PQC — Migration Architecture · PQC — Migration Architecture

PQC Migration & Crypto-Agility Architect

Discover cryptographic dependencies and design phased hybrid migration across PKI, TLS, VPN, code signing, identity, data protection, suppliers and mission systems.

Role mandate

Build the capability for the era ahead.

This team member will combine subject-matter depth, sound judgment and disciplined execution to move the mission from architecture to measurable results.

Responsibilities

Own the PQC — Migration Architecture workstream for PQC Migration & Crypto-Agility Architect and deliver measurable technical or operating outcomes.
Architect quantum-ready systems that integrate post-quantum cryptography, QKD and conventional network controls.
Model trust boundaries, key lifecycles, link performance and migration dependencies.
Translate current research and standards into practical enterprise and mission architectures.

Required qualifications

Experience in quantum communications, applied cryptography, photonics, network security or a closely related discipline.
Working knowledge of PQC migration, key management and secure communications architecture.
Ability to document, test and explain complex technical tradeoffs.

Preferred experience

Graduate study or equivalent research experience in quantum information, physics, electrical engineering or computer science.
Experience with regulated or mission-critical infrastructure.

Scientific and technical requirements

Physics, mathematics and engineering foundations

Applied cryptography, security reductions, KEMs, digital signatures, hash functions, entropy and protocol composition.
Module lattices and Learning With Errors for ML-KEM/ML-DSA; hash-based constructions and Merkle trees for SLH-DSA.
Discrete mathematics, modular arithmetic, polynomial rings, linear algebra, probability, constant-time implementation and side-channel analysis.

Mathematics and working equations

ML-KEM security is tied to Module-LWE: distinguish noisy linear samples b = A·s + e mod q from uniform while respecting standardized parameter sets.
Benchmark key generation, encapsulation/decapsulation, signing/verification, ciphertext/signature size, memory and cycle counts at required security levels.
Hybrid key establishment combines independent classical and post-quantum secrets through an approved KDF; prove downgrade and failure behavior.
Migration risk is prioritized by data confidentiality lifetime, system lifetime, exposure and replacement lead time—not by algorithm name alone.

Hardware, flight and infrastructure components

PQC software library, protocol endpoint, certificate authority, code-signing service, HSM or secure element, entropy source and protected key store.
Cryptographic inventory, PKI, TLS/VPN/SSH gateways, firmware update chain, identity services, APIs and constrained flight/edge processors.
Hybrid certificates/messages, algorithm negotiation, telemetry, rollback protection and recovery keys for staged migration.

Software, laboratory and analysis tools

NIST test vectors and ACVP-compatible validation, OpenSSL/provider test harnesses, protocol analyzers, fuzzers, constant-time and side-channel tooling.
Cryptographic discovery/inventory, PKI/HSM consoles, CI interoperability matrix, embedded benchmarking, packet capture and certificate analysis.

Verification and mission skills

Test ML-KEM, ML-DSA and SLH-DSA correctness, negative cases, malformed input, randomness failure, timing leakage, memory safety and zeroization.
Prove hybrid interoperability across vendors, certificate and handshake size, latency, constrained-platform limits, downgrade resistance, rotation and rollback/recovery.

Authoritative technical references

The hiring sequence will follow operating milestones and project requirements. The position may begin through advisory, consulting or project-based work before moving into a full-time role.

Send Your Resume ↗