot’s test team on measured results.
- Experience with FIPS 140-3 validated HSMs and reading CMVP security policies.
- Experience assessing entropy sources under NIST SP 800-90B or BSI AIS 31.
- Experience running parallel classical and PQC certificate chains.
- Experience on NATO or allied government PKI programs.
- The PKI shows the full credential lifecycle, including revocation, across representative pilot services.
- The key lifecycle is documented end to end and the private key controls are demonstrated.
- PKI and key management results are part of the crypto-agile reference architecture: baseline at the third milestone, validated at the sixth.
- Key material is zeroized at the end of the pilot, with each action recorded.
- Work model: hybrid. Off-site work is performed at Devis’s headquarters at 2107 Wilson Boulevard, Arlington, Virginia.
- Travel: about 40 percent of your time on-site at NCIA’s hub laboratory in The Hague. The contract plans on-site work across the whole team at about 40 percent, concentrated between the second and fifth milestones (roughly May through early November 2027, assuming a 4 January 2027 start).
Skills Required
- Bachelor's degree in a computer-related field
- At least five years of experience in PKI, key management, or security engineering
- Experience designing or operating an enterprise PKI with certificate authority hierarchies
- Experience implementing certificate revocation through CRL and OCSP
- Experience integrating PKI or key management systems with HSMs
- Working knowledge of ML-DSA and SLH-DSA signature algorithms
- Working knowledge of hybrid or composite certificates
- U.S. citizenship
- Active U.S. Secret clearance or higher at the time of hire
- Ability to receive a NATO SECRET clearance briefing
- Citizenship in a NATO member nation
- Disclosure of every citizenship held
- Valid passport with no travel restrictions
- Ability to document key lifecycle procedures and integration interfaces
- Ability to work with NCIA engineers in The Hague and the pilot test team
- Experience with FIPS 140-3 validated HSMs and CMVP security policies
- Experience assessing entropy sources under NIST SP 800-90B or BSI AIS 31
- Experience operating parallel classical and PQC certificate chains
- Experience with NATO or allied government PKI programs
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Development InfoStructure, LLC. (Devis) is a leading provider of IT consulting services and solutions to the Federal, State and Local Governments, as well as the international development community. Devis helps maximize your return on IT investment by: 1) working with the best-adapted programming languages, databases and other solutions for your specific project; 2) actively supporting the open source community; and 3) using and promoting open technology standards. Devis has extensive experience with world wide software deployments and support. Our systems operate in more than 80 countries, and in every federal department. Devis-built systems involve the full vertical spectrum of users from data entry clerks to Governement managers to Congress
