PKI and Key Management Architect

NATO is testing how to move its communication and information systems from today’s public-key cryptography to algorithms that hold up against attack by quantum computers. Headquarters Supreme Allied Commander Transformation (HQ SACT) is sponsoring a 12-month pilot across three NATO laboratories in Mons, Brussels and The Hague, with the NATO Communications and Information Agency (NCIA) as technical authority. The pilot includes a live demonstration for NATO VIPs by the end of June 2027 and closes in December 2027 with a migration roadmap NATO can act on.

Devis is competing to support this work. As PKI and Key Management Architect, you will design and build the pilot’s quantum-safe public-key infrastructure and the key management and hardware security behind it.

This is a contingent-upon-award PKI and Key Management Architect role. You will design, build and demonstrate a quantum-safe public-key infrastructure that supports hybrid and pure post-quantum cryptography (PQC) modes, then show the full credential lifecycle (issuance, renewal and revocation) across the pilot’s services. You will integrate the PKI with hardware security modules (HSMs) and key management through documented, reusable interfaces, protect private keys throughout their lifecycle, and assess the entropy sources used for key generation.

Most of this work centers on NCIA’s hub laboratory in The Hague, which hosts the pilot’s PKI and key management, and you will work closely with the Technical Lead and the test team. Experience with specific certificate authority and HSM products helps, but the core of the job is designing a PQC certificate chain and key lifecycle that hold up under measurement.

• Design the certificate hierarchy and trust arrangements for hybrid and pure PQC modes.
• Design certificate chains from root to end entity, including hybrid or composite options, parallel operation of classical and PQC chains, and PQC-signed revocation through both CRL and OCSP.
• Assess the operational and engineering effects of post-quantum certificates and keys, such as larger certificate and message sizes.

• Demonstrate issuance, renewal and revocation across representative pilot services.
• Document the key lifecycle: generation, storage, backup, rotation periods and destruction.

• Integrate the PKI with HSM and key management capabilities through documented, reusable interfaces.
• Help select an HSM whose PQC algorithms are covered by FIPS 140-3 validation and that is an approved product for NATO use (listed in the NATO Information Assurance Product Catalogue or approved by a NATO nation’s national authority).
• Assess the entropy sources used for key generation against NIST SP 800-90B or an equivalent evaluation such as BSI AIS 31.
• Protect private keys through their lifecycle, demonstrate the controls work, and zeroize key material at the end of the pilot.

• Bachelor’s degree in a computer-related field.
• At least five years of experience in PKI, key management or security engineering.
• Experience designing or operating an enterprise PKI, including certificate authority hierarchies and revocation through CRL and OCSP.
• Experience integrating a PKI or key management system with HSMs.
• Working knowledge of PQC signature algorithms (ML-DSA and SLH-DSA) and hybrid or composite certificates.

• U.S. citizenship and an active U.S. Secret clearance or higher at the time of hire.
• Ability to receive a NATO SECRET clearance briefing, arranged by Devis’s Facility Security Officer, before the estimated start of work on 4 January 2027. Unescorted access to NATO sites requires it.
• Disclosure of every…