Senior Security Engineer - Post-Quantum Cryptography (PQC)

• 12+ years of IT security or enterprise network engineering experience, including at least five years of hands-on network security engineering or assessment. \n

• Strong routing, switching, and network-protocol fundamentals, with practical expertise in enterprise firewalls, VPNs, segmentation, and secure connectivity across on-premises and AWS/hybrid environments. \n

• Demonstrated working knowledge of applied cryptography in networking: TLS 1.2/1.3, IPsec/IKEv2, SSH, PKI and certificate lifecycle, key management, and FIPS-validated cryptographic modules. \n

• Familiarity with the NIST PQC standards (FIPS 203, 204, and 205) and the Federal PQC migration landscape, including NSM-10, OMB M-23-02, NIST transition guidance (NIST IR 8547), and applicable Executive Order requirements. \n

• Experience assessing network security against Federal frameworks and standards such as NIST SP 800-53 (e.g., SC-8, SC-12, SC-13), SP 800-52, SP 800-77, and DISA STIGs or CIS Benchmarks. \n

• Ability to analyze device configurations, packet captures, and scan output (e.g., Wireshark, Nmap, testssl.sh/sslscan) to verify cryptographic and security settings. \n

• Strong technical writing and customer communication skills. \n, * Experience supporting Federal Government enterprise networks, preferably at a civilian agency. \n

• Experience with cryptographic discovery and inventory tools or automated cryptographic asset management. \n

• Hands-on lab testing of PQC or hybrid key exchange (e.g., OpenSSL 3.5 or Open Quantum Safe libraries; hybrid TLS or IKEv2 with ML-KEM). \n

• Depth in a complementary specialty: network access control and identity integration, application-delivery security (e.g., F5/WAF), or HSM and enterprise key management. \n

• Relevant certifications such as CISSP, CCNP/CCIE Security, GIAC (e.g., GCIA), or CompTIA SecurityX (formerly CASP+). Certifications do not replace demonstrated assessment experience. \n

n \n

• Plan and conduct security assessments of enterprise network architecture and infrastructure-routers, switches, firewalls, VPN concentrators, load balancers/ADCs, wireless, NAC, and AWS cloud networking (VPC, Transit Gateway, Direct Connect)-against Federal security baselines and configuration standards. \n

• Evaluate the effectiveness of segmentation, secure connectivity, Zero Trust controls, intrusion detection/prevention, and security monitoring, and identify control gaps. \n

• Reconstruct and validate an incompletely documented As-Is network and security environment using configuration reviews, traffic analysis, scan data, and stakeholder interviews; substantiate every finding with technical evidence. \n

• Discover and inventory cryptographic usage across network technologies, including TLS (with termination and offload points), IPsec/IKEv2, SSH, MACsec, 802.1X/EAP-TLS, SNMPv3, DNSSEC, RADIUS/TACACS+, and other management-plane protocols. \n

• Analyze cryptographic implementations-key-exchange, digital-signature, and cipher-suite selections; certificate and PKI dependencies; key management and HSM integration; and FIPS 140-2/140-3 validated modules-to identify components that rely on quantum-vulnerable public-key algorithms (RSA, Diffie-Hellman, ECDH, ECDSA). \n

• Assess the impact of PQC requirements on network implementations, including larger keys and signatures affecting packet size, fragmentation, MTU, and handshake latency; hardware, ASIC, and crypto-accelerator constraints; hybrid key-establishment options; and certificate-chain and protocol interoperability. \n

• Perform vendor and product readiness assessments to determine current PQC support by platform and firmware, vendor roadmaps for NIST-standardized algorithms (ML-KEM, ML-DSA, SLH-DSA), and associated hardware or software refresh dependencies. \n

• Develop prioritized cryptographic inventories, risk assessments (including “harvest now, decrypt later” exposure for long-lived data), cryptographic-agility recommendations, and phased migration inputs aligned with applicable Federal requirements. \n

• Coordinate findings and implementation planning with the Government’s designated PQC, security, identity, application, and architecture leads. \n

• Lead discovery workshops, produce assessment reports and briefing packages, and explain and defend findings and recommendations to Government leadership. \n

\n

\n